Define IaC security baseline standards and approved modules
Implementation Effort: Medium – Defining minimum security requirements and publishing approved Bicep, ARM, and Terraform modules requires coordination between security and infrastructure teams. User Impact: Low – Setting IaC baseline standards and curating approved modules is a security and platform-team activity; end users are not affected. Lifecycle Stage: Build
Overview
Define infrastructure-as-code security baseline standards and require teams to use approved reusable modules so secure defaults are inherited instead of reimplemented repository by repository.
Infrastructure as Code gives development teams the power to provision cloud resources — networks, databases, identity configurations, and storage accounts — through template files checked into source control. That power becomes a liability when every team writes templates from scratch without shared security requirements. The result is inconsistency: one team's storage template enforces private endpoints and encryption at rest, while another team's template deploys a publicly accessible account with default settings.
Define the minimum security requirements that every template must meet, including network isolation, encryption, identity and access configuration, logging, and tagging. For Azure-specific patterns, publish approved Bicep or ARM modules by using Azure Verified Modules or an internal curated fork so teams start from secure defaults. For Terraform, use a governed private module registry or approved internal catalog so teams consume pre-validated modules rather than raw resource definitions. Validate templates before deployment with Microsoft Defender for Cloud IaC scanning, and use Azure Policy at deployment time to deny or audit noncompliant resources. Enforcing secure-by-default baselines supports Assume breach, since consistent network isolation, encryption, and least-privilege identity configuration limit the blast radius when any single resource is compromised.