Deploy policy-as-code for critical Azure resources
Implementation Effort: Medium – Storing Azure Policy in source control, testing it, and wiring assignment and remediation into pipelines takes coordination between platform, security, and DevOps teams.
User Impact: Low – Policy authoring and enforcement are administrator actions on Azure scopes; application end users are not affected.
Lifecycle Stage: Deploy
Overview
Deploy policy-as-code for critical Azure resources so CI/CD pipelines can test, review, and enforce Azure Policy before insecure infrastructure reaches production. This task focuses on integrating policy-as-code into source control and delivery workflows. The Infrastructure pillar defines the enterprise policy baseline and longer-term governance ownership.
When infrastructure is provisioned through CI/CD pipelines, the speed of deployment can outpace the speed of security review. A single misconfigured resource — a storage account with public access, a virtual machine without encryption, or a network security group with an open management port — can create an entry point that threat actors discover quickly.
Policy-as-code encodes security and compliance requirements as machine-evaluable rules enforced automatically before or during resource deployment. Azure Policy provides built-in and custom policy definitions that can audit, deny, or automatically remediate non-compliant configurations.
Use deny-effect policies as a backstop that holds even when a change does not flow through the approved pipeline. Pair allowed-location, allowed-SKU, required-tag, and configuration-baseline policies with deny effects on production scopes so that a resource created or modified outside the governed deployment path — for example by a developer with direct portal or CLI access — is rejected rather than merely flagged after the fact. This reinforces the deployment-trust boundary established for CI/CD: the pipeline identity is the supported route to production, and policy denies what tries to go around it.
Treat policies as code: store Azure Policy definitions and assignments in source control, test them before deployment, and manage them through Azure Policy as Code workflows or Enterprise Policy as Code (EPAC). Platform and security teams define the baseline policies and exemptions. DevOps teams integrate validation, deployment, and remediation steps into pipelines so policy changes follow the same review and automation model as application and IaC changes.
Without policy-as-code, security becomes a human-dependent process in an automated pipeline. Misconfigurations persist until a periodic audit or until a threat actor exploits them. Enforcing policy automatically before resources reach production applies Verify explicitly, and using deny-effect policies as a backstop for changes that bypass the pipeline reflects Assume breach.