Private-Network Cloud Platform as Code

The situation

The platform handles member data and payments with a two-person team. The first version ran on public endpoints because that is how you ship in week one. Before paid launch, the estate needed to be private, auditable, and impossible to misconfigure by hand.

What I built

Everything lives in one virtual network. Inbound traffic hits Front Door with a WAF in prevention mode and reaches the container environment only over Private Link; public access on the environment is disabled. Outbound traffic from the app, CI runner, and management subnets is forced through an Azure Firewall whose rules are generated from a YAML allowlist in the repo. A CI guard reconciles that file against every outbound hostname in the code, and another guard fails any template that could reopen public access.

PostgreSQL, Key Vault, the container registry, and storage sit behind six private endpoints with private DNS. Human access goes through Bastion to a jump host that is deallocated between uses. Workloads authenticate with 12 managed identities and CI with OIDC pinned to the main branch, so no secret a human could copy exists.

On top of the network sits detection: about forty KQL alert rules across identity, data plane, network, control plane, liveness, and cost, plus two watchers that check the DNS security layer and the secrets vault every 15 minutes. Every rule is delete-locked and has a documented trigger that produces a known email. After the edge firewall silently swallowed the alert relay for five days, a daily heartbeat and a silent-pipeline rule joined the set.

The outcome

The cutover from public to private ran over one week with no member-facing downtime. The estate has no reachable data service from the internet, and "no email" can never be mistaken for "nothing happened."

Stack