# 1542 07 Compliance Matrix 51e7bcad > βš–οΈ Compliance Matrix: terraform-e2e - Skill: `tools-only/1542-07-compliance-matrix-51e7bcad` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add tools-only/1542-07-compliance-matrix-51e7bcad` - Raw SKILL.md: https://api.skillmd.com/api/skills/tools-only/1542-07-compliance-matrix-51e7bcad/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tools-only (https://skillmd.com/u/tools-only) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/tools-only/1542-07-compliance-matrix-51e7bcad --- # βš–οΈ Compliance Matrix: terraform-e2e ![Step](https://img.shields.io/badge/Step-7f-blue?style=for-the-badge) ![Status](https://img.shields.io/badge/Status-Draft-orange?style=for-the-badge) ![Agent](https://img.shields.io/badge/Agent-As--Built-purple?style=for-the-badge)
πŸ“‘ Compliance Contents - [πŸ“‹ Executive Summary](#-executive-summary) - [πŸ—ΊοΈ 1. Control Mapping](#️-1-control-mapping) - [πŸ” 2. Gap Analysis](#-2-gap-analysis) - [πŸ“ 3. Evidence Collection](#-3-evidence-collection) - [πŸ“ 4. Audit Trail](#-4-audit-trail) - [πŸ”§ 5. Remediation Tracker](#-5-remediation-tracker) - [πŸ“Ž 6. Appendix](#-6-appendix) - [References](#references)
> Generated by as-built agent | 2026-02-26
| ⬅️ Previous | πŸ“‘ Index | Next ➑️ | | -------------------------------------------- | ------------------- | ------------------------------------------------ | | [07-backup-dr-plan.md](07-backup-dr-plan.md) | [README](README.md) | [07-ab-cost-estimate.md](07-ab-cost-estimate.md) |
**Generated**: 2026-02-26 **Version**: 1.0 **Environment**: dev **Primary Compliance Framework**: GDPR + Azure Policy baseline --- ## πŸ“‹ Executive Summary This matrix maps as-built controls to requirements from project artifacts and enforced Azure Policies. | Compliance Area | Coverage | Status | | --------------- | -------- | ------ | | Network Security | 80% | βœ… | | Data Protection | 85% | βœ… | | Access Control | 85% | βœ… | | Monitoring & Audit | 80% | βœ… | | Incident Response | 70% | ⚠️ | | Overall | 80% | βœ… | --- ## πŸ—ΊοΈ 1. Control Mapping ### Requirement 1: Governance Policy Compliance | Control | Requirement | Implementation | Status | | ------- | ----------- | -------------- | ------ | | Allowed locations | Deploy only in approved regions | Resources deployed in `swedencentral` (plus global alert rule) | βœ… | | Required resource tags | `Environment`, `Project` enforced | Applied to deployed resources (`Environment=dev`, `Project=terraform-e2e`) | βœ… | | Required RG tags | 9 lowercase tags enforced | RG tagging model implemented in Terraform locals | βœ… | ### Requirement 2: Secure Application Platform | Control | Requirement | Implementation | Status | | ------- | ----------- | -------------- | ------ | | Web HTTPS | App Service must be HTTPS-only | Both web apps deployed with `https_only = true` | βœ… | | SQL AAD-only | SQL server must use AAD-only auth | `azureADOnlyAuthentication = true` in deployed SQL server | βœ… | | TLS baseline | SQL minimum TLS 1.2 | `minimalTlsVersion = 1.2` on SQL server | βœ… | | Key Vault hardening | RBAC + purge protection | `enableRbacAuthorization = true`, purge protection enabled | βœ… | ### Requirement 3: Monitoring and Operations | Control | Requirement | Implementation | Status | | ------- | ----------- | -------------- | ------ | | Centralized telemetry | App + platform logs | App Insights linked to Log Analytics workspace | βœ… | | Alerting | Failure anomaly detection | Smart detector alert rule enabled | βœ… | | Operational runbooks | Day-2 guidance | Documented in [07-operations-runbook.md](./07-operations-runbook.md) | βœ… | --- ## πŸ” 2. Gap Analysis | Gap | Severity | Risk Level | Remediation | Timeline | | --- | -------- | ---------- | ----------- | -------- | | Single-region deployment | 🟑 | Medium | Implement warm standby pattern in secondary EU region | Before production | | Broad SQL RBAC role (`Contributor`) | 🟑 | Medium | Narrow to least-privilege SQL roles | Next sprint | | No private endpoints | 🟒 | Low (dev), Medium (prod) | Add private endpoints + VNet integration for production | Before production | | Manual DR orchestration | 🟑 | Medium | Automate failover runbook and test quarterly | Next quarter | --- ## πŸ“ 3. Evidence Collection | Control | Evidence Type | Location | Last Collected | | ------- | ------------- | -------- | -------------- | | Deployment outcomes | Deployment summary | [06-deployment-summary.md](./06-deployment-summary.md) | 2026-02-26 | | Resource configuration | Inventory snapshot | [07-resource-inventory.md](./07-resource-inventory.md) | 2026-02-26 | | Policy constraints | Governance artifact | [04-governance-constraints.md](./04-governance-constraints.md) | 2026-02-26 | | Terraform control definitions | IaC source | [../../infra/terraform/terraform-e2e/main.tf](../../infra/terraform/terraform-e2e/main.tf) | 2026-02-26 | --- ## πŸ“ 4. Audit Trail | Date | Auditor | Finding | Status | Commit | | ---- | ------- | ------- | ------ | ------ | | 2026-02-26 | as-built agent | Step 7 compliance mapping created from deployed state | βœ… Complete | N/A | --- ## πŸ”§ 5. Remediation Tracker | Finding | Owner | Due Date | Status | | ------- | ----- | -------- | ------ | | Replace broad SQL scope role with least privilege | Platform engineering | 2026-03-31 | πŸ”„ In Progress | | Define production private networking baseline | Architecture + Security | 2026-04-30 | ⬜ Todo | | Run DR simulation and capture evidence | Operations | 2026-05-15 | ⬜ Todo | --- ## πŸ“Ž 6. Appendix ### A. Compliance Framework Reference - GDPR applicability identified in requirements and architecture artifacts. - Azure Policy baseline controls enforced at subscription/management-group scopes. ### B. Azure Security Baseline Mapping - HTTPS-only web apps: implemented - AAD-only SQL auth: implemented - Managed identity usage: implemented - Centralized monitoring: implemented - Private networking hardening: deferred to production posture --- ## References | Topic | Link | | ----- | ---- | | Microsoft Cloud Security Benchmark | [Overview](https://learn.microsoft.com/security/benchmark/azure/overview) | | Azure Policy | [Policy overview](https://learn.microsoft.com/azure/governance/policy/overview) | | Azure compliance offerings | [Compliance](https://learn.microsoft.com/azure/compliance/) | ---
| ⬅️ [07-backup-dr-plan.md](07-backup-dr-plan.md) | 🏠 [Project Index](README.md) | ➑️ [07-ab-cost-estimate.md](07-ab-cost-estimate.md) | | ----------------------------------------------- | ----------------------------- | --------------------------------------------------- |