tools-only ⚖️ Compliance Matrix: terraform-e2e
- 📋 Executive Summary
- 🗺️ 1. Control Mapping
- 🔍 2. Gap Analysis
- 📁 3. Evidence Collection
- 📝 4. Audit Trail
- 🔧 5. Remediation Tracker
- 📎 6. Appendix
- References
Generated by as-built agent | 2026-02-26
| ⬅️ Previous | 📑 Index | Next ➡️ |
|---|---|---|
| 07-backup-dr-plan.md | README | 07-ab-cost-estimate.md |
Generated: 2026-02-26 Version: 1.0 Environment: dev Primary Compliance Framework: GDPR + Azure Policy baseline
📋 Executive Summary
This matrix maps as-built controls to requirements from project artifacts and enforced Azure Policies.
| Compliance Area | Coverage | Status |
|---|---|---|
| Network Security | 80% | ✅ |
| Data Protection | 85% | ✅ |
| Access Control | 85% | ✅ |
| Monitoring & Audit | 80% | ✅ |
| Incident Response | 70% | ⚠️ |
| Overall | 80% | ✅ |
🗺️ 1. Control Mapping
Requirement 1: Governance Policy Compliance
| Control | Requirement | Implementation | Status |
|---|---|---|---|
| Allowed locations | Deploy only in approved regions | Resources deployed in swedencentral (plus global alert rule) |
✅ |
| Required resource tags | Environment, Project enforced |
Applied to deployed resources (Environment=dev, Project=terraform-e2e) |
✅ |
| Required RG tags | 9 lowercase tags enforced | RG tagging model implemented in Terraform locals | ✅ |
Requirement 2: Secure Application Platform
| Control | Requirement | Implementation | Status |
|---|---|---|---|
| Web HTTPS | App Service must be HTTPS-only | Both web apps deployed with https_only = true |
✅ |
| SQL AAD-only | SQL server must use AAD-only auth | azureADOnlyAuthentication = true in deployed SQL server |
✅ |
| TLS baseline | SQL minimum TLS 1.2 | minimalTlsVersion = 1.2 on SQL server |
✅ |
| Key Vault hardening | RBAC + purge protection | enableRbacAuthorization = true, purge protection enabled |
✅ |
Requirement 3: Monitoring and Operations
| Control | Requirement | Implementation | Status |
|---|---|---|---|
| Centralized telemetry | App + platform logs | App Insights linked to Log Analytics workspace | ✅ |
| Alerting | Failure anomaly detection | Smart detector alert rule enabled | ✅ |
| Operational runbooks | Day-2 guidance | Documented in 07-operations-runbook.md | ✅ |
🔍 2. Gap Analysis
| Gap | Severity | Risk Level | Remediation | Timeline |
|---|---|---|---|---|
| Single-region deployment | 🟡 | Medium | Implement warm standby pattern in secondary EU region | Before production |
Broad SQL RBAC role (Contributor) |
🟡 | Medium | Narrow to least-privilege SQL roles | Next sprint |
| No private endpoints | 🟢 | Low (dev), Medium (prod) | Add private endpoints + VNet integration for production | Before production |
| Manual DR orchestration | 🟡 | Medium | Automate failover runbook and test quarterly | Next quarter |
📁 3. Evidence Collection
| Control | Evidence Type | Location | Last Collected |
|---|---|---|---|
| Deployment outcomes | Deployment summary | 06-deployment-summary.md | 2026-02-26 |
| Resource configuration | Inventory snapshot | 07-resource-inventory.md | 2026-02-26 |
| Policy constraints | Governance artifact | 04-governance-constraints.md | 2026-02-26 |
| Terraform control definitions | IaC source | ../../infra/terraform/terraform-e2e/main.tf | 2026-02-26 |
📝 4. Audit Trail
| Date | Auditor | Finding | Status | Commit |
|---|---|---|---|---|
| 2026-02-26 | as-built agent | Step 7 compliance mapping created from deployed state | ✅ Complete | N/A |
🔧 5. Remediation Tracker
| Finding | Owner | Due Date | Status |
|---|---|---|---|
| Replace broad SQL scope role with least privilege | Platform engineering | 2026-03-31 | 🔄 In Progress |
| Define production private networking baseline | Architecture + Security | 2026-04-30 | ⬜ Todo |
| Run DR simulation and capture evidence | Operations | 2026-05-15 | ⬜ Todo |
📎 6. Appendix
A. Compliance Framework Reference
- GDPR applicability identified in requirements and architecture artifacts.
- Azure Policy baseline controls enforced at subscription/management-group scopes.
B. Azure Security Baseline Mapping
- HTTPS-only web apps: implemented
- AAD-only SQL auth: implemented
- Managed identity usage: implemented
- Centralized monitoring: implemented
- Private networking hardening: deferred to production posture
References
| Topic | Link |
|---|---|
| Microsoft Cloud Security Benchmark | Overview |
| Azure Policy | Policy overview |
| Azure compliance offerings | Compliance |
| ⬅️ 07-backup-dr-plan.md | 🏠 Project Index | ➡️ 07-ab-cost-estimate.md |
|---|