Step 4: Implementation Plan - pci-dss-gw

Step 4: Implementation Plan - pci-dss-gw

Generated by bicep-plan agent | 2025-07-15

[!NOTE] PCI-DSS Level 1 payment gateway — 10,000 TPS sustained, 99.99% SLA target. Hub-spoke topology with CDE isolation. All 19 resources use AVM modules.

Overview

Phased Bicep implementation for a PCI-DSS Level 1 compliant payment processing platform on Azure. The architecture uses a hub-spoke network topology with dedicated CDE (Cardholder Data Environment) isolation, dual-database strategy (PostgreSQL for transactions, Cosmos DB for sessions/cache), and defense-in-depth security across all layers.

Deployment Strategy: Phased (5 phases with approval gates)

Governance: 21 active policies (3 Deny blockers resolved). 9 mandatory lowercase tags enforced by JV-Enforce Resource Group Tags v3 (Deny effect). HSM purge protection required by MCAPSGov. Classic ARM resources blocked.

Resource Inventory

AVM Coverage: 20/20 resources (100%) — all use Azure Verified Modules.

Module Structure

infra/bicep/pci-dss-gw/
├── main.bicep                    # Orchestration — phased deployment
├── main.bicepparam               # Parameter values
├── modules/
│   ├── resource-groups.bicep     # Hub + Spoke resource groups (9 tags)
│   ├── networking-hub.bicep      # Hub VNet, NSGs, DDoS plan
│   ├── networking-spoke.bicep    # Spoke VNet, NSGs, peering
│   ├── monitoring.bicep          # Log Analytics, App Insights
│   ├── identity.bicep            # User-assigned managed identity
│   ├── key-vault.bicep           # Key Vault Premium (HSM, purge-protected)
│   ├── firewall.bicep            # Azure Firewall Premium + public IP
│   ├── bastion.bicep             # Azure Bastion Standard + public IP
│   ├── postgresql.bicep          # PostgreSQL Flex E16s_v5 (zone-redundant HA)
│   ├── cosmos-db.bicep           # Cosmos DB NoSQL (autoscale 10K-50K RU/s)
│   ├── service-bus.bicep         # Service Bus Premium (1 MU)
│   ├── container-registry.bicep  # ACR Premium (geo-replication)
│   ├── aks.bicep                 # AKS Standard + KEDA + Workload Identity
│   ├── front-door.bicep          # Front Door Premium + WAF policy
│   └── api-management.bicep      # APIM Premium (VNet-integrated)
└── deploy.ps1                    # Phase-aware deployment script

Implementation Tasks

Task 1: main.bicep (Orchestration)

Purpose: Main entry point with phased deployment support

Parameters:

• environment (string, allowed: dev, staging, prod)
• location (string, default: swedencentral)
• failoverLocation (string, default: germanywestcentral)
• owner (string) — team or individual
• costCenter (string) — cost center code
• technicalContact (string) — technical contact email
• deployPhase (int, 0-5, default: 0) — 0 = all phases

Variables:

• uniqueSuffix = uniqueString(resourceGroup().id) — generated once, passed everywhere
• requiredRgTags — 9 mandatory lowercase tags (Deny-enforced)
• allTags = union(requiredRgTags, { ManagedBy: 'Bicep', Project: 'pci-dss-gw' })

Tag Block (governance-compliant):

var requiredRgTags = {
  environment: environment
  owner: owner
  costcenter: costCenter
  application: 'pci-dss-gw'
  workload: 'payment-gateway'
  sla: '99.99'
  'backup-policy': 'daily'
  'maint-window': 'Sun:02:00-06:00'
  'technical-contact': technicalContact
}

Modules Called (conditional on deployPhase):

1. modules/networking-hub.bicep (Phase 1)
2. modules/networking-spoke.bicep (Phase 1)
3. modules/monitoring.bicep (Phase 1)
4. modules/identity.bicep (Phase 1)
5. modules/key-vault.bicep (Phase 2)
6. modules/firewall.bicep (Phase 2)
7. modules/bastion.bicep (Phase 2)
8. modules/postgresql.bicep (Phase 3)
9. modules/cosmos-db.bicep (Phase 3)
10. modules/service-bus.bicep (Phase 3)
11. modules/container-registry.bicep (Phase 3)
12. modules/aks.bicep (Phase 4)
13. modules/front-door.bicep (Phase 5)
14. modules/api-management.bicep (Phase 5)

Task 2: modules/networking-hub.bicep

Purpose: Hub VNet with firewall, bastion, and gateway subnets

Resources (via AVM):

• Hub VNet (vnet-hub-pci-dss-gw-{env}, 10.0.0.0/16)
  • AzureFirewallSubnet (10.0.1.0/24)
  • AzureBastionSubnet (10.0.2.0/26)
  • GatewaySubnet (10.0.3.0/27)
• NSG for Bastion subnet (required inbound/outbound rules)
• DDoS Protection Plan (ddos-pci-dss-gw-{env})

Key Configuration:

// DDoS plan associated with hub VNet
ddosProtectionPlan: { id: ddosPlan.outputs.resourceId }

Outputs: hubVnetId, hubVnetName, firewallSubnetId, bastionSubnetId

Task 3: modules/networking-spoke.bicep

Purpose: Spoke VNet for CDE workloads with private endpoint subnets

Resources (via AVM):

• Spoke VNet (vnet-spoke-pci-dss-gw-{env}, 10.1.0.0/16)
  • snet-aks-system (10.1.0.0/22) — AKS system node pool
  • snet-aks-cde (10.1.4.0/22) — AKS CDE user node pool
  • snet-data (10.1.8.0/24) — PostgreSQL, Cosmos DB private endpoints
  • snet-apim (10.1.9.0/24) — APIM VNet integration
  • snet-pe (10.1.10.0/24) — General private endpoints
• NSGs for each subnet (deny all inbound by default, allowlist)
• VNet peering: hub ↔ spoke (bidirectional)

Key Configuration:

// APIM subnet delegation
delegation: 'Microsoft.Web/serverFarms' // For APIM VNet integration
// All data subnets: privateEndpointNetworkPolicies: 'Enabled'

Outputs: spokeVnetId, aksSystemSubnetId, aksCdeSubnetId, dataSubnetId, apimSubnetId, peSubnetId

Task 4: modules/monitoring.bicep

Purpose: Centralized observability for PCI audit requirements

Resources (via AVM):

• Log Analytics Workspace (log-pci-dss-gw-{env})
  • Retention: 365 days (PCI-DSS § 10.7)
  • SKU: PerGB2018
• Application Insights (appi-pci-dss-gw-{env})
  • Connected to Log Analytics workspace

Outputs: logAnalyticsWorkspaceId, appInsightsId, appInsightsConnectionString, appInsightsInstrumentationKey

Task 5: modules/identity.bicep

Purpose: User-assigned managed identity for service-to-service auth

Resources (via AVM):

• User Assigned Managed Identity (id-pci-dss-gw-{env})

Outputs: identityId, identityPrincipalId, identityClientId

Task 6: modules/key-vault.bicep

Purpose: HSM-backed key storage for PCI cryptographic requirements

Resources (via AVM):

• Key Vault Premium (kv-thetest-{env}-{suffix})
  • enableRbacAuthorization: true
  • enablePurgeProtection: true (MCAPSGov Deny enforced)
  • enableSoftDelete: true
  • softDeleteRetentionInDays: 90
  • publicNetworkAccess: 'Disabled'
  • Private endpoint in snet-pe
  • Diagnostic settings → Log Analytics

Key Configuration:

sku: 'premium'  // HSM-backed for PCI-DSS Req 3
enablePurgeProtection: true  // MCAPSGov Deny — MANDATORY
networkAcls: { defaultAction: 'Deny', bypass: 'AzureServices' }

Outputs: keyVaultId, keyVaultName, keyVaultUri

Task 7: modules/firewall.bicep

Purpose: Network IDPS and east-west traffic inspection for PCI Req 1

Resources (via AVM):

• Public IP (pip-fw-pci-dss-gw-{env}, Standard, Static, Zone 1,2,3)
• Azure Firewall Premium (fw-pci-dss-gw-{env})
  • IDPS enabled (Alert & Deny mode)
  • TLS inspection enabled
  • Firewall Policy with rule collection groups
  • Zone-redundant (zones 1, 2, 3)
  • Diagnostic settings → Log Analytics

Outputs: firewallPrivateIp, firewallId

Task 8: modules/bastion.bicep

Purpose: Secure administrative access without public IPs on VMs

Resources (via AVM):

• Public IP (pip-bas-pci-dss-gw-{env}, Standard, Static)
• Bastion Host Standard (bas-pci-dss-gw-{env})
  • Native client support enabled
  • File copy enabled
  • IP connect enabled

Outputs: bastionId

Task 9: modules/postgresql.bicep

Purpose: Primary transactional database for payment processing

Resources (via AVM):

• PostgreSQL Flexible Server (psql-pci-dss-gw-{env})
  • SKU: MemoryOptimized, E16s_v5 (16 vCores, 128 GB RAM)
  • HA: Zone-redundant
  • Storage: 512 GB, auto-grow enabled
  • Backup: 35-day retention, geo-redundant
  • Authentication: Azure AD + password (PostgreSQL requires password)
  • Private endpoint in snet-data
  • PgBouncer: enabled (built-in connection pooling)
  • Diagnostic settings → Log Analytics

Key Configuration:

highAvailability: { mode: 'ZoneRedundant' }
backup: { backupRetentionDays: 35, geoRedundantBackup: 'Enabled' }

Outputs: postgresqlFqdn, postgresqlId

Task 10: modules/cosmos-db.bicep

Purpose: Session state and cache store with sub-10ms reads

Resources (via AVM):

• Cosmos DB Account (cosmos-pci-dss-gw-{env})
  • API: NoSQL
  • Consistency: Session
  • Autoscale: 10,000 — 50,000 RU/s
  • Backup: Continuous (PITR)
  • Public network access: Disabled
  • Private endpoint in snet-data
  • Diagnostic settings → Log Analytics

Key Configuration:

consistencyPolicy: { defaultConsistencyLevel: 'Session' }
databaseAccountOfferType: 'Standard'
enableAutomaticFailover: true

Outputs: cosmosDbEndpoint, cosmosDbId

Task 11: modules/service-bus.bicep

Purpose: Reliable message queuing for async payment processing

Resources (via AVM):

• Service Bus Namespace Premium (sb-pci-dss-gw-{env})
  • 1 Messaging Unit
  • Zone-redundant
  • Private endpoint in snet-pe
  • Queues: payment-transactions, payment-notifications
  • Dead-letter queue enabled per queue
  • Diagnostic settings → Log Analytics

Outputs: serviceBusId, serviceBusEndpoint

Task 12: modules/container-registry.bicep

Purpose: Private container image storage with vulnerability scanning

Resources (via AVM):

• Container Registry Premium (crthetest{env}{suffix})
  • Zone-redundant
  • Content trust enabled
  • Geo-replication to germanywestcentral
  • Public network access: Disabled
  • Private endpoint in snet-pe
  • Diagnostic settings → Log Analytics

Outputs: acrId, acrLoginServer

Task 13: modules/aks.bicep

Purpose: Kubernetes cluster for CDE payment workloads

Resources (via AVM):

• AKS Managed Cluster Standard (aks-pci-dss-gw-{env})
  • System node pool: Standard_D4s_v5 × 3 (zones 1,2,3)
  • CDE user node pool: Standard_D8s_v5 × 3-20 (KEDA autoscaler)
  • Network plugin: Azure CNI Overlay
  • Network policy: Calico
  • Workload Identity enabled
  • OIDC Issuer enabled
  • KEDA add-on enabled
  • Defender profile enabled
  • Azure Policy add-on enabled
  • Diagnostic settings → Log Analytics
  • ACR integration (attach)

Key Configuration:

sku: { name: 'Standard', tier: 'Standard' }
agentPoolProfiles: [
  { name: 'system', vmSize: 'Standard_D4s_v5', count: 3 }
  { name: 'cde', vmSize: 'Standard_D8s_v5', minCount: 3, maxCount: 20 }
]
networkProfile: { networkPlugin: 'azure', networkPolicy: 'calico' }

[!WARNING] MCAPSGov Deny limits AKS to 10 agent pools (2 planned — compliant). Verify VMSS node count limit does not conflict with autoscaler max (20).

Outputs: aksClusterName, aksOidcIssuerUrl, kubeletIdentityObjectId

Task 14: modules/front-door.bicep

Purpose: Global edge security with WAF and DDoS protection

Resources (via AVM):

• Front Door Premium (fd-pci-dss-gw-{env})
  • WAF policy: OWASP 3.2 ruleset, bot protection
  • Origin group: AKS ingress (private link)
  • Custom domains (if applicable)
  • Diagnostic settings → Log Analytics

Outputs: frontDoorId, frontDoorEndpoint

Task 15: modules/api-management.bicep

Purpose: API gateway inside CDE with OAuth, rate limiting

Resources (via AVM):

• APIM Premium (apim-pci-dss-gw-{env})
  • 1 unit
  • VNet integration mode: Internal
  • Subnet: snet-apim
  • Application Insights logger
  • Named values for Key Vault secrets
  • Diagnostic settings → Log Analytics

[!NOTE] APIM Premium deployment takes 30-45 minutes. Plan accordingly for Phase 5.

Outputs: apimGatewayUrl, apimId

Task 16: deploy.ps1 (Phase-Aware Deployment Script)

Features:

• Parameter: -Phase (0-5, default 0 = all phases)
• Parameter validation (environment, location)
• Bicep lint and build verification before deployment
• What-If preview with user confirmation per phase
• Phase-sequential execution with approval gates
• Deployment output capture and display
• Error handling with rollback guidance
• Timing per phase

Phase Mapping:

$phases = @{
    1 = 'Foundation (VNets, NSGs, DDoS, Monitoring, Identity)'
    2 = 'Security (Key Vault, Firewall, Bastion)'
    3 = 'Data (PostgreSQL, Cosmos DB, Service Bus, ACR)'
    4 = 'Compute (AKS)'
    5 = 'Edge/Integration (Front Door, APIM)'
}

Deployment Phases

Deployment strategy: Phased (chosen during planning)

Phase 1: Foundation

Estimated Deploy Time: 5-8 minutes

Approval Gate: Verify network topology — hub-spoke peering active, DDoS plan associated, Log Analytics ingesting, managed identity created. Run:

az network vnet peering list -g rg-pci-dss-gw-{env} --vnet-name vnet-hub-pci-dss-gw-{env}
az monitor log-analytics workspace show -g rg-pci-dss-gw-{env} -n log-pci-dss-gw-{env}

Phase 2: Security

Estimated Deploy Time: 8-12 minutes

Approval Gate: Verify security controls — Key Vault purge protection (MCAPSGov blocker), Firewall IDPS mode, private endpoint connectivity. Run:

az keyvault show -n kv-thetest-{env}-{suffix} --query "properties.enablePurgeProtection"
az network firewall show -g rg-pci-dss-gw-{env} -n fw-pci-dss-gw-{env} --query "sku.tier"

Phase 3: Data

Estimated Deploy Time: 15-20 minutes

Approval Gate: Verify data tier — PostgreSQL HA status, Cosmos DB consistency, Service Bus queues, ACR geo-replication. Run:

az postgres flexible-server show -g rg-pci-dss-gw-{env} -n psql-pci-dss-gw-{env} \
  --query "highAvailability"
az cosmosdb show -g rg-pci-dss-gw-{env} -n cosmos-pci-dss-gw-{env} \
  --query "consistencyPolicy"

Phase 4: Compute

Estimated Deploy Time: 10-15 minutes

Approval Gate: Verify AKS cluster — node pools running, KEDA enabled, ACR attached, workload identity configured. Run:

az aks show -g rg-pci-dss-gw-{env} -n aks-pci-dss-gw-{env} \
  --query "{pools:agentPoolProfiles[].{name:name,count:count,vmSize:vmSize}}"
az aks addon show -g rg-pci-dss-gw-{env} -n aks-pci-dss-gw-{env} -a keda

Phase 5: Edge & Integration

Estimated Deploy Time: 35-50 minutes (APIM is slow)

Approval Gate: Verify edge tier — Front Door endpoint responding, WAF policy active, APIM gateway reachable internally. Run:

az afd profile show -g rg-pci-dss-gw-{env} --profile-name fd-pci-dss-gw-{env}
az apim show -g rg-pci-dss-gw-{env} -n apim-pci-dss-gw-{env} \
  --query "virtualNetworkType"

Phase Summary

Dependency Graph

%%{init: {'theme':'neutral'}}%%
graph TD
    subgraph "Phase 1: Foundation"
        RG[Resource Groups<br/>9 tags enforced] --> HUB[Hub VNet + NSGs]
        RG --> SPOKE[Spoke VNet + NSGs]
        RG --> DDOS[DDoS Protection Plan]
        RG --> LOG[Log Analytics<br/>365-day retention]
        RG --> ID[Managed Identity]
        HUB --> PEER[VNet Peering]
        SPOKE --> PEER
        DDOS --> HUB
        LOG --> APPI[App Insights]
    end

    subgraph "Phase 2: Security"
        HUB --> FW[Azure Firewall Premium<br/>IDPS enabled]
        HUB --> BAS[Azure Bastion Standard]
        SPOKE --> KV[Key Vault Premium<br/>HSM + purge protection]
        ID --> KV
    end

    subgraph "Phase 3: Data"
        SPOKE --> PSQL[PostgreSQL Flex<br/>E16s_v5 HA]
        SPOKE --> COSMOS[Cosmos DB NoSQL<br/>10K-50K RU/s]
        SPOKE --> SB[Service Bus Premium<br/>1 MU]
        SPOKE --> ACR[ACR Premium<br/>Geo-replicated]
        KV --> PSQL
        KV --> COSMOS
        KV --> SB
    end

    subgraph "Phase 4: Compute"
        SPOKE --> AKS[AKS Standard<br/>D4s+D8s_v5 nodes]
        ACR --> AKS
        KV --> AKS
        LOG --> AKS
        ID --> AKS
    end

    subgraph "Phase 5: Edge"
        AKS --> FD[Front Door Premium<br/>WAF + DDoS]
        SPOKE --> APIM[APIM Premium<br/>VNet-integrated]
        KV --> APIM
        APPI --> APIM
    end

Naming Conventions

Security Configuration

Estimated Implementation Time

Approval Gate

[!IMPORTANT] Implementation Plan Ready

• 20 Azure resources planned across 15 Bicep modules
• 20/20 use AVM modules (100% coverage)
• 3 governance blockers resolved (9 tags, HSM purge, AKS pool limit)
• 5 deployment phases with approval gates between each
• CAF naming conventions applied to all resources
• Estimated deployment: ~73-105 minutes (all phases)
• Estimated implementation: ~7.5 hours

Reply "approve" to proceed to bicep-code, or provide feedback.

References

[!NOTE] The following Microsoft Learn resources inform this implementation.

Plan generated by bicep-plan agent following Azure Well-Architected Framework guidelines.