Dom Fradley
- ▸ firewall-rules-nobody-can-explain.md · 17 sep 2026
Don't migrate a firewall rule nobody can explain
FireMon's June 2026 analysis of 9.2 million firewall policy checks found 69% of rules unused and 45% with no owner or documentation. Migrations usually copy that kind of ruleset into the new landing zone, because a copied rule breaks nothing on cutover night. Rebuild it from sixty days of VNet flow logs instead, and give a flow a rule only when somebody can say what it is for.
read → - ▸ half-built-landing-zone.md · 7 sep 2026
What to finish first in a half-built landing zone
A platform with sound foundations underneath it and four unfinished corners on top, with workloads still landing while you decide what to fix. Ranking the gaps by risk gives you an order you cannot defend the first time delivery comes asking for your engineers. Ranking them by how much each one costs to close after another quarter gives you one you can.
read → - ▸ delete-the-secret-dont-rotate-it.md · 21 aug 2026
Delete the secret, don't rotate it
GitGuardian found 64% of the valid secrets they reported to owners in 2022 were still working this January, and that 59% of compromised machines in their incident data were CI/CD runners. Rotation is losing. Azure DevOps has also put a date in the calendar: the old issuer for workload identity service connections retires on 1 July 2027. What to convert your service connections to, how to do the whole project in one pass, and the query that finds every secret you are still holding.
read → - ▸ lift-and-shift-end-date.md · 18 aug 2026
Lift-and-shift with a written end date
Rehost or re-architect gets argued as a matter of taste, and the deciding variable is commercial rather than technical: how long the workload has left, and whether it will change while it lasts. Lift-and-shift is a legitimate move with a written end date and a liability without one. Here is how to make that date something the estate can answer for itself.
read → - ▸ llm-endpoints-new-public-storage.md · 13 aug 2026
LLM endpoints are the new public storage accounts
Credential theft aimed at AI services rose 376% in a quarter, and Microsoft is in court with a group that resold stolen Azure OpenAI access. The LLM endpoint is this decade's default-shaped misconfiguration: deployed like an experiment, billed like a utility, and secured with a key from demo day. The three ways to host a model in Azure, and the controls you already own that make a stolen key worthless.
read → - ▸ tfpolicy-quiet-successor.md · 10 aug 2026
tfpolicy: HashiCorp's quiet successor to Sentinel
HashiCorp's new tfpolicy framework puts Terraform governance in Terraform's own language, in public beta now. Sentinel is still supported, and there is a new AI tool for converting Sentinel policies to the new format. Here is how a decision maker should read that, and the questions to ask before the beta hardens.
read → - ▸ azure-policy-out-of-the-box.md · 6 aug 2026
Azure Policy out of the box: 5,000 guardrails you already own
Microsoft ships just over 5,000 ready-written policy rules and about 270 grouped rule-sets with every Azure subscription, mapped to ISO 27001, NIST, PCI DSS and the UK OFFICIAL controls. They cost nothing to run, and the assignment count in your own subscription is a two-minute check.
read → - ▸ clickops-to-code.md · 3 aug 2026
From ClickOps to code, without the big-bang rewrite
Hand-built estates stay hand-built because everyone prices the fix as a rewrite. You can put Terraform in charge of what already exists, in place, without rebuilding any of it. Here's the order of attack.
read → - ▸ ai-capex-audit-platform-team.md · 28 jul 2026
The AI capex audit lands on the platform team
Markets stopped applauding AI infrastructure spend this month and started asking what it returns. That question travels down the org chart until it reaches whoever can answer it, and the Terraform tooling that answers it shipped in the last two weeks.
read → - ▸ azure-iac-july-2026.md · 27 jul 2026
This month in Azure IaC: AVM landing zones go GA, azurerm 4.81, OpenTofu 1.12
A short monthly round-up of what changed in Terraform, the Azure provider and the wider IaC world, in plain English, with why each one matters. July 2026.
read → - ▸ pricing-the-design.md · 27 jul 2026
Your architect should be able to price the design
A cloud design that ships without a cost is half a design. Why owning the number produces better architecture, and the one question a leader should always ask.
read → - ▸ identity-is-the-perimeter.md · 26 jul 2026
Identity is your security perimeter now
The firewall stopped being the front door a while ago. In a cloud estate, identity is where an attacker gets in or gets stopped, so it's where the design attention belongs.
read → - ▸ virtual-wan-vs-hub-and-spoke.md · 25 jul 2026
Virtual WAN vs hub-and-spoke: a cost-of-management decision
Virtual WAN gets picked because it sounds like the grown-up option. Here's the actual trade against hub-and-spoke, and how to decide it on arithmetic rather than instinct.
read → - ▸ is-your-cloud-under-control.md · 24 jul 2026
Five questions that tell you if your cloud is under control
You don't need to read Terraform to know whether your cloud estate is in good shape. Five plain questions, and what a confident answer sounds like.
read → - ▸ cloud-cost-as-a-design-decision.md · 23 jul 2026
Make your Azure bill predictable: cost as a design decision
A shocking cloud bill is usually a governance gap, not a pricing problem. Here's how to make spend a design decision so the invoice stops surprising you.
read → - ▸ find-public-storage.md · 22 jul 2026
Find your public-facing storage before someone else does
A storage account open to the public is a common way cloud data leaks. Find every one across your estate in about thirty seconds with one query.
read → - ▸ allowed-locations-policy.md · 21 jul 2026
Keep Azure in the right regions: the allowed-locations policy
Stop resources landing in the wrong region. Azure's built-in allowed-locations policy is a real compliance control you can assign in a few lines of Terraform.
read → - ▸ resource-locks-prevent-deletion.md · 20 jul 2026
Stop someone deleting prod: resource locks in one line
Someone runs az group delete on the wrong resource group and prod is gone. A resource lock is the cheapest insurance in Azure, and it's one command.
read → - ▸ budget-alerts-as-code.md · 19 jul 2026
Never get surprised by the Azure bill: budget alerts as code
The worst way to learn your spend doubled is the invoice. A monthly budget with an alert, in a few lines of Terraform, turns a surprise into an email at 80%.
read → - ▸ enforce-azure-tags-as-code.md · 18 jul 2026
Untagged Azure resources: find them today, enforce tags as code tomorrow
Every Azure estate drifts into untagged chaos. Two moves any admin can run this week: find every untagged resource with one query, then stop it happening again with a policy defined as code.
read → - ▸ what-is-infrastructure-as-code.md · 17 jul 2026
Infrastructure as Code, explained: why serious Azure teams stopped clicking around
You start in the Azure portal, clicking. It works, right up until you need to do it again. A friendly on-ramp to Infrastructure as Code, and the idea that changes how you build.
read →