Continuous Integration and Deployment
Black Lung utilizes an Azure DevOps repository to hold the code for all Azure cloud infrastructure. Through this repository a series of pipelines run to achieve continuous integration and deployment across the Black Lung Azure cloud environment through service connections.
Pipelines
Each repository has the following pipelines. Note, these pipelines can only act upon resources that they’ve deployed. It will not track, change, or destroy resources deployed manually or by other pipelines.
| Pipeline | Description |
|---|---|
| Black Lung Dev/Prod | Runs when a code push is approved to the master branch. |
| Drift Check | Runs once a day and scans the Azure environment for any differences between what’s deployed and what’s in the repository. If any are found it will change the environment to match the repository and notify relevant parties. |
| Tear Down | Must be initiated manually by privileged user(s). Will run a basic terraform destroy command against the azure environment. |
Terraform
Inside each repository all terraform files are held under a single directory. These terraform files can be generalized as context files and deployment files. Context files supply information like naming conventions, variables, versions, and project configuration files. Deployment files are responsible for reading context and deploying required resources as listed by the context. Any example of a deployment file would be static_site, which is responsible for deploying all Black Lung static websites. Project configuration files are used to indicated if they’re enabled, what terraform deployment file is used to deploy the project, and any relevant parameters.
Security
| Standard / Regulation | Requirement | Requirement Description | How I Am or Am Not in Compliance |
|---|---|---|---|
| ISO 27001 | A.9.1.1 / A.9.2.1 — Access Control Policy & User Access | CI/CD service connections must use Managed Identity or service principals with least-privilege RBAC. No standing credentials in pipeline variables. | Compliant Azure DevOps service connection uses Managed Identity scoped to resource group. |
| ISO 27001 | A.12.6.1 — Management of Technical Vulnerabilities | Terraform provider versions must be pinned; IaC scanning (tfsec/checkov) must run in pipeline. Pipeline agents must be patched regularly. | Compliant provider versions are pinned and a static analysis step is ran in the pipeline. |
| SOC 2 | CC7.3 — Incident Response | Infrastructure must be recoverable from a known-good state. A redeployment runbook must exist. | Compliant — Terraform + Azure DevOps provides version-controlled, reproducible deployments. Document the rollback procedure if not already written. |
| NIST SP 800-53 | AC-3 — Access Enforcement | RBAC must enforce least privilege on all Azure resources (storage account, Front Door, resource groups). | Compliant the service principal has only the roles it needs (e.g., Storage Blob Data Contributor on the specific resource group). |
| NIST SP 800-53 | CM-2 / CM-3 — Baseline Configuration & Configuration Change Control | Infrastructure must be defined as code with version control and an approved change process. | Compliant — Terraform + Azure DevOps provides this. Document the approval process for config changes if not already done. |
| CIS Azure Benchmark | 2.9 — Azure Policy Tag Enforcement | Azure Policy must enforce resource tagging. | Not compliant no Azure Policy enforces tagging. This feature is still under development |