Static Sites
The static site project was created in order for Black Lung Ink to be able to deploy websites containing basic functionality and information in a rapid, systematic style. Each website can be deployed in several different infrastructures that balances security and content delivery against cost.
Design
Each static site has the following configurations contained inside their configuration yaml files. All projects, whether static sites or otherwise, must have this configuration file to have any resources deployed.
| Configuration | Required | Values | Description |
|---|---|---|---|
| name | yes | any | name of the website project. This name will be used for naming all resources deployed for the static website. |
| enabled | yes | true/false | must have enabled: true configuration in order for resources to be deployed. |
| type | yes | static_site | must have type: static_site to have static sites resources deployed for it. |
| host | yes | storage_account, etc. | lists where the static site files will be hosted. For now just storage accounts have been accounted for, but this project will be expanded to be able to utilizes others. |
| domain | no | any | what the domain of the website will be. If no listed, the static sites will just use the default host public URL. |
| subdomain | no | any | If listed, will use this subdomain of the listed domain of the parent website. |
| parent | no | any | Must be listed if the site is using a subdomain. Lists the name of the parent project static website to tie the subdomain to a domain. |
| front_door | no | standard, premium | If listed, will tie the static website to the perspective azure front door SKU. |
| hugo | no | true/false | If listed true, will install hugo and dependencies on the pipeline runner and will attempt to convert markdown files into html files during pipeline runtime. |
File Upload
Regardless if the static site configuration file lists a value for hugo or not, all static site html files must be held in the public directory. The Black Lung Ink Dev/Prod CI/CD pipeline will only upload files contained in the public directory of static_site type projects to the project’s host.
Azure Front Door
The azure front door configuration value has the biggest influence on the infrastructure of Black Lung Ink static sites. Front door resources and resource groups will only deployed as needed. All static sites share the same front door that matches their SKU. Static sites that have a listed domain value have their own front door endpoint created for them. While static sites that use a subdomain value utilize their static site parent’s front door endpoint.
No Front Door
Without the use of a front door, the resource is accessed directly from the public internet ingress through the static site host resource’s public address or domain if supplied.
Standard Front Door
When utilizing a Standard SKU Azure Front Door resource to handle internet ingress two major advantages are gained. The first, is having access to Microsoft’s Content Delivery Network, which will minimize delays in website response times. The second, is leveraging fire wall managed rules and traffic encryption. It is to be noted that when utilizing the Standard Azure Front Door SKU all traffic that isn’t blocked by the Front Door’s Web Application Firewall will be rerouted back out to public internet before arriving to the static site host. This traffic still retains the advantage of encryption while in transit.
Premium Front Door
Leveraging the Premium Azure Front Door SKU grants the most amount of security and reliability. The front door’s Web Application Firewall gains expanded capabilities by using Microsoft’s industry standard firewall security rules. Additionally, once traffic has passed the firewall it is not rerouted out to the internet again. Instead, traffic is routed through the project’s virtual private network on Microsoft’s private network backbone to the a private end point attached to the static site host resource.
Logging
Health probe, traffic, and web application firewall logging has been enabled on all Azure Front Door resources that are deployed through static sites. These logs are stored in a shared log analytics workspace with a 30 day data retention period.
Monthly Costs
The costs of each major configuration can be roughly summarized on the table below.
| Resource | Monthly Cost |
|---|---|
| storage account | $0.10-$1.00 |
| Standard Front Door | $35.00 |
| Premium Front Door | $330.00 |
| Public DNS Zone | $0.50 |
| Log Ingestion | ~$2.30 / 500k logs |
Security
| Standard / Regulation | Requirement | Requirement Description | Compliance |
|---|---|---|---|
| ISO 27001 | A.10.1.1 — Cryptographic Controls | HTTPS/TLS must be enforced on all public endpoints. | Compliant Standard and Premium tiered Azure Front Door handles TLS termination, and No Front Door tier has “Secure transfer required” enabled on static site host resource. |
| ISO 27001 | A.12.4.1 — Event Logging | Diagnostic logs must be enabled on storage account and Front Door. Logs must be shipped to Log Analytics and retained per policy. | Compliant for Standard and Premium tiers if diagnostic settings ship to Log Analytics. Not compliant for No Front Door tier — no WAF logs available; only storage metrics are logged. |
| SOC 2 | CC6.1 — Logical and Physical Access | Network boundaries must control access to resources. Traffic should not traverse the public internet unnecessarily. | Compliant for Premium tier (private endpoint + VNet, no public internet egress). Partially compliant for Standard tier (WAF inspection, but traffic egresses to public internet). Not compliant for No Front Door tier (no network boundary at all). |
| SOC 2 | CC6.6 — Transmission Security | All data in transit must be encrypted with TLS. | Compliant for all tiers as TLS 1.2 minimum is enforced both by Front Door resources and static site host resources. |
| SOC 2 | CC7.2 — System Monitoring | Alerts must be configured for security events (WAF blocks, auth failures). | Compliant for Standard and Premium tiers if WAF block alerts are configured. Not compliant for No Front Door tier — no WAF to alert on. |
| NIST SP 800-53 | AC-4 — Information Flow Enforcement | Information flow must be controlled between the public internet and the resource. | Compliant for Premium tier (VNet + private endpoint enforces flow). Partially compliant for Standard tier (WAF filters but flow egresses to public internet). Not compliant for No Front Door tier (no flow enforcement). |
| NIST SP 800-53 | SC-8 / SC-8(1) — Transmission Confidentiality & Cryptographic Protection | TLS must protect all data in transit. | Compliant for all tiers as TLS 1.2+ is universally enforced. |
| NIST SP 800-53 | SC-7 — Boundary Protection | A defined security boundary must protect the resource from unauthorized access. | Compliant for Premium tier (VNet boundary). Partially compliant for Standard tier (Front Door provides partial boundary). Not compliant for No Front Door tier (no boundary). |
| NIST SP 800-53 | SI-4 — System Monitoring | The system must be monitored for security events. | Compliant front door resources send logs to an log analytic workspace. |
| NIST SP 800-53 | AU-3 / AU-6 — Audit Records & Audit Review | Audit logs must capture deployments (Azure DevOps audit logs) and traffic events (WAF logs, storage logs). | Compliant Azure DevOps audit logging is enabled and Front Door diagnostic logs are shipped to Log Analytics. |
| CIS Azure Benchmark | 4.1 — Secure Transfer Required | Storage account must reject HTTP requests. | Compliant “Secure transfer required” is enabled on the static site host in all tiers. |
| CIS Azure Benchmark | 4.3 — Public Access Level | Only the $web container should have anonymous read access; all other containers must be private. | Compliant only $web is set to anonymous read and all other containers are private. |
| CIS Azure Benchmark | 4.4 — Private Endpoint | Storage account should use a private endpoint when possible. | Compliant for Premium tier. Not applicable for Standard and No Front Door tiers (by design). |
| CIS Azure Benchmark | 5.1 / 5.2 — Front Door WAF | Azure Front Door must have WAF enabled with the OWASP 3.x rule set. | Compliant for Premium tiers the OWASP 3.x managed rule set to the WAF policy. Not Compliant Standard Azure Front Door SKU doesn’t allow for managed rules. Not Applicable No Front Door avoids this requirement. |
| CIS Azure Benchmark | 2.1 — Defender for Cloud Standard Tier | Standard pricing tier must be selected for Defender for Cloud. | Not Applicable Defender for Cloud is no set up in the Black Lung Ink cloud environment. |
| GDPR | Art. 5(1)(c) — Data Minimization | Only collect personal data that is strictly necessary. | Compliant Black Lung Ink static websites do not collect user data. |
| GDPR | Art. 13 — Privacy Notice | A privacy notice must be provided if any personal data is collected. | Compliant Black Lung Ink static websites do not collect user data. |
| GDPR | Art. 32 — Security of Processing | Appropriate technical measures must protect personal data. | Compliant Black Lung Ink static websites do not collect user data. |