Assuming a team maintaining multiple simple cloud web apps with associated secret key stores.

The control plane for the app needs to access secrets, and we don't want to expose the secret store on the internet, thus we put both resources in the same VNet and then expose the web service through other means (e.g. application gateway)

I think this is a fair way to do defence-in-depth, protecting the secret store from the internet. However, I see that VNets are peered into the corporate network more and more. I think this is mainly for convenience as e.g. secrets management can then be done on a personal laptop on the corporate VPN.

If most teams follow this strategy, we face a risk of a supply chain attack on one of the services, and now we have malicious code running somewhere and it has access to the entire corporate network.

Without peering, our developers complain that maintaining all these different VNets and VPN connections is too hard, and start challenging the value of segmentation altogether (to the tune of "the keyvault authz/n is as secure as the Azure portal itself")

I don't want to face the risk of exposing the secret store on the internet, and I also don't want to have a large pool of VNets peered together with the corporate network, as this essentially violates network segmentation.

Is there a way to preserve good network network segmentation as defined in the zero trust security model, while retaining some form of user friendliness for developers managing the solutions? Or any other recommendations for this scenario?

  • 1
    I find the title misleading: You are not actually generically asking if perimeter security is a good thing. Not sure what you actually asking though: is perimeter security sufficient when faced with vnet peering into the corporate network - or does perimeter security add least add some protection in this situation - or is allowing vnet peering the problem which undermines any security measures - or ??? Right now it looks to me like listing various concerns without actually asking a question. Apr 3 at 10:26
  • I'm seeking advice on all those topics and I find it hard to capture it in a single question. I agree with you and will try to make a clarifying edit to the question itself. But the main gist of it would be "Does VNet peering compromise perimeter security to the point that it becomes less secure than not protecting resources behind a VNet at all?" Apr 3 at 10:40
  • 1
    How much impact on security the vnet peering into the corporate network has, depends (obviously) on the security of the corporate network. Apr 3 at 10:44
  • 2
    Your original question was 3 different and unrelated questions in one. If your question ends up being "Thoughts?" then that is usually a good indication that you need to refine your question. Thoughts on what? Your assumptions? Your conclusions? Your last line also includes some specific assumptions that are a bit confused considering the assumed context that was provided before it. Segmentation is, and has always been, a solid strategy. Is that your question, or is your question "is the violation of segmentation a bad thing?" (it is). But that's obvious.
    – schroeder
    Apr 3 at 11:13
  • Thanks for the feedback, it has helped me reach a more concrete question, somewhat deviating from the original formulation Apr 3 at 13:55


You must log in to answer this question.

Browse other questions tagged .