Project B – Policy-as-Code & Secure Score Uplift (SC-100 Learning Project)

[sking-dev]

Description

This epic tracks the work required to implement Project B: Policy-as-Code & Secure Score Uplift as outlined in the SC-100 learning project roadmap.

---

Goal

Demonstrate how to author, deploy, and validate custom Azure Policy (initiative) assignments using Infrastructure as Code, and uplift Azure Secure Score through automation and continuous improvement.

---

Work Areas to Cover

• Scaffold project folder & README
  - Create the /policy (or /governance) domain structure with prod/ and nonprod/ subfolders.
  - Add a clear README outlining the scope, objectives, and prerequisites for Project B.

• Author custom Azure Policy set (CAF + CIS)
  - Author a custom Azure Policy initiative (policy set) that combines key controls from the Cloud Adoption Framework (CAF) and the CIS Azure Foundations Benchmark.
  - Deploy the initiative and assignments via Terraform.
  - Document the rationale for selected policies and their expected impact.

• Integrate tfsec + Infracost in Azure DevOps pipeline
  - Add tfsec for Terraform security scanning in the CI pipeline.
  - Add Infracost for cost estimation and reporting in the pipeline.
  - Document pipeline steps and sample outputs.

• Capture before/after Secure Score metrics
  - Record the baseline Secure Score before policy assignment.
  - Capture the Secure Score after deploying the custom policy set.
  - Document the observed uplift and lessons learned.

---

Sub-Issues to Create

• Create Terraform code for custom policy initiative and assignments
• Select and justify policies from CAF and CIS benchmarks
• Add tfsec integration to pipeline
• Add Infracost integration to pipeline
• Document Secure Score measurement process and results
• Update root README and add project-specific documentation

---

References

• Azure Policy documentation
• Azure Secure Score documentation
• tfsec documentation
• Infracost documentation