Beginner Capstone: Deploy a Secure Azure Web Application

This capstone deploys a small Northstar web API on App Service with storage, managed identity, Key Vault for one dummy secret, Application Insights, a budget, and a CI/CD path. It proves that you can move from portal exploration to repeatable infrastructure, verify the user journey, and remove every lab resource safely.

Time: 2–3 hours · Cost: App Service plan, storage, monitoring, and optional networking can charge · Use: synthetic data only · Cleanup: required at the end.

What are the acceptance criteria?

• HTTPS API returns /health and /version.
• App uses managed identity to list/read an approved blob container.
• No storage key or Azure password is stored in code/pipeline.
• Dummy Key Vault secret is read only by the app identity.
• Application Insights shows a correlated request and dependency.
• A deployment slot or equivalent safe release path is used.
• Budget/alerts and ownership tags exist.
• Bicep or Terraform can recreate the environment.
• Teardown removes all billable lab resources.

Step 1: Plan the resource set

Use an isolated group such as rg-northstar-capstone-dev-001 containing:

• App Service plan and web app.
• Storage account and documents container.
• Key Vault with a harmless DemoMessage value.
• Application Insights and Log Analytics workspace.
• Managed identity and scoped role assignments.
• Staging slot if the selected plan supports it.

Budget can be subscription or resource-group scoped under supported billing permissions.

Step 2: Write infrastructure as code

Parameterize location, environment, and globally unique names. Apply these secure defaults in either method:

• HTTPS only and current TLS baseline.
• Anonymous blob access disabled.
• Managed identity enabled.
• Storage Blob Data Reader at the storage/container scope.
• Key Vault Secrets User at the vault/secret scope.
• Diagnostic settings and alerts.
• No secret values in IaC outputs/state.

Ways to build

Choose the Azure tool you want to use. The underlying resource stays the same.

BicepTerraform

Bicep

Reuse the modules and deployment workflow from the Bicep chapter. Run az bicep lint, az deployment group validate, and az deployment group what-if; inspect every resource, role assignment, network change, and deletion before az deployment group create.

Terraform

Reuse the version-pinned modules and protected remote state from the Terraform chapter. Run terraform fmt -check, terraform validate, and terraform plan -out=reviewed.tfplan; inspect the plan and apply that reviewed artifact through the authorized pipeline.

Step 3: Build the smallest application

Implement endpoints:

Use DefaultAzureCredential for Blob and Key Vault SDK clients. Locally it can use your Azure CLI login; in Azure it uses the app identity. Do not return a secret endpoint in a real product—this dummy endpoint proves identity only.

Step 4: Deploy through CI

Pipeline:

1. Test and scan.
2. Build one package.
3. Authenticate with workload identity federation.
4. Preview and apply infrastructure.
5. Deploy package to staging.
6. Run /health, /version, identity/storage/vault tests.
7. Swap staging to production.
8. Watch error/latency for a defined window.

Keep production deployment approval even in a learning repository so the pattern is visible.

Step 5: Verify from Azure

Portal checks:

• Web app → Identity shows system-assigned principal.
• Storage/Key Vault → IAM shows narrow roles.
• App Service → Deployment slots shows staging/production.
• Application Insights → Transaction search shows request and dependencies.
• Cost Management → Budget exists at intended scope.
• Activity Log shows deployments and role assignments.

CLI checks:

Step 6: Test failure safely

• Remove the app's blob role and confirm access fails without exposing credentials.
• Restore the role and confirm recovery after propagation.
• Deploy a failing health version to staging and prove it is not swapped.
• Stop the app and confirm availability alert/runbook behavior if configured.

Do not test destructive database or tenant changes in this beginner capstone.

Step 7: Clean up and prove it

Delete through the same IaC tool or the isolated resource group. Then query:

Remove any federated identity/app registration created only for the lab, budget, custom domain/DNS record, and retained globally scoped object. Preserve the code and deployment evidence, not the cloud bill.

Graduation review

Explain why the app has no credential, why the role scope is narrow, how a bad release is stopped, what the budget does not do, where the traces are, and how cleanup is verified. If you can explain those decisions, you have moved beyond portal clicking.