We design, build, and automate secure solutions. On-prem, cloud, and AI.

# Azure SDK: audit resource compliance
from azure.identity import DefaultAzureCredential
from azure.mgmt.resource import ResourceManagementClient

credential = DefaultAzureCredential()
client = ResourceManagementClient(credential, subscription_id)

non_compliant = []
for resource in client.resources.list():
    tags = resource.tags or {}
    if "environment" not in tags or "owner" not in tags:
        non_compliant.append({
            "name": resource.name,
            "type": resource.type,
            "missing": [t for t in ["environment", "owner"]
                       if t not in tags]
        })

print(f"Found {len(non_compliant)} resources missing required tags")

# Azure landing zone with hub-spoke networking
module "hub_network" {
  source              = "./modules/network"
  name                = "vnet-hub-prod"
  address_space       = ["10.0.0.0/16"]
  resource_group_name = azurerm_resource_group.hub.name
  location            = var.location

  subnets = {
    gateway    = { prefix = "10.0.1.0/24" }
    firewall   = { prefix = "10.0.2.0/24" }
    management = { prefix = "10.0.3.0/24" }
  }
}

module "spoke_networks" {
  source   = "./modules/network"
  for_each = var.spoke_configs

  name                = "vnet-${each.key}-prod"
  address_space       = [each.value.cidr]
  resource_group_name = azurerm_resource_group.spokes[each.key].name

  peering = {
    hub_vnet_id = module.hub_network.vnet_id
  }
}

// Next.js API route: Azure AD token validation
import { NextRequest, NextResponse } from "next/server";
import { jwtVerify, createRemoteJWKSet } from "jose";

const JWKS = createRemoteJWKSet(
  new URL(`https://login.microsoftonline.com/${TENANT}/discovery/v2.0/keys`)
);

export async function middleware(req: NextRequest) {
  const token = req.headers.get("Authorization")?.replace("Bearer ", "");
  if (!token) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  try {
    const { payload } = await jwtVerify(token, JWKS, {
      issuer: `https://login.microsoftonline.com/${TENANT}/v2.0`,
      audience: CLIENT_ID,
    });
    return NextResponse.next();
  } catch {
    return NextResponse.json({ error: "Invalid token" }, { status: 403 });
  }
}