Network security

Much like IAM, networking and network security are huge domains. The exact network security configurations are often best kept for experts in the field, but it is still valuable for a cloud data architect to grasp the principles of securing networks.

The PoLP in access management stated that any identity should have the least amount of access to complete the job. Similar to this, in network security, endpoints should have the least possible exposure.

First, this comes down to not blindly opening up all endpoints to the public internet. This is, however, the default option in many Azure services. It is possible to deny public network access on the resource level, or we could enforce any resource of a given type to have disabled public network access by using Azure Policy. Azure Policy is further explained at the end of this chapter.

By disabling all access from the public network, the resources can only be accessed through private endpoints. This prevents...