Azure Infrastructure

Every resource the Azure template creates, and what each one is for.

This is the actual shape of the Azure Resource Manager template — one App Service running everything, a PostgreSQL Flexible Server and a Redis Enterprise cache reached privately, and a Key Vault for the credentials it starts with.

It's a leaner shape than the AWS template, and deliberately not padded out to look symmetric: one App Service plays the role AWS splits across three ECS services, and there's no CDN layer or template-hosting bucket in front of it. Both differences are called out below rather than glossed over.

Cloud-Vex Azure infrastructure. An App Service running as a Web App for Containers is the public HTTPS endpoint itself, with no separate CDN in front of it. One compute unit runs the API, the web UI, and the scan scheduler together - unlike the AWS deployment, there is no separate scheduler or worker process. The App Service reaches into a virtual network through regional VNet integration, outbound only, to a PostgreSQL Flexible Server 16 database in a delegated subnet, resolved by a private DNS zone rather than a public endpoint, Burstable tier with 30-day backups and high availability disabled, and to a Redis Enterprise cache reached over a private endpoint in its own subnet, public network access disabled. Outside the virtual network, a Key Vault holds the database password, admin password and licence key as three secrets, resolved into app settings at deploy time. A user-assigned managed identity is what the App Service authenticates as, holding the Key Vault access policy so no credential is stored for that access. Application Insights collects logs, requests and metrics from the App Service.

Compute

  • App Service — Web App for Containers — one compute unit running the API, the web UI, and the scan scheduler together. It's the public HTTPS endpoint itself; there's no separate edge or CDN tier in front of it. HTTPS-only, sized by its App Service Plan.
  • No separate scheduler or worker process. This is a real difference from the AWS deployment's three-way split into backend, scheduler and worker services — on Azure, one process does all three jobs.

Network

  • Virtual network, three subnets — an app-service subnet delegated for regional VNet integration, a database subnet delegated to the Postgres server, and a subnet for the Redis private endpoint.
  • VNet integration (outbound only) — how the App Service reaches the database and cache privately. It's regional integration, not hosting: the App Service's compute itself still runs outside the virtual network.
  • Private DNS zones — resolve the database and cache to their private addresses inside the virtual network, linked to it directly.

Data

  • PostgreSQL Flexible Server 16 — the findings store. Reached through a delegated subnet, not a public endpoint. Burstable tier, 30-day backups, high availability disabled.
  • Redis Enterprise cache — shared cache, reached over a private endpoint. Public network access disabled, TLS 1.2 minimum.

Secrets & identity

  • Key Vault — three secrets: the database password, the initial administrator's password, and the licence key. Standard tier.
  • User-assigned managed identity — what the App Service authenticates as; holds the Key Vault access policy (get, list secrets and keys). No stored credential for that access, the same role AWS's task role plays.

Monitoring

  • Application Insights — logs, requests and metrics from the App Service. Azure's equivalent of CloudWatch Logs on the AWS side.

What isn't here

  • No customer-managed encryption key. Postgres and Redis encrypt at rest with Microsoft-managed keys by default; there's no Key Vault key or disk encryption set in this template, unlike AWS's KMS key.
  • No storage account for collector templates. The AWS template hosts its collector setup templates in an S3 bucket the backend links to; this template has no Azure Blob Storage equivalent.

This is the hub's own account. Adding another Azure subscription, or AWS or Google Cloud, deploys a much smaller collector into it instead — covered by the permission model and the scan cycle pages.

Need this against your own security review checklist? Email support@cloud-vex.com.

Join the waitlist