From Vulnerability Baseline to Zero-Trust Production: Remediating Static Secrets through Control & Data-Plane Isolation, OIDC Federation, and Multi-Source Telemetry Auditing Across Entra ID & Log Analytics

Modern cloud security posture frequently fails not at the human perimeter, but at automated non-human/workload identities. Legacy CI/CD pipelines historically rely on static symmetric keys (AZURE_CLIENT_SECRET) and over-privileged subscription management roles (Contributor), creating high-exposure attack vectors and massive blast radiuses.

This project presents a production-grade implementation of the AI & Cloud Pipeline Hardening Framework (ACPHF). By transitioning workload authentication to OpenID Connect (OIDC) federated trust, enforcing strict Control-Plane versus Data-Plane role separation, and validating execution through dual-perspective telemetry, this architecture completely eliminates static credentials and enforces Zero Trust (NIST 800-207) standards.

  • Eliminated Static Symmetric Secrets: Replaced long-lived client secrets with dynamic, short-lived JSON Web Tokens (JWTs) using OpenID Connect (OIDC) federation.
  • Control-Plane vs. Data-Plane Isolation: Stripped broad subscription-level Contributor management rights in favor of resource-scoped, least-privilege RBAC (Key Vault Secrets User on KV-Secure-Data).
  • Headless Execution & Boundary Isolation: Enforced single-tenant directory routing, zero redirect URIs, and explicit subject claim matching (repo:Org/Repo:ref:refs/heads/main).
  • Dual-Perspective Telemetry Verification: Correlated runner-side execution logs with directory-side Entra ID non-interactive sign-in logs and Azure Log Analytics (AzureDiagnostics).
  • Audit Codification: Formally verified all four governance gates via the machine-readable Identity Architecture Ledger (IAL) and Audit Results Ledger (ARL).

This architecture brings together enterprise identity controls, pipeline orchestration, cloud target infrastructure, and deep telemetry analysis:

  • Identity Authority: Built on Microsoft Entra ID utilizing App Registrations, Workload Identities, and Federated Credentials.
  • Automation & CI/CD Runner: Powered by GitHub Actions incorporating OIDC token exchange, ephemeral Ubuntu execution environments, and zero-residual session teardowns (az account clear).
  • Target Infrastructure & Governance: Deployed in Microsoft Azure leveraging Key Vault data-plane isolation, granular RBAC, and Bicep Infrastructure-as-Code templates.
  • Telemetry & SIEM Alignment: Verified via Azure Log Analytics (AzureDiagnostics), Entra ID Non-Interactive Sign-In Logs, and custom KQL query sets.
  • Compliance Standards: Architected to satisfy NIST 800-207 Zero Trust framework requirements and SOC 2 Type II audit readiness.

To inspect the complete 18-slide architectural blueprint—including high-resolution portal configurations, sequence diagrams, Bicep IaC templates, and correlated log queries—access the master document directly: