Building a Scalable, Secure Framework for Cross-Subscription Access in Azure
DSPM
Engagement Highlights
- Automated secure cross-subscription access to customer Azure data stores from Normalyze compute.
- Used Terraform to deploy Azure Container Apps and VMs in Normalyze subscription.
- Built onboarding scripts to grant secure data store access via Terraform and shell.
- Created Python scripts to fetch and validate data from various Azure sources.
Company Introduction
A leading DSPM (Data Security Posture Management) platform provider, Normalyze (acquired by Proofpoint) specializes in protecting sensitive data across multi-cloud environments. The client aimed to securely access and audit data across customer Azure subscriptions while keeping all compute resources within its own trusted subscription boundary.
Challenges
The key goal was to replicate the capabilities currently available when compute runs in the customer environment within the confines of the Normalyze subscription. This shift required solving for:
- Cross-subscription access: Granting compute in Normalyze subscription the ability to read from data stores in customer subscriptions.
- Secure onboarding: Automating the provisioning of roles and permissions in the customer environment.
- Proof of access: Demonstrating data access and visibility with real-world test cases across various Azure storage types.
Solutions
- Provisioned Compute in Normalyze Subscription
Neova’s team provisioned compute resources—Azure Container Apps and Virtual Machines—inside the Normalyze subscription using robust Terraform automation, enabling consistent and secure deployments. - Created Data Stores in Customer Subscription
Leveraging existing automation frameworks, the team created test data across multiple Azure data services:- Azure Blob Storage
- Azure File Shares
- Azure SQL
- Azure PostgreSQL
- Azure CosmosDB (Mongo API)
- Azure MySQL
- Automated Cross-Subscription Access Setup
A combination of Terraform and shell scripts were provided to customers to grant minimum necessary access from their data stores to the Normalyze subscription. This included assigning roles and setting up appropriate service principals. - Data Access from company Compute
Python scripts were developed and executed from within the Normalyze subscription compute to validate data access across all supported storage services. This included running queries, listing files, and reading blobs to prove visibility. - Containerization and ACR Integration
For scalability and integration with CI/CD pipelines, all Python access scripts were containerized and deployed via ACR to Container Apps.
Result
- Successful Access Across Subscriptions
Enabled read access to all targeted Azure data stores in customer environments using compute in the Normalyze subscription. - Secure, Scalable Framework
Infrastructure-as-code and automated onboarding minimized risk, manual steps, and customer friction. - Operational Visibility
Python-based validators confirmed data visibility, with logs and evidence maintained for audit purposes. - Foundation for Multi-Tenant Support
The modular design enables onboarding of additional customer subscriptions with minimal changes.
Related Projects
Ensuring Secure Multi-Platform MFT Automation & Compliance
Learn how end-to-end automation testing stabilized cross-platform file transfers, role-based access, and audit logging in an enterprise MFT system.
Strengthening Real-World Reliability in a Distributed AI Execution Platform
Discover how Neova's exploratory testing identified critical edge cases and stabilized a distributed AI platform before production release.
Streamlining User Interface Quality in Gunshot Alert Systems
Helped Shooter Detection Systems (SDS) modernize regression testing by building a robust Playwright Web UI automation framework, streamlining testing and accelerating delivery.