Draft documentation

These infrastructure requirements are a draft. Validate them against the approved infrastructure design and customer requirements before use.

Election Readiness Tools infrastructure requirements

Scope

This document defines the infrastructure configuration required to run the Election Readiness (EC) Tools. It is a provisioning specification for DevOps teams using customer-managed deployment processes.

The infrastructure is a privileged, on-demand Windows execution host. It is not a Brief Connect application component.

Deploy a dedicated tools VM for each Brief Connect environment. Avoid sharing one tools VM, its identities, or retained output across multiple environments where possible.

The deployment creates the tools VM, NIC, managed disks, VM extensions, and VM-specific role assignments. It uses existing customer-managed VNet, subnet, NSG, Bastion, private endpoint, route, DNS, firewall, Key Vault, monitoring, backup, and Brief Connect database resources. It does not create or alter Azure SQL users or database roles.

Resource configuration

Virtual machine

Property	Required configuration
Resource type	Azure Virtual Machine
Ownership	Customer-controlled subscription and dedicated tools resource group
Azure region	Same as the primary region of the Brief Connect resources for the selected environment
Operating system	Windows Server 2022 Datacenter: Azure Edition, x64 Gen2
Architecture	x64
Security type	Trusted Launch
Secure Boot	Enabled
vTPM	Enabled
Minimum capacity	2 vCPU and 4 GiB RAM (dev/test and small scopes up to ~100,000 comparisons); 2–4 vCPU and 8–16 GiB RAM recommended for production runs
Baseline SKU	Standard_B2ls_v2 (minimum small-scope baseline); Standard_D2s_v5 (8 GiB) or Standard_D4s_v5 (16 GiB) recommended for production workloads
Pricing model	Client policy and commercial model
Windows licensing	Client licensing policy and entitlement
Availability	Single VM; no availability set, scale set, load balancer, or HA pair required
Guest patching	Azure Update Manager customer-managed maintenance schedule
Patch assessment	Periodic assessment enabled
Patch orchestration option	Manual updates, or another approved option with restarts controlled separately outside tool runtime
Patch installation reboot	Never; patch installation must not restart the VM automatically
Patch window	Must not overlap planned or active EC Tools sessions
VM restart	Separate manually initiated or explicitly approved maintenance action after confirming that no tool job is active
Boot diagnostics	Enabled using managed storage
Application runtime	Self-contained win-x64 package; separate .NET runtime and SDK not required
Custom data and scripts	None
VM extensions	AADLoginForWindows only

The selected image and VM SKU must be available in the primary region used by the Brief Connect resources for the selected environment.

OS disk

Property	Required configuration
Capacity	128 GiB
Baseline SKU	E10
Storage type	Standard SSD LRS
Delete with VM	Enabled

Tools data disk

Property	Required configuration
Purpose	Packages, configuration, job state, journals, logs, reports, and restricted error output
Capacity	64 GiB minimum baseline (128–512 GiB for large production scopes; see table below)
Baseline SKU	E6 Standard SSD minimum baseline; Premium SSD LRS (P10 / P15 / P20) recommended for 1M+ comparisons
Storage type	Standard SSD LRS (small scopes) or Premium SSD LRS (production / large scopes)
LUN	0
Host caching	None
Partition style	GPT
Filesystem	NTFS
Persistence	Content survives process failure, operator sign-out, RDP disconnection, VM restart, and VM deletion
Delete with VM	Disabled; detach on VM deletion
Public network access	Disabled
Network access policy	Deny all

The data volume must have sufficient free capacity and IOPS for the largest expected job before any data-changing operation starts:

• Why production workloads should use Standard_D2s_v5 / Standard_D4s_v5 and Premium SSD (P10–P20):
  1. Windows OS RAM + NTFS file cache: Windows Server 2022 Datacenter with Trusted Launch (VBS), Microsoft Defender (MsMpEng.exe), and an interactive RDP session consumes ~2.0–2.4 GiB of RAM before the tool starts. While the tool bounds its own process working set to ~190–405 MiB (plus ~12 MiB per 100,000 parent-field pairs $D \times F$), 8–16 GiB of VM RAM is required so Windows can cache the file-backed .lookup/.index/.data spools in RAM instead of paging.
  2. Uncached VM & disk IOPS limits (Host caching: None): Because host caching is None on the tools data disk, every spool read/write is subject to both the VM's uncached disk cap and the managed disk's IOPS cap. Burstable Standard_B2ls_v2 (40% baseline CPU, capped at 1,280 IOPS / 42.5 MB/s) and Standard SSD tiers E6–E20 (all capped at 500 IOPS) bottleneck multi-hour runs that perform millions of random index lookups (FileBackedKeyIndex). Non-burstable Standard_D2s_v5 (3,750 IOPS / 85 MB/s) and Standard_D4s_v5 (6,400 IOPS / 145 MB/s) paired with Premium SSD LRS (P10 500 IOPS / burst 3,500, P15 1,100 IOPS, P20 2,300 IOPS) provide sustained CPU and 2x–7x higher disk throughput.
  3. Retained disk capacity: Across the complete Golden Path (prepare → fill-child-docs → apply → verify), retained JSON/CSV reports and journals require ~22 GB retained (~24.5–32.2 GB peak) per 1,000,000 evaluated comparisons (Total library items × Selected fields; see Estimate scope and size the VM and disk).

Workload tier	Evaluated comparisons ($R$)	Recommended Azure VM SKU	Recommended data disk SKU & capacity	Required free space before job
Small / Dev-Test	Up to 100,000	Standard_B2ls_v2 (2 vCPU, 4 GiB) or Standard_D2s_v5 (2 vCPU, 8 GiB)	64 GiB Standard SSD (E6)	>= 10 GB free
Large (Production baseline)	Up to 1,000,000	Standard_D2s_v5 (2 vCPU, 8 GiB) (or Standard_D4s_v5 if $D > 25,000$)	128 GiB Premium SSD (P10) (or E10 / E6 with >= 45 GB free)	>= 45 GB free
Extra Large	Up to 5,000,000	Standard_D4s_v5 (4 vCPU, 16 GiB)	256 GiB Premium SSD (P15) (or split scope by site/record type)	>= 200 GB free
Maximum (single scope)	Up to 10,000,000	Standard_D4s_v5 (4 vCPU, 16 GiB)	512 GiB Premium SSD (P20) (or split scope by site/record type)	>= 400 GB free

Treat the data disk and retained output as sensitive. Retention, access, and disposal are governed by customer policy.

Network interface

Property	Required configuration
VNet and subnet	Existing, approved, environment-aligned customer VNet and subnet
Subnet capacity	Sufficient available address capacity for the VM NIC
Private IP	Dynamic or customer-approved static private address
Public IP	None
Public application endpoint	None
Network security	Existing subnet policy or approved NIC-level NSG
Inbound access	No unrestricted public RDP or SSH
Administration path	Customer-approved Bastion, VPN, private RDP, or equivalent path capable of reaching TCP 3389 without broad public exposure
Accelerated networking	Disabled
Delete NIC with VM	Enabled
DNS	Customer DNS with resolution for all required public and private service endpoints
Outbound path	Customer-approved internet, firewall, proxy, NAT, VPN, ExpressRoute, or private path

The deployment uses existing customer-managed NSG, firewall, route, DNS, proxy, peering, VPN, ExpressRoute, Bastion, and private endpoint resources. Permissive public access and broad service-firewall rules are not supported.

Identity and access

Managed identities

Identity	Type	Applicability	Required use
VM identity	System-assigned managed identity	All deployments	Key Vault authentication and infrastructure configuration retrieval
Brief Connect SQL identity	Existing environment-specific user-assigned managed identity	Latest DB deletion operations requiring Azure SQL	Azure SQL authentication

The VM system-assigned identity requires the following role assignment:

Role	Scope	Principal
Key Vault Secrets User	Existing environment-specific Brief Connect Key Vault only	VM system-assigned identity

Identity constraints:

• The Key Vault uses Azure RBAC authorization.
• Key Vault Administrator, Key Vault Secrets Officer, and equivalent broad roles are not permitted.
• The SQL identity is attached only where the selected operation requires Azure SQL.
• The SQL identity must be the existing Brief Connect SQL identity for the same environment.
• Infrastructure provisioning does not create a replacement SQL identity or modify Azure SQL users and database roles.
• Operators do not receive direct access to certificates, private keys, tokens, connection strings, or database credentials.

Operator access

Property	Required configuration
Authorisation	Customer-managed Microsoft Entra ID security group containing authorised EC Tools operators
Windows authentication	Microsoft Entra ID login using AADLoginForWindows
Azure role	Virtual Machine Administrator Login
Role scope	Tools VM only
Bootstrap administrator	Recovery and initial provisioning only; strong credential held in customer-approved credential management
Revocation	Group membership and role assignments must be independently removable
Domain join	Not permitted when Microsoft Entra VM login is used

The bootstrap credential must not be stored in source control, deployment records, or tickets. Day-to-day operator access uses Microsoft Entra ID.

Service connectivity

Common destinations

Destination	Protocol/port	Purpose
Microsoft Entra ID authentication and registration endpoints	HTTPS 443	Operator login and application authentication
Existing Brief Connect Key Vault	HTTPS 443	Runtime retrieval of approved secrets and certificate material
Microsoft Graph	HTTPS 443	Tool operations
SharePoint Online target tenant and site	HTTPS 443	Tool operations
Azure Instance Metadata Service 169.254.169.254	HTTP 80, link-local	Managed identity token acquisition

For Azure Global, Entra VM login requires access to at least enterpriseregistration.windows.net, login.microsoftonline.com, and pas.windows.net. Sovereign cloud deployments require the corresponding cloud-specific endpoints.

Database-model destinations

Exactly one database model applies to each Brief Connect environment and tool run. Connectivity for the other model must not be added as a fallback.

Database model	Brief Connect versions	Required destinations
Legacy DB	2.5.10 only	Data storage account Azure Storage Table and Blob endpoints over HTTPS 443; Azure Cosmos DB endpoint when required by deletion
Latest DB	2.5.10 and above	Azure DocumentDB MongoDB-compatible endpoint and environment-defined port; Azure SQL over TCP 1433 or approved private equivalent when required by deletion

Brief Connect 2.5.10 can use either model according to its environment configuration. Later supported versions use Latest DB.

Private networking

Environments using Private Link, service firewalls, custom DNS, forced tunnelling, or restricted egress require:

• Routing from the VM subnet to each required private endpoint.
• Private DNS resolution from the VM for each private endpoint.
• Service firewall or network ACL authorization for the VM network path.
• Proxy or firewall rules for required Microsoft 365 and Entra endpoints.
• TLS inspection compatibility with Microsoft identity, Graph, SharePoint, and Azure service requirements.

Required deployment information

The deployment process requires the following non-secret values:

Input	Requirement
Azure subscription	Approved target subscription
Tools resource group	Dedicated customer-controlled resource group
Azure region	Primary region of the Brief Connect resources for the selected environment
VM name	Customer-approved resource name
VNet and subnet	Existing approved network resources
Key Vault	Existing environment-specific Brief Connect Key Vault
Operator group	Authorised Microsoft Entra ID security group
Database model	Exactly one of Legacy DB or Latest DB
SQL managed identity	Existing environment-specific identity when required
Administration path	Approved Bastion, VPN, private RDP, or equivalent path
Resource tags	Tags required by customer policy
Provisioner access	Permission to create the VM, NIC, and disks and to create role assignments on the VM and existing Key Vault

Deployment records must not contain passwords, certificate values, connection strings, access tokens, or private keys.

Security and operational controls

Control	Requirement
Environment isolation	A dedicated VM per Brief Connect environment where possible; identities, Key Vault, network paths, configuration, and retained output remain environment-aligned
Endpoint protection	Customer policy
Vulnerability management	Customer policy
Monitoring and alerting	Customer policy
Pending restart	Monitored and resolved during an approved maintenance window
Backup	Customer policy; VM backup does not replace tool dry runs, checkpoints, journals, or evidence
Auto-shutdown	Disabled unless its schedule cannot overlap tool sessions or maintenance activity
Deallocation	Supported while unused; retained resources continue to incur charges
Disk encryption	Customer policy
Configuration compliance	Customer policy
Access review	Customer policy
Resource tags	Tags required by customer policy
Evidence	Resource IDs, image, size, disks, network placement, identity IDs, role scopes, configuration state, and approved variances

Deployment and operational evidence must not contain credentials, tokens, certificate values, private keys, Key Vault secret values, connection strings, customer document contents, or unrestricted service responses.

Provisioned-state requirements

Infrastructure is suitable for EC Tools when all of the following conditions hold:

Area	Required state
Compute	Approved Windows image, x64 architecture, and at least 2 vCPU and 4 GiB RAM
Security	Trusted Launch, Secure Boot, vTPM, customer-managed patch schedule with automatic restart disabled, and customer-required security controls configured
Storage	Persistent NTFS tools volume with sufficient free space
Exposure	No public IP, public application endpoint, or broad inbound administration rule
Identity	VM system identity enabled and scoped to the environment Key Vault only
Conditional SQL identity	Correct environment SQL identity attached only when required
Operator access	Approved authentication path and VM-scoped operator authorization configured
DNS and routing	Every required common and selected database-model endpoint resolves and is reachable through an approved path
Package compatibility	Approved self-contained win-x64 package can execute without a separately installed .NET runtime
Preflight	Tool non-destructive preflight succeeds without data writes

Live deletion and metadata updates are not infrastructure validation methods.