Draft documentation
These infrastructure requirements are a draft. Validate them against the approved infrastructure design and customer requirements before use.
Election Readiness Tools infrastructure requirements
Scope
This document defines the infrastructure configuration required to run the Election Readiness (EC) Tools. It is a provisioning specification for DevOps teams using customer-managed deployment processes.
The infrastructure is a privileged, on-demand Windows execution host. It is not a Brief Connect application component.
Deploy a dedicated tools VM for each Brief Connect environment. Avoid sharing one tools VM, its identities, or retained output across multiple environments where possible.
The deployment creates the tools VM, NIC, managed disks, VM extensions, and VM-specific role assignments. It uses existing customer-managed VNet, subnet, NSG, Bastion, private endpoint, route, DNS, firewall, Key Vault, monitoring, backup, and Brief Connect database resources. It does not create or alter Azure SQL users or database roles.
Resource configuration
Virtual machine
| Property | Required configuration |
|---|---|
| Resource type | Azure Virtual Machine |
| Ownership | Customer-controlled subscription and dedicated tools resource group |
| Azure region | Same as the primary region of the Brief Connect resources for the selected environment |
| Operating system | Windows Server 2022 Datacenter: Azure Edition, x64 Gen2 |
| Architecture | x64 |
| Security type | Trusted Launch |
| Secure Boot | Enabled |
| vTPM | Enabled |
| Minimum capacity | 2 vCPU and 4 GiB RAM |
| Baseline SKU | Standard_B2ls_v2, or approved equivalent or larger SKU |
| Pricing model | Client policy and commercial model |
| Windows licensing | Client licensing policy and entitlement |
| Availability | Single VM; no availability set, scale set, load balancer, or HA pair required |
| Guest patching | Azure Update Manager customer-managed maintenance schedule |
| Patch assessment | Periodic assessment enabled |
| Patch orchestration option | Manual updates, or another approved option with restarts controlled separately outside tool runtime |
| Patch installation reboot | Never; patch installation must not restart the VM automatically |
| Patch window | Must not overlap planned or active EC Tools sessions |
| VM restart | Separate manually initiated or explicitly approved maintenance action after confirming that no tool job is active |
| Boot diagnostics | Enabled using managed storage |
| Application runtime | Self-contained win-x64 package; separate .NET runtime and SDK not required |
| Custom data and scripts | None |
| VM extensions | AADLoginForWindows only |
The selected image and VM SKU must be available in the primary region used by the Brief Connect resources for the selected environment.
OS disk
| Property | Required configuration |
|---|---|
| Capacity | 128 GiB |
| Baseline SKU | E10 |
| Storage type | Standard SSD LRS |
| Delete with VM | Enabled |
Tools data disk
| Property | Required configuration |
|---|---|
| Purpose | Packages, configuration, job state, journals, logs, reports, and restricted error output |
| Capacity | 64 GiB |
| Baseline SKU | E6 |
| Storage type | Standard SSD LRS |
| LUN | 0 |
| Host caching | None |
| Partition style | GPT |
| Filesystem | NTFS |
| Persistence | Content survives process failure, operator sign-out, RDP disconnection, VM restart, and VM deletion |
| Delete with VM | Disabled; detach on VM deletion |
| Public network access | Disabled |
| Network access policy | Deny all |
The data volume must have sufficient free capacity for the largest expected job before any data-changing operation starts. Treat the data disk and retained output as sensitive. Retention, access, and disposal are governed by customer policy.
Network interface
| Property | Required configuration |
|---|---|
| VNet and subnet | Existing, approved, environment-aligned customer VNet and subnet |
| Subnet capacity | Sufficient available address capacity for the VM NIC |
| Private IP | Dynamic or customer-approved static private address |
| Public IP | None |
| Public application endpoint | None |
| Network security | Existing subnet policy or approved NIC-level NSG |
| Inbound access | No unrestricted public RDP or SSH |
| Administration path | Customer-approved Bastion, VPN, private RDP, or equivalent path capable of reaching TCP 3389 without broad public exposure |
| Accelerated networking | Disabled |
| Delete NIC with VM | Enabled |
| DNS | Customer DNS with resolution for all required public and private service endpoints |
| Outbound path | Customer-approved internet, firewall, proxy, NAT, VPN, ExpressRoute, or private path |
The deployment uses existing customer-managed NSG, firewall, route, DNS, proxy, peering, VPN, ExpressRoute, Bastion, and private endpoint resources. Permissive public access and broad service-firewall rules are not supported.
Identity and access
Managed identities
| Identity | Type | Applicability | Required use |
|---|---|---|---|
| VM identity | System-assigned managed identity | All deployments | Key Vault authentication and infrastructure configuration retrieval |
| Brief Connect SQL identity | Existing environment-specific user-assigned managed identity | Latest DB deletion operations requiring Azure SQL | Azure SQL authentication |
The VM system-assigned identity requires the following role assignment:
| Role | Scope | Principal |
|---|---|---|
Key Vault Secrets User |
Existing environment-specific Brief Connect Key Vault only | VM system-assigned identity |
Identity constraints:
- The Key Vault uses Azure RBAC authorization.
Key Vault Administrator,Key Vault Secrets Officer, and equivalent broad roles are not permitted.- The SQL identity is attached only where the selected operation requires Azure SQL.
- The SQL identity must be the existing Brief Connect SQL identity for the same environment.
- Infrastructure provisioning does not create a replacement SQL identity or modify Azure SQL users and database roles.
- Operators do not receive direct access to certificates, private keys, tokens, connection strings, or database credentials.
Operator access
| Property | Required configuration |
|---|---|
| Authorisation | Customer-managed Microsoft Entra ID security group containing authorised EC Tools operators |
| Windows authentication | Microsoft Entra ID login using AADLoginForWindows |
| Azure role | Virtual Machine Administrator Login |
| Role scope | Tools VM only |
| Bootstrap administrator | Recovery and initial provisioning only; strong credential held in customer-approved credential management |
| Revocation | Group membership and role assignments must be independently removable |
| Domain join | Not permitted when Microsoft Entra VM login is used |
The bootstrap credential must not be stored in source control, deployment records, or tickets. Day-to-day operator access uses Microsoft Entra ID.
Service connectivity
Common destinations
| Destination | Protocol/port | Purpose |
|---|---|---|
| Microsoft Entra ID authentication and registration endpoints | HTTPS 443 | Operator login and application authentication |
| Existing Brief Connect Key Vault | HTTPS 443 | Runtime retrieval of approved secrets and certificate material |
| Microsoft Graph | HTTPS 443 | Tool operations |
| SharePoint Online target tenant and site | HTTPS 443 | Tool operations |
Azure Instance Metadata Service 169.254.169.254 |
HTTP 80, link-local | Managed identity token acquisition |
For Azure Global, Entra VM login requires access to at least enterpriseregistration.windows.net, login.microsoftonline.com, and pas.windows.net. Sovereign cloud deployments require the corresponding cloud-specific endpoints.
Database-model destinations
Exactly one database model applies to each Brief Connect environment and tool run. Connectivity for the other model must not be added as a fallback.
| Database model | Brief Connect versions | Required destinations |
|---|---|---|
| Legacy DB | 2.5.10 only |
Data storage account Azure Storage Table and Blob endpoints over HTTPS 443; Azure Cosmos DB endpoint when required by deletion |
| Latest DB | 2.5.10 and above |
Azure DocumentDB MongoDB-compatible endpoint and environment-defined port; Azure SQL over TCP 1433 or approved private equivalent when required by deletion |
Brief Connect 2.5.10 can use either model according to its environment configuration. Later supported versions use Latest DB.
Private networking
Environments using Private Link, service firewalls, custom DNS, forced tunnelling, or restricted egress require:
- Routing from the VM subnet to each required private endpoint.
- Private DNS resolution from the VM for each private endpoint.
- Service firewall or network ACL authorization for the VM network path.
- Proxy or firewall rules for required Microsoft 365 and Entra endpoints.
- TLS inspection compatibility with Microsoft identity, Graph, SharePoint, and Azure service requirements.
Required deployment information
The deployment process requires the following non-secret values:
| Input | Requirement |
|---|---|
| Azure subscription | Approved target subscription |
| Tools resource group | Dedicated customer-controlled resource group |
| Azure region | Primary region of the Brief Connect resources for the selected environment |
| VM name | Customer-approved resource name |
| VNet and subnet | Existing approved network resources |
| Key Vault | Existing environment-specific Brief Connect Key Vault |
| Operator group | Authorised Microsoft Entra ID security group |
| Database model | Exactly one of Legacy DB or Latest DB |
| SQL managed identity | Existing environment-specific identity when required |
| Administration path | Approved Bastion, VPN, private RDP, or equivalent path |
| Resource tags | Tags required by customer policy |
| Provisioner access | Permission to create the VM, NIC, and disks and to create role assignments on the VM and existing Key Vault |
Deployment records must not contain passwords, certificate values, connection strings, access tokens, or private keys.
Security and operational controls
| Control | Requirement |
|---|---|
| Environment isolation | A dedicated VM per Brief Connect environment where possible; identities, Key Vault, network paths, configuration, and retained output remain environment-aligned |
| Endpoint protection | Customer policy |
| Vulnerability management | Customer policy |
| Monitoring and alerting | Customer policy |
| Pending restart | Monitored and resolved during an approved maintenance window |
| Backup | Customer policy; VM backup does not replace tool dry runs, checkpoints, journals, or evidence |
| Auto-shutdown | Disabled unless its schedule cannot overlap tool sessions or maintenance activity |
| Deallocation | Supported while unused; retained resources continue to incur charges |
| Disk encryption | Customer policy |
| Configuration compliance | Customer policy |
| Access review | Customer policy |
| Resource tags | Tags required by customer policy |
| Evidence | Resource IDs, image, size, disks, network placement, identity IDs, role scopes, configuration state, and approved variances |
Deployment and operational evidence must not contain credentials, tokens, certificate values, private keys, Key Vault secret values, connection strings, customer document contents, or unrestricted service responses.
Provisioned-state requirements
Infrastructure is suitable for EC Tools when all of the following conditions hold:
| Area | Required state |
|---|---|
| Compute | Approved Windows image, x64 architecture, and at least 2 vCPU and 4 GiB RAM |
| Security | Trusted Launch, Secure Boot, vTPM, customer-managed patch schedule with automatic restart disabled, and customer-required security controls configured |
| Storage | Persistent NTFS tools volume with sufficient free space |
| Exposure | No public IP, public application endpoint, or broad inbound administration rule |
| Identity | VM system identity enabled and scoped to the environment Key Vault only |
| Conditional SQL identity | Correct environment SQL identity attached only when required |
| Operator access | Approved authentication path and VM-scoped operator authorization configured |
| DNS and routing | Every required common and selected database-model endpoint resolves and is reachable through an approved path |
| Package compatibility | Approved self-contained win-x64 package can execute without a separately installed .NET runtime |
| Preflight | Tool non-destructive preflight succeeds without data writes |
Live deletion and metadata updates are not infrastructure validation methods.