Skip to content

Azure Static Hosting Security Baseline

This docs site is hosted on Azure Static Web Apps and follows a hardened deployment pattern for ACX + Longhaul content.

Security Controls in This Repository

  1. OIDC-based Azure auth in GitHub Actions
    The deploy workflow uses azure/login@v2 with federated identity (AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID) instead of long-lived Azure credentials.

  2. Short-lived signed URL for deployment artifact
    The workflow uploads a zip artifact to a private blob container and generates a read-only user-delegation SAS URL with:

  3. HTTPS-only
  4. 30-minute default expiration

  5. Read-only permissions

  6. Security headers at the edge
    staticwebapp.config.json enforces HSTS, CSP, frame protection, and browser hardening headers.

  7. No secrets in source
    Deployment uses GitHub Secrets and OIDC; no access keys or SAS tokens are committed.

Required Secrets

Set these in the repository before enabling production deployment:

  • AZURE_STATIC_WEB_APPS_API_TOKEN
  • AZURE_CLIENT_ID
  • AZURE_TENANT_ID
  • AZURE_SUBSCRIPTION_ID
  • DOCS_ARTIFACT_STORAGE_ACCOUNT
  • DOCS_ARTIFACT_CONTAINER
  1. Keep the blob container private (no anonymous read).
  2. Use least-privilege RBAC for the workflow identity (Blob Data Contributor scoped only to the artifact container).
  3. Rotate Static Web Apps deployment token on a regular schedule.
  4. Enable diagnostic logs and retention for both Static Web Apps and Storage.