OOPROJECT SYSTEM / SECURECLOUD HUB← PROJECT INDEX
ZERO-TRUST · AZURE SERVERLESS · FILE SECURITY
PROJECT / 02SYSTEM ONLINE

SECURECLOUD HUBAzure-native zero-trust file sharing with identity, scanning and short-lived access.

A production-style Azure serverless platform using Microsoft Entra ID authentication, direct-to-Blob uploads with temporary write SAS, Event Grid malware scanning, clean/quarantine storage separation and temporary read-only downloads.

AZURE FUNCTIONS FLEXTERRAFORM IACGITHUB ACTIONS · OIDCEASY AUTH · ENTRA IDMANAGED IDENTITY + RBACEVENT GRIDDIRECT-TO-BLOB SAS
START PROJECT STORY ↓ARCHITECTUREGALLERYLIVE SIMULATIONENGINEERING DEEP DIVE ↗
● UPLOAD / WRITE SAS / 10 MIN● DOWNLOAD / READ SAS / 15 MIN● DEPLOYMENT / GITHUB OIDC
ARCHITECTURE / CONTROL SURFACEDEPLOYED AZURE SYSTEM
ACTIVE
SecureCloud Hub Azure architecture
IDENTITYENTRA ID
STORAGEPRIVATE
SCANEVENT DRIVEN
Browser
  ↓
request_upload
  ↓ write SAS
incoming-raw
  ↓
Event Grid → scan_function
              ├── safe-files
              └── quarantine
                     ↓
              download_function
                     ↓
                read SAS
VIEW SOURCE REPOSITORY ↗
01 / OVERVIEW

WHAT SECURECLOUD HUB SOLVES.

Many teams still move sensitive files using emailed attachments, public Blob URLs or long-lived shared SAS tokens. SecureCloud Hub demonstrates a stronger Azure-native pattern: authenticate first, upload directly to private storage, inspect automatically and expose only approved files through temporary read-only SAS.

THE PATTERN

ZERO-TRUST FILE DISTRIBUTION, FROM UPLOAD TO DOWNLOAD.

Files never sit in public containers. The browser never receives account keys. New uploads begin in an untrusted state and only verified content becomes downloadable.

  • Microsoft Entra ID sign-in enforced with Easy Auth.
  • Direct-to-Blob upload using temporary write SAS.
  • All new content initially lands in incoming-raw.
  • scan_function promotes clean files or isolates infected content.
  • download_function validates identity and scanStatus before SAS issuance.
KEY OUTCOMES

IDENTITY-FIRST, SERVERLESS AND AUDIT-FRIENDLY.

The platform is a practical Azure reference implementation spanning Infrastructure as Code, automation, identity, storage security, serverless compute and observability.

EASY AUTHPRIVATE CONTAINERSEVENT-DRIVEN SCANNINGCLEAN / QUARANTINEMANAGED IDENTITYGITHUB OIDC
02 / BUSINESS IMPACT

BUSINESS VALUE DELIVERED BY SECURECLOUD HUB.

The security architecture translates into practical outcomes: reduced exposure, improved auditability and identity-first access across the complete file lifecycle.

  • Reduced malware distribution risk by enforcing inspection before files become downloadable.
  • Minimized data exposure through temporary SAS instead of permanent public links.
  • Improved compliance readiness with audit-friendly upload, scan, quarantine and download telemetry.
  • Removed storage-key exposure from the application path using Managed Identity, RBAC and OIDC.
  • Enabled secure internal file sharing without email attachments or long-lived shared links.
  • Separated untrusted, clean and quarantined content into dedicated private containers.
03 / ZERO-TRUST PRINCIPLES

ZERO TRUST BY DESIGN.

Every stage reduces implicit trust and narrows the blast radius of a leaked link, malformed upload or misrouted request.

01 / CONTROL

PRIVATE BY DEFAULT

Storage accounts disable anonymous blob access. All containers remain private and valid data paths use short-lived SAS or authenticated requests.

PRIVATE BLOB STORAGENO PUBLIC BLOB URLS
02 / CONTROL

IDENTITY-FIRST ACCESS

Easy Auth with Microsoft Entra ID is enabled on the Function App. Users authenticate before reaching the frontend or APIs.

EASY AUTH ENFORCEDX-MS-CLIENT-PRINCIPAL
03 / CONTROL

LEAST-PRIVILEGE ACCESS

Uploads receive short-lived write SAS. Downloads receive read-only SAS only after backend validation.

WRITE SAS / 10 MINREAD SAS / 15 MINPER-FILE SCOPE
04 / CONTROL

EVENT-DRIVEN SCANNING

Uploads enter incoming-raw as untrusted content. Event Grid invokes scan_function to classify each new blob.

EVENT GRIDSAFE / QUARANTINE
05 / CONTROL

VERSIONING & LIFECYCLE

Versioning, retention, soft delete and lifecycle policies improve recovery while controlling storage growth.

VERSIONINGSOFT DELETELIFECYCLE RULES
06 / CONTROL

IAC + PASSWORDLESS CI/CD

Terraform provisions the platform and GitHub Actions deploys through OpenID Connect federation without long-lived pipeline secrets.

TERRAFORMGITHUB ACTIONS + OIDCNO STORED SECRETS
04 / AZURE ARCHITECTURE

FROM UPLOAD REQUEST TO SECURE DOWNLOAD.

SecureCloud Hub is built from discrete Azure components that map directly to deployed resources and Python Functions. The platform is fully rebuildable through Terraform and mirrors a production serverless design.

LOGICAL COMPONENTS
01

GitHub Actions CI/CD

deploy-infrastructure · deploy-application

GitHub Actions deploys infrastructure and Function code using OIDC federation, avoiding long-lived Azure credentials.

OIDC LOGININFRA / APP SEPARATION
02

Terraform IaC layer

Resource Group · Storage · Function App · Event Grid · Monitoring

Terraform provisions the storage account, containers, Flex Function App, Event Grid subscription, monitoring resources, and RBAC assignments.

03

Frontend + Easy Auth

frontend Function · Microsoft Entra ID

The frontend is served through the Function App, and Easy Auth forces Microsoft sign-in before users can see files or request operations.

FRONTENDEASY AUTH
04

Upload SAS issuer

request_upload_function

The backend creates a short-lived write-only SAS URL for the authenticated user, scoped to their blob path in incoming-raw.

05

Storage account + containers

incoming-raw · safe-files · quarantine · function-packages

Files move across private containers according to trust state. Clean files never mix with unscanned or infected content.

06

Event Grid + scan_function

BlobCreated → scan pipeline

Event Grid watches incoming-raw and triggers scan_function when new uploads arrive.

07

Clean file listing

list_function

The frontend retrieves only the authenticated user's clean files from safe-files, using user-scoped blob paths.

08

Secure download SAS generator

download_function

The backend checks identity, blob existence, and scanStatus=clean, then issues a short-lived read-only SAS URL.

09

Monitoring & observability

Application Insights · Log Analytics

Logs capture upload SAS issuance, scan execution, clean/infected outcomes, and secure download activity for troubleshooting and auditability.

END-TO-END WORKFLOW
01

User signs in with Microsoft

The browser accesses the Function App frontend and is authenticated through Easy Auth with Microsoft Entra ID.

02

User requests upload SAS

The frontend calls request_upload_function, which returns a short-lived write-only SAS URL.

03

Browser uploads directly to Blob

The selected file uploads directly into incoming-raw/<user-id>/filename without streaming through the Function App.

04

Event Grid triggers scan

BlobCreated events from incoming-raw invoke scan_function.

05

File is scanned and tagged

The scan pipeline writes metadata including scanStatus, scanReason, and scannedAtUtc.

06

Promote or quarantine

Clean files move to safe-files. Infected files move to quarantine.

07

User refreshes clean file list

list_function shows only clean files belonging to the authenticated user.

08

User requests secure download link

download_function validates the blob and generates a short-lived read-only SAS URL if the file is approved.

09

Browser downloads from Storage

The browser downloads directly from Blob Storage and the SAS expires automatically.

CONTROL SURFACE / LIVE ARCHITECTUREZERO-TRUST DATA PATH
GitHub Actions → Terraform → Flex Function App
Easy Auth (Entra ID) → Managed Identity + RBAC

Browser
   ↓
request_upload_function
   ↓  write SAS / 10m
incoming-raw
   ↓  BlobCreated
Event Grid
   ↓
scan_function
   ├── CLEAN    → safe-files
   └── INFECTED → quarantine
                      ↓
list_function → download_function
                      ↓
                read SAS / 15m
                      ↓
                  Browser
05 / SECURITY CONTROLS

DEFENSE-IN-DEPTH ARCHITECTURE.

Security controls operate across identity, storage, application flow, content safety, CI/CD and operations.

01 / SECURITY DOMAIN

STORAGE HARDENING

  • Public Blob access disabled.
  • incoming-raw, safe-files and quarantine remain private.
  • CORS scoped for direct browser upload with SAS.
  • Lifecycle rules manage retention and cleanup.
02 / SECURITY DOMAIN

IDENTITY-FIRST ACCESS

  • Easy Auth blocks unauthenticated access before application code.
  • Backend identity is derived from trusted platform headers.
  • Managed Identity + RBAC replace storage keys.
  • User-scoped paths isolate ownership.
03 / SECURITY DOMAIN

MALWARE & CONTENT SAFETY

  • All uploads initially remain untrusted.
  • Event Grid triggers scan_function automatically.
  • Scan metadata records the trust decision.
  • download_function refuses SAS unless scanStatus=clean.
04 / SECURITY DOMAIN

SECRETS & CI/CD

  • GitHub Actions authenticates through OIDC.
  • Managed Identity minimizes application secrets.
  • Key Vault can support future secret-backed integrations.
  • Terraform keeps infrastructure reproducible.
06 / SCREENSHOT GALLERY

KEY HIGHLIGHTS OF SECURECLOUD HUB.

These screenshots mirror the real system: architecture, authentication, storage layout, event-driven scanning, Function code, CI/CD, monitoring, and the working client experience.

07 / INTERACTIVE DEMO

HOW SECURECLOUD HUB WORKS.

Select any local file to simulate SAS generation, direct-to-Blob upload, Event Grid malware scanning, clean-file promotion, and secure download-link creation. No real upload occurs.

SECURECLOUD HUB / PORTALZERO-TRUST FILE SHARING SIMULATION
SAFE SIMULATION / NO REAL UPLOADS
SIGNED INrecruiter@contoso.com
✓ ENTRA ID
READY FOR SIMULATION0%
FILESTATUSLINK

NO FILES YET — RUN A SIMULATION ABOVE

WORKFLOW STATUS
01

User authenticated with Microsoft Entra ID

VERIFIED
02

Frontend requests short-lived upload SAS

WAITING
03

Browser uploads directly to incoming-raw

WAITING
04

Event Grid triggers malware scan function

WAITING
05

Clean file promoted to safe-files

WAITING
06

Download function issues read-only SAS link

WAITING
08 / TECH STACK

AZURE-NATIVE. IAC-DRIVEN. IDENTITY-FIRST.

PLATFORM DOMAIN

CORE PLATFORM

  • Azure Functions Flex Consumption
  • Azure Blob Storage
  • Azure Event Grid
  • Application Insights
  • Log Analytics
PLATFORM DOMAIN

IDENTITY & SECURITY

  • Microsoft Entra ID
  • Easy Auth
  • Managed Identity
  • RBAC
  • User delegation SAS
PLATFORM DOMAIN

DEVOPS & AUTOMATION

  • Terraform
  • GitHub Actions
  • OIDC federation
  • Function deployment
  • Operational telemetry
09 / PROJECT SNAPSHOT

SECURECLOUD HUB / SYSTEM STATE.

UPLOAD MODELBrowser → request_upload → short-lived write SAS → incoming-raw
DOWNLOAD MODELdownload_function → read-only SAS → direct Blob download
AUTHENTICATIONEasy Auth + Microsoft Entra ID
CONTENT SAFETYincoming-raw → Event Grid → scan_function → safe-files / quarantine
IDENTITY MODELManaged Identity + RBAC
CI/CD & IACTerraform + GitHub Actions OIDC
10 / CHALLENGES & LESSONS

WHAT I LEARNED BUILDING SECURECLOUD HUB.

The strongest engineering lessons came from architecture changes, runtime debugging and production-style fixes.

01Switching from streamed uploads to direct-to-Blob upload SAS+

The original design could proxy uploads through the Function App. I moved the data path directly from the browser to Blob Storage instead.

  • Lower Function App load and more scalable upload handling.
  • Required Storage CORS and tighter browser-side flow design.
  • Resulted in an enterprise-style short-lived write-SAS upload path.
02Getting user-scoped blob paths correct end-to-end+

The frontend and backend needed a consistent distinction between display names and the real user-scoped Blob path.

  • The interface only displays the base filename.
  • The backend reconstructs the Blob path using authenticated identity.
  • Authorization remains inside the trusted backend boundary.
03Reworking infrastructure for Flex Consumption+

Moving the Function App to Flex Consumption required infrastructure and deployment changes rather than a simple SKU replacement.

  • Flex provisioning differs from classic Linux Consumption.
  • Several application settings and site configuration patterns changed.
  • Event Grid and application deployment had to be revalidated.
04Solving runtime issues in Event Grid and Easy Auth+

The strongest engineering lessons came from troubleshooting the actual integration between authentication and platform events.

  • Event Grid subscriptions had to be recreated after infrastructure changes.
  • Easy Auth needed the Event Grid webhook path handled correctly.
  • Additional Function and Application Insights telemetry exposed the real runtime behaviour.