Skip to content
CloudRunbook logo
Start Here

CloudRunbook | Practical Cloud Engineering

Start Here

If you only read a few things, follow this path: land the platform safely, sort identity, keep networking predictable, then standardise monitoring and ops without the drama.

The path

Follow the order; each layer assumes the last one exists.

See all posts →
  1. Secure Landing Zone 7 min read

    Design the management group tree, policy guardrails, logging baseline, and subscription lifecycle.
  2. Identity-first Architecture 7 min read

    Entra roles, PIM, workload identity, and secrets discipline so privileges are never standing.
  3. Secure Networking 6 min read

    Hub & spoke or vWAN patterns, Private Link conventions, DNS, and egress control.
  4. Defender for Cloud 5 min read

    Defender coverage, actionable recommendations, and feedback loops that close the gap with app teams.

Want everything on one topic instead? Landing Zones · Identity · Secure Networking · Defender for Cloud

What makes CloudRunbook different
  • Every post is structured like a runbook: prerequisites, steps, checks, and rollback.
  • Architecture trade-offs explained for real deadlines and regulatory pressure.
  • Security is the default, not the final tick-box before go-live.
Short on time? Stage 01 — Secure Landing Zone — is the one to read if you only read one.

Also worth reading

Deeper cuts and change notes that sit alongside the path rather than inside it.