The summary.
CHOOSE THE MOST MANAGED OPTION THAT MEETS THE REQUIREMENT
Every layer you manage is a layer you must patch, secure and monitor. Virtual machines chosen out of familiarity are a recurring mistake.
PLAN NON-OVERLAPPING ADDRESS RANGES BEFORE BUILDING ANYTHING
Overlapping ranges prevent connectivity to your existing networks, and renumbering afterwards is painful.
NEVER EXPOSE MANAGEMENT PORTS TO THE INTERNET
They are scanned continuously. Use a bastion service or private connectivity.
And storage left publicly readable is a frequent cause of exposure, actively scanned for.
USE MANAGED IDENTITIES AND A KEY VAULT
That removes credentials from configuration entirely, which is the single most valuable security change available.
THE COMMONEST COST WASTE IS RESOURCES LEFT RUNNING AFTER THEY ARE FINISHED WITH
Set budgets and alerts on day one, tag everything, and automate shutting down non-production environments.
CLOUD RESOURCES ARE NOT BACKED UP BY DEFAULT
Configure it deliberately, protect the backups from deletion, separate backup access from resource administration, and test restoring on a schedule.
DEFINE INFRASTRUCTURE IN FILES, NOT THE PORTAL
It is what makes environments identical and disaster recovery credible.
