Enforce Security Prereqs

Ensure infrastructure/code templates explicitly and correctly handle the two most common security failure points: (1) required authorization for identities to perform discovery/monitoring, and (2) strict validation of user-supplied parameters.

Apply this as a checklist:

• Authorization (RBAC):
  • Document and implement the exact role assignment(s) required for the managed identity/service to access target resources.
  • If discovery/monitoring depends on permissions, make it a “must-do” step early; otherwise the deployment may succeed but produce no discovered entities.
  • Prefer least-privilege scoping (e.g., subscription/resource group) where appropriate, rather than repeating assignments on every resource.
• Input validation (template parameters):
  • For any required string parameters (names/IDs), add min/max length constraints (and other validation) so invalid values fail fast at deployment time.

Example (Bicep/ARM-style validation + scoped RBAC intent):

param healthModelName string(minLength: 3, maxLength: 50) // validate required inputs

// RBAC (conceptual): assign the managed identity the needed monitoring/discovery permissions
// at the smallest practical scope (resource group / subscription) instead of per-resource.
// (Implement using the template’s RBAC assignment constructs and the correct role definition.)

This prevents silent security/authorization failures (no effective access) and reduces misconfiguration risk by rejecting invalid inputs early.