Implement NSP for supported services

[doherty100]

Implement a Network Security Perimeter for all supported PaaS services.

[doherty100]

NSP compatibility assessment — deferring until all in-scope services are onboarded

Before implementing a Network Security Perimeter (NSP) across the sandbox's PaaS services, I reviewed the NSP onboarded private link resources against the services this project provisions:

Resource (module)	ARM type	NSP status
Key Vault (vnet-shared)	Microsoft.KeyVault/vaults	✅ GA
Storage Account (vnet-app)	Microsoft.Storage/storageAccounts	✅ GA
Log Analytics Workspace (vnet-shared)	Microsoft.OperationalInsights/workspaces	✅ GA (Azure Monitor)
Application Insights (vnet-app)	Microsoft.Insights/components	✅ GA (Azure Monitor)
Azure SQL DB (mssql)	Microsoft.Sql/servers	⚠️ Public Preview
MySQL Flexible Server (mysql)	Microsoft.DBforMySQL/flexibleServers	❌ Not onboarded

Blockers

• MySQL Flexible Server is not an NSP-onboarded service, so it cannot be associated with a perimeter today. Because mysql is in scope for this issue, NSP cannot cover all in-scope services.
• Azure SQL DB NSP is only in Public Preview — usable in a sandbox but without an SLA and subject to change, so it isn't suitable as a GA-quality deliverable yet.

Additional notes

• There is no native azurerm NSP resource; NSP would have to be implemented via the azapi provider (already pinned in this project).
• NSP in enforced mode denies public traffic by default, which conflicts with the data-plane writes Terraform performs over the public network (Key Vault secrets, blob uploads, diagnostic settings). This is the same tension the existing public-access barrier pattern solves, so integration would require barrier-style ordering, transition mode during apply, or inbound access rules for the Terraform SPN.

Decision

Deferring this issue until all in-scope services are onboarded to NSP. Implementing NSP only for the GA-supported subset (Key Vault, Storage, Azure Monitor) while leaving MySQL uncovered and SQL DB on a preview API would produce an inconsistent, partial security posture. This will be revisited once MySQL Flexible Server (and a GA NSP for Azure SQL DB) are onboarded.