I design cloud platforms that regulated organisations can defend to their risk committee and their regulator.
I'm Binu Sooryachandran. I have 20 years in enterprise infrastructure, and I've worked on Azure since 2017. Today I'm co-architect and engineer of an enterprise Azure platform at an APRA-regulated financial services organisation.
What a decision looks like
This one comes from my lab. The design called for one token per level, but the free tier of HCP Terraform has no teams, so those tokens could not exist.
Rejected
User token in CI
Ties automation to one person, and breaks when they leave.
Rejected
Pay for the Essentials tier
Teams are the only gap, so the gap is documented instead of funded.
Kept as fallback
Azure Storage backend
Isolates state with Azure RBAC, but gives up shared outputs, the private registry and dynamic credentials.
Chosen
One owners team token, treated as Tier 0
Stored only as a GitHub environment secret, with a 30-day maximum lifetime.
Risk accepted
A leaked token can read and write every workspace's state
Azure and Entra permissions stay isolated, because they come from separate OIDC identities at each level.
The lab
I'm building a right-sized Azure landing zone and Entra ID baseline as Terraform, with AI workload security to follow. Some of it exists today and most of it doesn't yet, so I keep a plain status list.
Certifications
- Microsoft Certified: Azure Solutions Architect Expert
- Microsoft Certified: Azure Administrator Associate
- CISSP
- CCSP
- TOGAF 9
Studying for SC-500 and then SC-100. Neither is complete.