Skip to content
View simon-vedder's full-sized avatar
2 followers · 1 following

Block or report simon-vedder

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
simon-vedder/README.md

Simon Vedder, cloud and cloud-security engineer in Zurich. Azure automation, identity audits, infrastructure as code: AzureInPlaceUpgrade, Least Privilege Studio, App Lifecycle Analyzer, VM Power Management, Terraform Secrets, RiskyRolesAnalyzer.

Blog LinkedIn PowerShell Gallery

Cloud & cloud-security engineer near Zurich. I work across Azure platform engineering and cloud security, with a focus on Microsoft Entra ID, RBAC and infrastructure-as-code. Some of the tools below run tedious Azure work unattended, the others audit what a tenant actually allows. All of them are tested against live tenants before they're written up at simonvedder.com.

Tools

Tool What it does Ships as
AzureInPlaceUpgrade Tag-driven, unattended in-place upgrades of Windows Server on Azure VMs: preflight, snapshot, detached Setup, Azure Automation state machine, Log Analytics workbook PowerShell Gallery module + Bicep deploy
Least Privilege Studio Find the minimal Azure RBAC role that covers a set of actions and generate the assignment Web app
App Lifecycle Analyzer Read-only lifecycle audit of Entra ID app registrations: secrets, certs, federated credentials, sign-in activity PowerShell script → HTML report
Azure VM Power Management Tag-driven start/stop for Azure VMs via an AutoShutdown tag Runbook + Terraform
Terraform Secrets Rotate Terraform-provisioned VM credentials via Key Vault + Automation, no plaintext in state Runbook + Terraform
Azure VM Self-Service Order Self-service VM / AVD ordering via a web form: Logic App, Queue, Function App Terraform blueprint
Aria Cloud Enterprise RAG on Azure AI Foundry with private networking Terraform + FastAPI blueprint

Collections: powershell (RiskyRolesAnalyzer, NSG audit, OS inventory, tag audit) · terraform-azure · bicep · arm · kql

Currently building

  • RiskyRolesAnalyzer as a proper module. Azure RBAC and Entra privileged roles in one snapshot: escalation paths through custom-role actions, nested groups, PIM eligibles, dormant privileged app registrations, with -WhatIf-first cleanup. Same pattern as AzureInPlaceUpgrade: Gallery module, Pester, release workflow.
  • AzureInPlaceUpgrade toward 1.0: the remaining paths of the upgrade matrix, plus the blog series.

Upstream

Latest posts

More at simonvedder.com · LinkedIn

Pinned Loading

  1. least-privilege-studio least-privilege-studio Public

    Least-privilege Azure RBAC — find the minimal role that covers a set of Azure actions.

    JavaScript 1

  2. app-lifecycle-analyzer app-lifecycle-analyzer Public

    Read-only lifecycle audit for Entra ID app registrations — secrets, certs, federated creds, sign-in activity, in one HTML report

    PowerShell

  3. azure-vm-power-management azure-vm-power-management Public

    Tag-driven start/stop for Azure VMs via an AutoShutdown tag — runbook + Terraform + optional GUI

    PowerShell

  4. azure-vm-inplace-upgrade azure-vm-inplace-upgrade Public

    Tag-driven, unattended in-place upgrades of Windows Server on Azure VMs: preflight, snapshot, detached Setup, Azure Automation state machine, Log Analytics workbook.

    PowerShell