Skip to content
Docs
foxborne.comRequest a pilot

Deploy in Azure Government

Give a Foxborne deployment in Azure Government the same properties as the example on AWS GovCloud. That means no internet egress, keys you hold in Key Vault, write-once originals and a private PostgreSQL 16.

How-toAzure GovernmentAdminMarkdown
On this page6

Foxborne deploys into your Azure Government subscription as it does into AWS. Originals stay in your storage under your key, and nothing leaves your network. The console's example runs in AWS GovCloud, so this page maps each of its parts to an Azure Government service with the same property.

Properties, not a recipe

The properties come from Foxborne: no egress, your key, write-once originals and read-only sources. The Azure services named below are one way to provide each of them.

How the example maps to Azure Government#

PropertyExample in AWS GovCloudIn Azure Government
No internet egressVPC with egress deniedA virtual network whose subnets deny outbound internet traffic
Customer-managed keyAWS KMS key, rotated yearlyA key in Azure Key Vault with a rotation policy
Write-once originalsS3 Object Lock, compliance mode, 7 yearsA Blob container with a locked time-based retention policy
Encrypted object storageSSE-KMS with the customer keyStorage account encryption with your customer-managed key
PostgreSQL 16Multi-AZ, in the VPCPostgreSQL 16 on private networking, such as Azure Database for PostgreSQL flexible server
BackupsAWS Backup vault, customer key, daily, kept 35 daysBackups encrypted with your key, on your program's schedule
Read-only sourcesAn IAM role you createA managed identity with the Storage Blob Data Reader role

The middle column holds values from the console's example dataset. They are examples, not requirements.

Before you start#

  • You need the Admin role in Foxborne to open Hosting. Admins manage hosting, keys and access.
  • You need an Azure Government subscription where you can create a virtual network, a key vault, a storage account and a PostgreSQL server.
  • Your identity provider signs users in over SAML 2.0, and your SIEM accepts syslog over TLS inside your network.
  • You have the signed release bundle, a .fxb file, for the version you install.

Prepare the subscription#

  1. Build a network with no path out

    Place the deployment in a virtual network and deny outbound internet traffic from its subnets. A network security group rule that denies the Internet service tag does this, at a higher priority than the default AllowInternetOutBound rule.

    Reach Blob Storage and Key Vault through private endpoints, so their traffic stays on the virtual network. Engineers reach the console from your network or VPN, never from the internet.

  2. Create the key in Key Vault

    Create a key vault with soft delete and purge protection turned on, since Azure Storage requires both for a customer-managed key. Create the key and give it a rotation policy, so Key Vault rotates it on your schedule.

    When you point the storage account at the key, leave out the key version. Azure Storage then moves to each new version by itself, and a rotation needs no change on the account.

    The key controls the evidence

    Disabling the key, or removing access to it, makes every stored original unreadable, to Foxborne as much as to anyone. Reports and case files encrypted with it become unreadable too.

  3. Create the storage

    Create a storage account encrypted with your customer-managed key, with three containers to match the example's buckets: originals, exports and basemaps.

    Turn on immutable storage for the originals container with a time-based retention policy, then lock the policy. Until the retention period ends, each blob can be read but not modified or deleted, and a locked policy cannot be removed or shortened.

    Azure Government services answer on their own endpoints, such as blob.core.usgovcloudapi.net for Blob Storage.

  4. Create the database

    Run PostgreSQL 16 on private networking, with its data encrypted with your customer-managed key. On Azure Database for PostgreSQL flexible server, choose private access and the customer-managed key when you create the server.

    The example's Multi-AZ database corresponds to zone-redundant high availability, where the region offers availability zones.

  5. Set up backups

    Keep backups encrypted with your customer-managed key, on the schedule your program sets. The example backs up daily and keeps each backup 35 days.

  6. Connect identity and audit

    Foxborne signs users in through your identity provider over SAML 2.0 and provisions them over SCIM. Evidence marked export-controlled opens only for users whose identity provider asserts US person status, in the usPerson SAML attribute. The audit log streams to your SIEM over syslog with TLS, inside your network.

    Single sign-on and SCIM provisioning cover the settings on the Foxborne side.

  7. Give the workers read access to your sources

    Where flight logs already land in Blob Storage, give the Foxborne workers a managed identity. Assign it the Storage Blob Data Reader role on those containers. The role reads and lists blobs and cannot change them.

    In Foxborne, go to Sources, select Add source and choose Azure Blob Storage. Enter the storage account and container, the managed identity and a file pattern, then run Test connection. The test confirms read access and shows that writes and deletes are refused.

  8. Install the signed release

    Each Foxborne release is one signed bundle, a .fxb file, with a software bill of materials. Foxborne checks the bundle's signature against the Foxborne release key before anything installs, and a bundle that does not match installs nothing.

Check the result#

Sign in through your identity provider and open Hosting. The panels match the AWS example, with your own services in place of its values.

PanelWhat to confirm
SummaryMode reads Self-hosted and Environment names where the deployment runs. Version carries Signature verified. Network reads No outbound internet, and License shows seats and the renewal date.
Data boundaryThe dashed line encloses the application, the workers, PostgreSQL 16, original files, the customer-managed key and your IdP and SIEM. Foxborne, Inc. receives nothing sits outside it.
Where each kind of data livesOne row per store, from original files to backups, with your location, encryption and retention.
Encryption keyThe key's name and identifier, its Custody and its Rotation with the last rotation date.
UpdatesInstalled shows the version and date. Signed by names the Foxborne release key, and Bill of materials is stored with the release.
NodesApplication, workers and database, each Healthy. The footer shows Last backup and Restore tested on.
Outbound connectionsFoxborne, Inc. None, map and tile services None, identity provider Inbound, your SIEM Internal.

The status bar repeats the environment, No outbound internet and the version on every screen.

Troubleshoot#

A locked retention policy cannot be undone. A locked policy can be extended but not shortened or removed, and protected blobs stay until their period ends. Settle the period before the first original arrives.

The key is disabled or its access removed. Stored originals and exports stay unreadable until access returns. Soft delete keeps a deleted key recoverable for the vault's retention period, and purge protection stops anyone purging it early.

The console is not reachable from outside your network. That is the intended layout. Connect over the VPN or from a network listed under Access, Sign-in, Sessions.

Collectors cannot connect. Each vehicle opens an outbound HTTPS connection to the deployment's address while it is on the ground. Give that address a route from the network the vehicles use, as in Install and enroll the collector.

Next#