# Deploy in Azure Government

URL: /deploy/azure-government

Give a Foxborne deployment in Azure Government the same properties as the example on AWS GovCloud. That means no internet egress, keys you hold in Key Vault, write-once originals and a private PostgreSQL 16.



Foxborne deploys into your Azure Government subscription as it does into AWS. Originals stay in your storage under your key, and nothing leaves your network. The console's example runs in AWS GovCloud, so this page maps each of its parts to an Azure Government service with the same property.

<Callout type="note" title="Properties, not a recipe">
  The properties come from Foxborne: no egress, your key, write-once originals and read-only sources. The Azure services named below are one way to provide each of them.
</Callout>

## How the example maps to Azure Government [#how-the-example-maps-to-azure-government]

| Property                 | Example in AWS GovCloud                             | In Azure Government                                                                        |
| ------------------------ | --------------------------------------------------- | ------------------------------------------------------------------------------------------ |
| No internet egress       | VPC with egress denied                              | A virtual network whose subnets deny outbound internet traffic                             |
| Customer-managed key     | AWS KMS key, rotated yearly                         | A key in Azure Key Vault with a rotation policy                                            |
| Write-once originals     | S3 Object Lock, compliance mode, 7 years            | A Blob container with a locked time-based retention policy                                 |
| Encrypted object storage | SSE-KMS with the customer key                       | Storage account encryption with your customer-managed key                                  |
| PostgreSQL 16            | Multi-AZ, in the VPC                                | PostgreSQL 16 on private networking, such as Azure Database for PostgreSQL flexible server |
| Backups                  | AWS Backup vault, customer key, daily, kept 35 days | Backups encrypted with your key, on your program's schedule                                |
| Read-only sources        | An IAM role you create                              | A managed identity with the Storage Blob Data Reader role                                  |

The middle column holds values from the console's example dataset. They are examples, not requirements.

## Before you start [#before-you-start]

* You need the **Admin** role in Foxborne to open **Hosting**. Admins manage hosting, keys and access.
* You need an Azure Government subscription where you can create a virtual network, a key vault, a storage account and a PostgreSQL server.
* Your identity provider signs users in over SAML 2.0, and your SIEM accepts syslog over TLS inside your network.
* You have the signed release bundle, a `.fxb` file, for the version you install.

## Prepare the subscription [#prepare-the-subscription]

<Steps>
  <Step title="Build a network with no path out">
    Place the deployment in a virtual network and deny outbound internet traffic from its subnets. A network security group rule that denies the `Internet` service tag does this, at a higher priority than the default `AllowInternetOutBound` rule.

    Reach Blob Storage and Key Vault through private endpoints, so their traffic stays on the virtual network. Engineers reach the console from your network or VPN, never from the internet.
  </Step>

  <Step title="Create the key in Key Vault">
    Create a key vault with soft delete and purge protection turned on, since Azure Storage requires both for a customer-managed key. Create the key and give it a rotation policy, so Key Vault rotates it on your schedule.

    When you point the storage account at the key, leave out the key version. Azure Storage then moves to each new version by itself, and a rotation needs no change on the account.

    <Callout type="warning" title="The key controls the evidence">
      Disabling the key, or removing access to it, makes every stored original unreadable, to Foxborne as much as to anyone. Reports and case files encrypted with it become unreadable too.
    </Callout>
  </Step>

  <Step title="Create the storage">
    Create a storage account encrypted with your customer-managed key, with three containers to match the example's buckets: originals, exports and basemaps.

    Turn on immutable storage for the originals container with a time-based retention policy, then lock the policy. Until the retention period ends, each blob can be read but not modified or deleted, and a locked policy cannot be removed or shortened.

    Azure Government services answer on their own endpoints, such as `blob.core.usgovcloudapi.net` for Blob Storage.
  </Step>

  <Step title="Create the database">
    Run PostgreSQL 16 on private networking, with its data encrypted with your customer-managed key. On Azure Database for PostgreSQL flexible server, choose private access and the customer-managed key when you create the server.

    The example's Multi-AZ database corresponds to zone-redundant high availability, where the region offers availability zones.
  </Step>

  <Step title="Set up backups">
    Keep backups encrypted with your customer-managed key, on the schedule your program sets. The example backs up daily and keeps each backup 35 days.
  </Step>

  <Step title="Connect identity and audit">
    Foxborne signs users in through your identity provider over SAML 2.0 and provisions them over SCIM. Evidence marked export-controlled opens only for users whose identity provider asserts US person status, in the `usPerson` SAML attribute. The audit log streams to your SIEM over syslog with TLS, inside your network.

    [Single sign-on](/security/sso) and [SCIM provisioning](/security/scim) cover the settings on the Foxborne side.
  </Step>

  <Step title="Give the workers read access to your sources">
    Where flight logs already land in Blob Storage, give the Foxborne workers a managed identity. Assign it the Storage Blob Data Reader role on those containers. The role reads and lists blobs and cannot change them.

    In Foxborne, go to **Sources**, select **Add source** and choose **Azure Blob Storage**. Enter the storage account and container, the managed identity and a file pattern, then run **Test connection**. The test confirms read access and shows that writes and deletes are refused.
  </Step>

  <Step title="Install the signed release">
    Each Foxborne release is one signed bundle, a `.fxb` file, with a software bill of materials. Foxborne checks the bundle's signature against the Foxborne release key before anything installs, and a bundle that does not match installs nothing.
  </Step>
</Steps>

## Check the result [#check-the-result]

Sign in through your identity provider and open **Hosting**. The panels match the AWS example, with your own services in place of its values.

| Panel                         | What to confirm                                                                                                                                                                                                       |
| ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Summary                       | **Mode** reads Self-hosted and **Environment** names where the deployment runs. **Version** carries **Signature verified**. **Network** reads No outbound internet, and **License** shows seats and the renewal date. |
| Data boundary                 | The dashed line encloses the application, the workers, PostgreSQL 16, original files, the customer-managed key and your IdP and SIEM. **Foxborne, Inc. receives nothing** sits outside it.                            |
| Where each kind of data lives | One row per store, from original files to backups, with your location, encryption and retention.                                                                                                                      |
| Encryption key                | The key's name and identifier, its **Custody** and its **Rotation** with the last rotation date.                                                                                                                      |
| Updates                       | **Installed** shows the version and date. **Signed by** names the Foxborne release key, and **Bill of materials** is stored with the release.                                                                         |
| Nodes                         | Application, workers and database, each **Healthy**. The footer shows **Last backup** and **Restore tested on**.                                                                                                      |
| Outbound connections          | Foxborne, Inc. **None**, map and tile services **None**, identity provider **Inbound**, your SIEM **Internal**.                                                                                                       |

The status bar repeats the environment, **No outbound internet** and the version on every screen.

## Troubleshoot [#troubleshoot]

**A locked retention policy cannot be undone.** A locked policy can be extended but not shortened or removed, and protected blobs stay until their period ends. Settle the period before the first original arrives.

**The key is disabled or its access removed.** Stored originals and exports stay unreadable until access returns. Soft delete keeps a deleted key recoverable for the vault's retention period, and purge protection stops anyone purging it early.

**The console is not reachable from outside your network.** That is the intended layout. Connect over the VPN or from a network listed under **Access**, **Sign-in**, **Sessions**.

**Collectors cannot connect.** Each vehicle opens an outbound HTTPS connection to the deployment's address while it is on the ground. Give that address a route from the network the vehicles use, as in [Install and enroll the collector](/collect/collector/install).

## Next [#next]

* [Azure Blob Storage](/collect/sources/azure-blob) covers the read-only source in detail.
* [Install an update](/deploy/upgrades) when the next signed bundle arrives.
* [Monitor a deployment](/deploy/operations) reads the **Hosting** panels day to day.
* [Architecture and network paths](/deploy/architecture) lists every connection in and out.