Recently I was invited to conduct a technical session for CINEC Campus. Glad to see a large enthusiastic crowd.
Following is the structure for code to write Azure Policy as a Code. You can specify policy initiatives, definitions and assignments as you wish
//Parameters
//Variables
//Policy initiative
resource PolicyInitiative 'Microsoft.Authorization/policySetDefinitions@2020-09-01' = {
properties: {
policyType: 'Custom'
displayName: initiativeName
description: 'Custom Policy Initiative'
metadata: {
category: policyCategory
source: policySource
version: '0.1.0'
}
parameters: {
//Your custom parameters
}
policyDefinitions: [
//Selected policy definitions based on existing Microsoft policy definitions
]
}
}
//Policy assignment
resource PolicyAssignment 'Microsoft.Authorization/policyAssignments@2020-09-01' = {
name: assignmentName
properties: {
displayName: assignmentName
description: 'Custom Policy Assignment'
enforcementMode: assignmentEnforcementMode
metadata: {
source: policySource
version: '0.1.0'
}
policyDefinitionId: PolicyInitiative.id
parameters: {
//Your parameters
}
}
}
We encounter Cross-Origin Resource Sharing (CORS) errors when we call an API from another domain if proper policies are not allowed.
In order to resolve the issue we need to allow the calling domain in our API. In this instance it is an Azure Function.
Following are the steps to resolve the error
1. Navigate to Azure Function and navigate to the CORS blade in API section
2. Then specify the calling application URL in Allowed Origins section. In this instance it is the Azure static web app I'm using.
.
Now I'm able to connect to the API which is an azure function app with SignalR output binding
In this article I'll introduce Well-architected framework, Azure advisor and Advisor score. More importantly I'll illustrate how they are interconnected and how can we use them together to achieve cloud excellence.
Azure well-architected framework
Microsoft Azure has a large collection of features categorized into IaaS, PaaS and SaaS. It is very difficult for us to gain expertise on each workload.
As a solution, Microsoft has introduced the well-architected framework which guides us on implementing Azure services with best practices. Furthermore, it assists us on operating and governing services those are already implemented in our tenant.
The Well-architected framework is built with five pillars. When implementing or operating Azure services we should always consult following pillars. The detailed documentation is available here
1. Cost optimization
Most of the cloud offerings are delivered as pay-as-you-go modal. So we need to be very careful on picking right workloads as you need to select the most cost effective solution. Furthermore when and where to use our resources. Some guidelines are given below
2. Performance efficiency
This is discusses how can your workloads meet varying demands in an efficient way. You should consider about
Azure advisor
Azure advisor is your personal assistant in the cloud.
It provides you with recommendations and corrective actions improve your cloud workloads. It provides feedback on following areas
Advisor score
Azure advisor score is the consolidated figure calculated based on your progress towards achieving the excellence in your cloud.
You can have the current score as the baseline and set an improved figure as the target. Then you can follow recommended actions to achieve the target score,
Summary
Well-architected framework is a great tool to achieve the excellence in Azure cloud. You don't need to reinvent the wheel.
You can use Azure advisor and advisor score to keep your tenant complied with the well-architected framework.
Cloud Adoption Framework (CAF) guides you to implement your cloud workloads in Azure with best practices. We encounter the concept of Landing Zones at the latter part of CAF.
I will briefly describe the concept of Landing Zones in this article. You can access the official documentation via this link
Landing Zones allow us to implement resources within subscriptions declaratively. It will commission the foundation of our cloud tenant with best practices and guidelines.
Why do we need landing zones? What is the problem with GUI/Wizard based provisioning via the beloved portal?
Landing zones are built with code to provision workloads in our tenant. Since it is written in code, we can version our cloud infrastructure in a source code repository. As we have the code, we can scale our cloud environment as we wish and we can repeatedly execute this in many environments.
Furthermore, landing zones are built in declarative manner where our resources are idempotent. Landing zones are structured in a modular manner where we can execute another landing zone in our environment on top of an existing zone.
Following are the key takeaways :)
There are mainly two ways that we can implement the our landing zones
1. Small Scale (Forever small or starting small)
Let's assume that we have only a single subscription or we want to start very small and gradually progress to enterprise level. Then the small scale landing zone model would be the preferred design choice.
We can develop small scale landing zone with ARM templates, Azure Policy and Azure Blueprint.
Azure provides kick-start packages where we can start our small scale landing zone journey.
Since landing zones are modular in nature, we can first apply the foundation blueprint and later add the migration blueprint to the same subscription.
2. Enterprise Scale
This is where you design and build your tenant at enterprise level. The tenant might contain multiple subscriptions with their own dedicated workloads.
Why do we need multiple subscriptions in my tenant? can't I use a single subscription to house all my workloads?
Yes you can. But that's not the best practice. The idea is to separate and contain interests within specific boundaries.
For an example you can have a subscription to contain specific application and relevant components. You can secure and govern it with firewalls and policies. You should not mix this with unrelated Virtual Machine workloads that cater a separate business function. Ideally those workloads should reside in a separate subscription.
We can develop enterprise scale landing zones with ARM templates and Azure policies.
Azure provides following kick-start packages for enterprise
Recently I did a session on building data solutions with Microsoft Azure for the students of Faculty of Technology, University of Ruhuna.
This is a continuation of my previous session.
