Hi folks, earlier this month I wrote an article about Azure Cost Management for Nigel Frank International who are a global leader in Microsoft Recruitment, if you want to learn all about Azure Cost Management you can read my article on 8 tools to help optimise spending and maximise potential in the cloud
I hope you find this article useful and as always leave feedback below.
The Azure Key Vault Service is where you store certificate keys, passwords and more instead of having them stored within your application.
Reducing the chance that application secrets can be leaked is always a good thing, don’t store things like access key’s and usernames and passwords in your application config files etc. – Azure Key Vault is where you will want to store these types of secrets.
Here is a quick list of things you can use Azure Key Vault for:-
A good example of ways to improve existing code is say you have a connection string to SQL Server and you have hard-coded this connection string to use the username and password of an account to gain access to the data held within your SQL Database (back in the day this was fairly common), even encrypting the connection string isn’t as secure as it could be. Changing the code to store the connection string inside Azure Key Vault is one idea (there are a few available), this way you can lock down who can see the connection string, so that people wont be able to get access to the database unless they have the rights to read the connection string from Azure Key Vault (this is just a very simple example).
Other useful things you can use Azure Key Vault for is to create and therefor control encryption keys, instead of doing this manually you can leverage Azure Key Vault functionality to do this on your behalf, and you can also provision and manage SSL Certificates which is extremely useful.
With Azure Key Vault you can control access to the Vault using policies. This means you decide who can do things like read, write, edit secrets and keys stored within the KeyVault.
Azure Key Vault can be integrated with a number of services including: –
To read more about Azure Key Vault here is a link to the official documentation.
Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic optimally to services across global Azure regions, while providing high availability and responsiveness.
What this mean is that you can distribute the traffic your web application receives across different regions throughout the world and this is a great Azure feature – other features like the Azure Load Balancer and Application Gateway cant distribute traffic across regions.
Azure Traffic Manager has a number of routing methods and its important to know the options available and what you can use them for: –
A good example of why Traffic Manager is super awesome, lets say you have your web app running in the North Europe region, all users get directed to this region, what would happen if this region were to go down, not good! – with Traffic Manager you could have a second region (lets say UK South for this example) which has a copy of the web application and If the first region (North Europe) were to go down then Traffic manager would move all of your traffic to the second region meaning your website stays up and running, your users stay happy and bingo, now you have a highly available web application, this is known as performing a failover, also note your now paying for both regions but you have the added reliability and high availability your users may demand.
On a project at work we had a requirement which was basically make the website responsive to users around the globe, one way to aid in this is to use Traffic Manager and implement the Performance routing method, we had a copy of the web application deployed to 3 or 4 regions and when users would hit the website they would be directed to their nearest region which helps with faster response times.
You can read the official documentation on Azure Traffic Manager for lots more information.
Managed Service Identity allows you to securely access your Azure resources and avoid storing credentials in your code like to access these resources, think of things like adding access keys to storage accounts as an example, this is bad practice and you certainly don’t want to add them to your code bas to be checked into git for example.
You can create service identities for a number of Azure resources already and more are coming, examples of the resources you can create service identities include the following: –
If you have some code that needs to access a storage account and you have added the access key to the code in order to access the storage account (please never do this its very bad practice and someone might gain access to your storage account if you do this), perhaps you’ve even moved the access key into Key Vault which is another option, well you could even go a step further and improve security even further.
To do this you can take advantage of managed service identities and instead of using an access key you use a temporary access token, which is generated at run-time. This can then be used to assign role based access control for other resources.
The managed identity for the resource is generated within Azure AD.
Managed Identities come in 2 forms: –
You can learn more from the docs.
When it comes to Azure Security there are several options available, in this blog post I’ll cover Role Based Access Control (RBAC for short).
RBAC is about giving access to Azure resources at a granular level, you can give access to the Subscription all the way down to just a single resource within a subscription. This is perfect if you have the scenario where you have a lot of Azure resources and you may just want to give someone access to just a Virtual Machine or maybe just read-only access to say a storage account.
Azure has built in Roles which you can assign to users, the most common of these roles are as follows: –
You can also create your own custom roles which can be made of different access.
RBAC works when assigned against what’s known as a Security Principal in other words a User, Group, Service Principal or a Managed Identity.
RBAs is made of role definitions and these have action which are assigned to the role definition, an example of this would be say Billing Reader, this allows the user read access to Billing Data. The list of roles are seen below: –
The last thing we need to touch on is the Scope that the RBAC can be assigned, this can take the form of the following: –
At work we normally give people in the project Contributor access to a Resource Group or Groups and normally one, maybe two at most are Owners of the Subscription. If we wish to give some one read-only access to view resources then we make them a Reader.
If we are working on a project and want to give a new dev Contributor access to a Resource Group, then I would log in as an Owner and then find the subscription, chose the subscription and then select Access Control (IAM), and then Add a Role Assignment.
You can also setup alerts when an Owner gives some other user access to your Azure resources if required.
Azure resource locks will at some point save your bacon, it will trust me.
If you want to stop people being able to delete a development resource when they think it’s no longer being used, or more importantly on production resources so that they cannot be deleted (until the lock is deleted), then Azure locks are your friend
Azure Resource Locks are often over looked, most people know about them but never implement them, its always a good idea to use them, so what are you waiting for?
They can be applied at different levels ranging from the Resource Group (think of a folder where your Azure resources reside), down the individual resources themselves.
If there are a few people in your organisation that have one of the roles where they have access privileges to delete resources then Azure resource locks might be something to look into further.
To add a Resource Lock to any resource, simply locate the resource and then click on Locks as per below
As you can see, there are 2 different types of resource locks: –
So how do locks actually work?
When you apply a lock at a parent scope, all resources within that scope inherit the same lock. Even resources you add later inherit the lock from the parent. The most restrictive lock in the inheritance takes precedence.
Unlike role-based access control, you use management locks to apply a restriction across all users and roles.
You can read up more on Azure Locks from the documentation. Go add locks to your production resources just in case, better to be safe than sorry.
On February 29th 2020, we are hosting a brand new, FREE event here in Scotland, UK which is called the Scottish Summit which will have several tracks running.
We are bringing over 60 sessions to you covering multiple tracks as per below:-
To find out more about the event you can view the website and see the list of speakers.
I am giving a talk titled “Super charge your Azure learning” where I will cover how I have learned Azure and go over all the very best resources I have came across in the last 18 months of learning Azure. This talk will be for all levels, people getting started, people who know some Azure and want to learn a bit more, right up to Azure experts who might want to branch out their learning into new areas.
Topics will include:-
I cant wait to welcome people from around the world to the Scottish Summit and hopefully you catch the world premier of my talk.
If you wish to attend then grab your FREE ticket – hope to see you there!
The following is a quick and dirty list I made for the Architect exams so that I could read them quickly before the exam itself. This is mostly for the AZ-302 but good to know regardless of what exam your doing.
The following traffic routing methods are available in Traffic Manager:
App Service plan pricing Tiers
There are a few categories of pricing tiers:
Logic Apps
TO enable high throughput on a Logic App you can go to workflow settings and then choose High Throughput and click ON, this allows up to 300,000 executions every 5 minutes.
App Service Plans
The basic App Service Plan doesn’t support auto-scaling
Create a Linux virtual machine with Accelerated Networking
To create a Windows VM with Accelerated Networking, see Create a Windows VM with Accelerated Networking. Accelerated networking enables single root I/O virtualization (SR-IOV) to a VM, greatly improving its networking performance. This high-performance path bypasses the host from the datapath, reducing latency, jitter, and CPU utilization, for use with the most demanding network workloads on supported VM types. The following picture shows communication between two VMs with and without accelerated networking
Azure Migrate
Migrate databases to Azure with familiar tools
Azure Database Migration Service integrates some of the functionality of our existing tools and services. It provides customers with a comprehensive, highly available solution. The service uses the Data Migration Assistant to generate assessment reports that provide recommendations to guide you through the changes required prior to performing a migration. It’s up to you to perform any remediation required. When you’re ready to begin the migration process, Azure Database Migration Service performs all of the required steps. You can fire and forget your migration projects with peace of mind, knowing that the process takes advantage of best practices as determined by Microsoft.
Note: Using Azure Database Migration Service to perform an online migration requires creating an instance based on the Premium pricing tier.
Types of storage accounts
Azure Storage offers several types of storage accounts. Each type supports different features and has its own pricing model. Consider these differences before you create a storage account to determine the type of account that is best for your applications. The types of storage accounts are:
Azure Functions ARR affinity
If you create azure functions as part of the Basic app service plan, you can enable ARR Affinity which basically allows support for sticky sessions.
Azure App Service Access Restrictions
Access Restrictions enable you to define a priority ordered allow/deny list that controls network access to your app. The list can include IP addresses or Azure Virtual Network subnets. When there are one or more entries, there is then an implicit “deny all” that exists at the end of the list.
Auto Swap Staging Slots (Auto Swap isn’t supported in web apps on Linux.)
VNet Peering – connecting VM’s within the same Azure Region
Global VNet Peering – connecting VM’s across Azure Regions
Choose between Azure messaging services – Event Grid, Event Hubs, and Service Bus
Comparison of services
| Service | Purpose | Type | When to use |
| Event Grid | Reactive programming | Event distribution (discrete) | React to status changes |
| Event Hubs | Big data pipeline | Event streaming (series) | Telemetry and distributed data streaming |
| Service Bus | High-value enterprise messaging | Message | Order processing and financial transactions |
Event Grid
Event Grid is an eventing backplane that enables event-driven, reactive programming. It uses a publish-subscribe model. Publishers emit events, but have no expectation about which events are handled. Subscribers decide which events they want to handle.
Event Grid is deeply integrated with Azure services and can be integrated with third-party services. It simplifies event consumption and lowers costs by eliminating the need for constant polling. Event Grid efficiently and reliably routes events from Azure and non-Azure resources. It distributes the events to registered subscriber endpoints. The event message has the information you need to react to changes in services and applications. Event Grid isn’t a data pipeline, and doesn’t deliver the actual object that was updated.
Event Grid supports dead-lettering for events that aren’t delivered to an endpoint.
It has the following characteristics:
Event Hubs
Azure Event Hubs is a big data pipeline. It facilitates the capture, retention, and replay of telemetry and event stream data. The data can come from many concurrent sources. Event Hubs allows telemetry and event data to be made available to a variety of stream-processing infrastructures and analytics services. It is available either as data streams or bundled event batches. This service provides a single solution that enables rapid data retrieval for real-time processing as well as repeated replay of stored raw data. It can capture the streaming data into a file for processing and analysis.
It has the following characteristics:
Service Bus
Service Bus is intended for traditional enterprise applications. These enterprise applications require transactions, ordering, duplicate detection, and instantaneous consistency. Service Bus enables cloud-native applications to provide reliable state transition management for business processes. When handling high-value messages that cannot be lost or duplicated, use Azure Service Bus. Service Bus also facilitates highly secure communication across hybrid cloud solutions and can connect existing on-premises systems to cloud solutions.
Service Bus is a brokered messaging system. It stores messages in a “broker” (for example, a queue) until the consuming party is ready to receive the messages.
It has the following characteristics:
Notification Hubs
Has an SLA of 99.99% on the Basic and Standard tiers
RPO – Recovery Point Objective – The amount of data loss if a recovery needs to be done
RTO – Recovery Time Objective – The amount of time it takes to complete a recovery or restore
Azure Backup
Recover Points
Azure Backup is good for retention periods of days, weeks, months and eve years.
Virtual Machines SLA’s
One VM = 99.9% availability
Two or more VM’s in an Availability Zone = 99.99% availability
Two or more VM’s in an Availability Set = 99.95% availability
Availability Zones
Within 1 Region you may have 2 availability zones
So this can mean 2 Availability Zones each having 2 data centres.
Deploy 2 copies of your vm, 1 to a datacentre in zone1, the other vm to the other availability zone
Availability Sets
If you add 6 vm’s to an availability set then the 6th vm would go into update domain 0 as the numbering starts at 0.
Azure Load Balancer (works at layer 4)
Important Notes:-
Application Gateway (works at layer 7)
WAF (web application firewall)
Azure Traffic Manager
The Premium tier of SQL Database runs the database in a 4-node Always On Availability Group Cluster. This has one primary database node with 3 secondary processes keeping copies of the data.
Proud to say that I now have the following exams passed: –
The following is a list of the best practices I have found in 18 months of learning and using Azure (not including the community blogs of course), I know best practice isn’t a great term but here are the links anyway, enjoy!
p.s. I’ll keep updating this so check back in a month or 2 🙂
