knowledge-base

AZ 300 Microsoft Azure Architect Technologies Notes

Azure Fundamentals

Some comparisons

cloud_0 cloud_12

Accounts and Subscriptions Overview

cloud_1

Quotas Cost Analysis and Tagging Demonstration

Billing Alerts

Policies

You can assign policies, (also with JSON), so that any a suscription for example, can only deploy certain type of virtual machines.

So we want maybe to set such “Allowed virtual Machine SKUs” for services.

Policies can be assigned to multiple subscriptions by using management groups.

Resource Groups and Tagging

Resource groups are an arbitrary grouping of related resources. You can put resources from another region (aside of the one defined in the resource group). But the meta data of the resource group will be stored in the defined region.

Tips for tagging

We can also do IAM and policies on a resource group basis.

You can check all the deploys that happened in a Resource Group.

A resource group has its own view, you can do deployments, policies, iam, cost, automation scripts, metrics, …

A resource group is always assigned to a subscription.

Moving Resources Between Resource groups

You can move resources from one resource group to another.

Metrics from monitoring are stored in a “Diagnostics Storage Account”.

Somre resources cannot be moved, like alerts and (at the moment) managed disks.

Azure Monitoring Overview

cloud_6

You can create metric filters and then pin them to your dashboard.

When creating an alert, you choose the target resource(s), then what condition to trigger it, then the action group which is to notify a team via mail, text, trigger webhooks, runbooks, functions, or many others.

A runbook is basically certain actions you dfine (like scale up) or such. This can be triggered manually or automatically.

Azure by default monitors the host level metrics (from the hypervisor) like CPU usage and such, this is different from the guest level metrics, being the usage of certain services or programs in your OS. For this you need to install an agent on your guest OS which runs on your virtual machine.

You can enable guest level metrics collection in the VM > Monitoring > Diagnostic Settings > Enable guest level monitoring.

ITSM (IT Service Management)

Log Analytics Key Features

Log Analytics is the layer that is used to gather all logs and then other services can query this layer. The log analytics takes care of auto storing, creating tables and everything necessary to persist data.

Data Sources (for logs)

other ones are like Azure Activity Log and Storage account logs.

Search query fundamentals

You are charged for the service “Log Analytics”

Seems that resource groups are often mandatory in many setups.

You pay for Log Anayltics per GB

So you create a Log Analytics workspace, here you pay per GB, you can then attach data sources, like VMs to it.

You can then query in the workspace, somehow you can also query accross multiple workspaces.

Log analytics stores in a region its data.

Again IAM is applicable to such a workspace.

With the query language, you start with a source, then you always do PIPING to the next thing, like:

    Perf 
    | where TimeGenerated > ago(1h) 
    | where CounterName == @"% Processor Time"
    | summarize avg(CounterValue) by Computer, (bin(TimeGenerated, 1m))
    | render timechart

Reminds a bit of F# syntax

From a query you can create an alert rule.

Create and Configure Storage Accounts

Like S3, storage accounts are assigned some public URL, therefore it needs to be universily unique,

    https://<your-storage-account-name>.<type>.core.windows.net/<container>/filename.extension

Types

Storage accounts must have unique names across Azure (like a bucket on AWS).

A storage account can be allowed to a single VPC or to all of your VPCs.

The Secure transfer flag enforces access to be over HTTPS and other equivalents depending the type of access.

You can use Azure Storage Explorer for managing files, uploading, viewing, get urls, and such. You also have azcopy CLI to copy from and to a storage account.

Managing Access: Container permissions

We can have more granular access management

Breakdown

    https://<your-storage-account-name>.<type>.core.windows.net/<container>/filename.extension
    ?sv=2017-7-29  # Storage service version
    &ss=bfqt       # Signed services (Blob, File, queue, Table)
    &srt=sco       # Signed Resource Types (Service, Container, Object)
    &sp=rwdlacup   # Signed Permission (Read, Write, Delete, List, Add, Create, Update, Process) (process is queue messages)
    &se=UTCTIMESTR # Signed Expiry
    &st=UTCTIMESTR # Signed Expiry & Start
    &spr=https     # Signed Protocol
    &sig=...       # Signature hash

You can create a Access Policy that a SAS refers to. Since the SAS refers to an policy, you can change the policy itself dynamically.

Encryption Keys and Key Vault

cloud_7

HSM : Hardware Security Modules

SSE : Service Encryption

Custom Domains

e.g. have http://acloud.guru instead of http://account.blob.core.windows.net *can also points directly a specific container)

It’s all DNS anyway!

2 ways to do this

Azure Import/export Use Cases

cloud_8

Business Continuity Strategies

Virtual Machines

Cloud_9

Cloud_10 Cloud_11

Networking

cloud_12 cloud_12 cloud_12

Managing and Securing Identities

Governance and RBAC Controls

Create and Deploy Apps

App Services Overview

Serverless Computing

Design and Develop Apps that run in Containers

Server Migrations

Azure Migrate

cloud_22

Azure Site Recovery (ASR)

Automation

VM Custom Images

DSC Overview

Cloud_23

Custom Script Extension

PowerShell VM Commands

NewAzureRmResourceGroup -Name <myResourceGroup> -Location <EastUS>

New-AzureRmVM \
    -ResourceGroupName "<...>"
    -Name "<...>"
    -Location "<...>"
    -VirtualNetworkName "<...>"
    -SubnetName "<...>"
    -SecurityGroupName "<...>"
    -PublicIpAddressName "<...>"
    -OpenPorts "<...>"

NewAzureRmVMConfig -VMName <...>

    Start-AzureRmVM
    Stop-AzureRmVM

More… TRY THIS

ARM Templates

{
  "$schema": "...",
  "contentVersion": "1.0.0.0",
  "parameters" : {
    "skuName" : {
      "type" : "string"
    }
  },
  "variables" : {},
  "resources" : [],
  "outputs" : {}
}

ARM Linking Templates

TODO ! Learn some ARM code for templates

Think which part of the Azure automation makes sense to “start P9 on windows server”

Azure Runbooks

Azure Automation DSC

Azure Files

Remember, this is like EFS on AWS. So you can attach such file share to different VMs and any other

Azure File Sync

Use Azure File Sync to centralize your organization’s file shares in Azure Files, while keeping the flexibility, performance, and compatibility of an on-premises file server. Azure File Sync transforms Windows Server into a quick cache of your Azure file share. You can use any protocol that’s available on Windows Server to access your data locally, including SMB, NFS, and FTPS. You can have as many caches as you need across the world.

Self study notes