Chapter 3: Governance and Compliance Flashcards
What is a Subscription?
Billing unit that aggregates all costs of underlying resources
Helps segment billing units into logical ownership
Ex. Marketing vs. Engineering
What does a subscription contain?
Contain resource groups and associated resources
Each resource group must be part of one single subscription
Subscription is a scoping level for deploying ARM templates
What are some types of subscriptions?
Pay as you Go
Free Trial
Enterprise Agreement
What are 3 major types of subscription naming conventions?
Environment - Prod, Dev, Staging
Department/Teams
Region - geographical region of the business
What is a Management Group?
Container to manage subscriptions in a parent/child relationship
What is the Root Management Group?
Top level management group - cannot put another manage group above
How many levels of management groups can you have?
6 levels
Can you deploy an Azure Policy at the Management Group level?
Yes
Can you deploy RBAC at the Management Group level?
Yes
Why is it important to understand where you set scope for RBAC and Policies?
The level of scope will allow those settings to flow down from there - cascade downward
Are users given access to a root management group by default?
No, this would allow users highest scope control
Only the global admin
Can Root Management Groups be moved or deleted?
No
What can the global admin do in the event of getting locked out?
Global Administrators can elevate themselves to User Access Admin of root group
What is an Azure Policy?
Enforce compliance and enable auditing
You determine what is “compliant”
What are some use cases for policies?
Prohibiting services and/or resources to control costs
Enforce allowed locations
What are the components of an Azure policy?
Definition
Assignment
Initiative Definition
What is a policy definition?
Defines the policy - the evaluation criteria for compliance and defines the actions that take place
Audit or deny something outside of compliance
Example: Deny the creation of a resource without a specific tag
What is a policy assignment?
The scope at which we assign our policy. The WHO
What policy scopes are possible?
Management Group
Subscription
Resource Group
Resource
What is a policy initiative definition?
Collection of policies that are tailored to achieving a singular high-level goal together
What are Tags?
Name / Value pairs
Ex. Dept:Marketing, Env:Prod
How many characters can names be? Values? Storage Accounts?
Names = 512
Value = 256
Storage = 128
Are tags inherited down the hierarchy?
No tags stay at the set scope and are not inherited beneath.
What is a resource lock?
Allows you to override permissions to resources
You can lock subscriptions, resource groups, or resources.
What are the types of resource locks?
Read Only
Delete
What is a Read Only Lock?
Allows users to only read a resource
What is a CanNotDelete lock?
Allows you to read, modify, but not delete
When can you not move a resource?
When you have a Read Only lock
You can still move with a Delete lock
What impacts the cost of a resource?
Subscription type (Free, Pay as you go, enterprise agreement, Cloud Solution Provider)
Resource Type (ex. Blob vs. Table storage)
Usage Meters (CPU time, network traffic, disk size, etc.)
Resource Usage (Costs of actually using a resource)
Location (Services available in various geographical locations)
What are some cost best practices?
Select appropriate resource for the use case
Plan costs ahead prior to purchase
Deallocate resources when no longer needed
Understand resource needs
What are the main cost tools in Azure?
Pricing Calculator
Total Cost of Ownership Calculator
Microsoft cost management Tool
What is the Pricing Calculator?
Create quotes of workloads prior to provisioning a resource
What is the TCO calculator?
Scenario planning calculator to calculate how much you could save if you transitioned from on prem to the cloud.
What is Microsoft Cost Management?
Helps analyze cost and set budgets
What are the four major steps of planning a cloud strategy?
Define
Define governance needs of the organization
Plan
Plan which tools will be used to implement governance
Ready
Understand how those tools will be used to implement governance
Adopt
Implement governance for the organization using a cloud strategy
What are the four major services for enforcing governance?
Management Groups
Subscriptions
RBAC
Policies
Tagging
Locks
