Module 10 Flashcards
Good IT Governance involves planning initatives and setting prioritees on strategic level to help manage and prevent issues..
What are some situations where Good IT Governance is required (in Azure)
- Multiple teams in Azure
- Multiple subscriptions in Azure
- Multiple subscriptions in your tenant
- Regulatory requirements must be enforced
- Ensuring standards for all IT resources.
One way to enforce standards is by not allowing teams to directly create azure resources, instead having IT team define and deploy cloud assets. This approach is often used OnPrem.
Why isn’t this a good approach for Azure?
This approach reduces agility and innovation.
Instead Azure provides tools to enforce/validate standards, whilst allowing engineering teams to create there own cloud resources.
As well as enforcing standards what else do you need to monitor resources for?
As well as enforcing standards you need to monitor resources to ensure responsiveness and performing properly.
Azure Provides several built in features to track and analyse your resource utilization and performance.
What does planning consistent cloud infrastructure start with?
Planning consistent cloud infrastructure starts with setting up policy
What does Policy enforce and why does it do this
Policy enforces rules for created resources to ensure infrastructure stays compliant with corporate standards, cost requirements and SLAs with your customers.
Azure Policy is a service to
create/assign/manage policies
Azure Policies enforce different rules and effects over resources so resources stay compliant.
How does Azure Policy meet these needs?
- Azure policy meets this need by evaluating resouces for non compliance with assigned policies.
- E.G. A policy might allow only a certain size VM, after policy implementation new and existing resources are evaluated for compliance. The right type of policy can bring existing resources into compliance.**
If we want to control costs by not allowing users to create VMs with more than 4 cores, how could Azure Policy help us define this
Set up an Azure Policy that will stop anyone creating a VM outside of the list of allowed SKUs (stock keeping units)
If we have a policy that stops anyone creating a VM outside of the list of allowed SKUs (stock keeping units), what will happen if we try to create or adjust a VM that would compromise this?
Updating a VM will cause it to be checked against policy - on audit, non compliant resources have there properties altered or are stopped from being created.
Can Azure Policy be intergrated with Azure DevOps
Yes - Azure Policy can be integrated with Azure DevOps, applying continuous integration and delivery pipelines that affect pre and post deployment of your applications.
How do Azure Policy and RBAC solve different problems
- RBAC focuses on user action at different scopes (i.e. you might be added as contributor for a resource group allowing you to make changes to anything in that resource group).
- Azure Policy focuses on resource properties during deployment and altering existing resources. Azure policy controls properties such as types or location of resources
Is Azure Policy a default allow or default deny
Unlike RBAC, Azure policy is default allow and explicit deny.
What is the process for creating a policy
- Azure policy starts with creating a policy definition, which has policy definition conditions under which it is enforced.
- And an accompanying affect to happen if conditions are met.
- To apply a policy:
- Create a policy definition
- Assign definition to scope of resouces
- View policy evaluation results.
What is an Azure Policy Definition?
A policy definition will express what to evaluate and the actions to take (e.g. ensure all public websites are secured with HTTPs OR prevent perticular storage type being created OR Force a specific version of SQL
What are some common policy definitions
- Allows storage account SKUs - set of condtions/rules to deftermine if storage account being deployed is within SKU sizes = Effect is to deny storage accounts not conforming
- Allowed Resouce Type - Specify resource types organisation can deploy = Effect is to deny all resouces not part of that defined list.
- Allowed Locations - Allows restriction of locations when deploying resources = Effect used to enforce Geographic compliance.
- Allows VM SKUs - Specify set of VM SKUs your organistion can deploy
- Not Allowed Resouce Types - Pevents list of reosuce types being deployed
How is a policy definition represented and where can pre-defined definitions be found?
Policy definition is represented as JSON file, use predefined definition in the portal or create your own N.B. Lots of samples on GITHUB
What methods can you use to apply Azure Policy
Use Azure portal or one of the command line tools such as Azure Powershell.
Where/How can you identify non compliant resources with your Azure Policy
- Use applied policy defintion to Identify resources that are not compliant with policy assigntment through Azure portal
- Results match what you see in resource compliance tab of policy assignment in AZ portal
- Or you can use command line tools to identify non compliant resources in your Resource group.
Once one or more policy definitions defined, you will need assign them, a policy assignment is a policy definition that is assigned to take place within a specific scope.
Where can scopes range from and are Policy assignments inherited?
- Scope could range from full subscription to a resource group.
- Policy assignments are inherited by all child resources however you can exclude a subscope.
E.G. Enforce a policy at subscription level with a few resource groups excluded.
When do parameters defined need to be supplied to an Azure Policy
- When assigning a policy you need to supply any parameters defined.
Requests to create or update resouces through Azure Resource Manage are evaluated by azure policy first.
Policy will create a list of assignments appertaining to resources that evaluate against definition, processing several effects before handling the request to avoid unnecessary processing.
A policy definition will have a single effect to determine what should happen when a rule is matched, what are these and what are there effects
- DENY - Resource create or update failes
- DISABLED - Policy rule is ignored - often used for test
- APPEND - Adds additional parameters/fields to resource (common example is adding tags for a cost center OR specifying allowed Ips for a storage resource.
- AUDIT/AUDITIFNOTEXISTS - Creates warning in activity log- does not stop request
- DEPLOYIFNOTEXISTS - Executes a template deployment when condition is met (E.G. If SQL Encryption is enabled, after creation run template to set it up a certain way)
Azure Policy can allow resource creation to be created even if validation fails, where can you view policy evaluation results?
- You can have a failed validation trigger an event to be viewed in Azure policy portal or through command line tools.
- The easiest approach is the GUI and you can find Azure policy in search field or all services.
- The portal makes it easy to spot non compliant resources and take action.
What methods can you use to remove an Azure Policy
Finally you can delete a policy thru portal or Azure PowerShell. (e.g. “Remove-AZPolicyAssignment -Name ‘policyname’ -Scope ‘policyscope”)
What method can you use to organise multiple Azure polices
Initiatives.
When you have more than a few you will want to organise them - That is where initatives come in
Initiatives work alongside polcices, what is an initative definition
An initative definition is a set or group of policy definitions to help track compliance for a larger goal.
Why might you use an initiative if you only have a single policy
Even if you only have a single policy you should use initiatives if you foresee the number of policies growing over time.
- Like a policy an initiative assignment is an initiative assignment to a specific scope
- This reduces the need to make several initiative definition for each scope.
At what ranges can the scope for an initiative be
- Scope could range from management group to resource group.
- Once defined, initiatives can be assigned as polices can, they apply all the associated policy definitions
Initiatives definitions simplify the processes of managing and assigning policy definitons by grouping policies into a single item.
What sort of policy definitions would make up an initative called “Enable Monitoring in Azure Security Center”
- Monitor unencrypted SQL DB - Monitors unencrypted SQL DBs and Servers
- Monitor OS Vunrabilites - Monitors servers that do not satisfy baseline
- Monitor Missing endpoint protection - Monitors servers without installed endpoint protection
How/Where can you define initatives
Define initiatives in Azure portal or command line tools - In portal use the “Authoring” section
Enterprise Governance Management:
Where does access management occur?
And what does this allow organisations to do
Access management occurs at Azure subscription level
- Allows organisation to configure each division in a specific fashion based on responsibilities and requirements.
- Without help, keeping rules consistent across subscriptions can be challenging.
What are Azure Management groups?
- Azure management groups are containers for managing access, polices and compliance across multiple subscriptions.
- Management groups allow ordering of Azure resources hierarchy into collections, providing a further level of classifications above the level of subscriptions.
What is the behaviour of subscriptions with management groups around inheritance and what does Management groups give you?
- Subscriptions with a management group inherit conditions applied to management group
- Management groups gives you enterprise grade management at a large scale not matter what type of subscriptions you have.
If you create a hierarchy so you can apply a policy that limits VM locations to a certain region for a specific management group, what would the result for all subscriptions in that management group be?
All subscriptions in that management group would inherit that policy and would inherit that policy and it would apply to all VMs within those subscriptions.
Can a security policy be altered by the resource or subscription owner
The security policy cannot be altered by the resource of subscription owner allowing for improved governance.
How can you use management groups to provide users access to multiple subscriptions?
And what are the benefits of this
- By having many subscriptions in one management group you can use one RBAC assignment that will allow access to all subscriptions
- One assignment on the management group can enable users to access everything they need instead of scripting RBAC rules over different subscriptions.
True or False: Resources and subscriptions you apply to each management group automatically inherit the conditions you apply to that management group.
True
You can manage Azure subscriptions more effectively by using Azure policy and RBAC. These apply distinct governance conditions you can apply to each management group.
