Chapter 5: Ensuring Platform Governance

In Chapter 2, Principles of Modern Architecture, we discussed the need for an IT strategy that would define many aspects of your cloud platform, particularly around security, and would state different requisites, such as encryption, data residency, sign-on locations, use of Multi-Factor Authentication (MFA), and so on.

Within Azure, you can provide different teams within the business direct access to build solutions. With a relatively open and dynamic system, how can you ensure that the IT strategies and rules you have defined are observed?

Governance and compliance are terms used to describe what users of a system should and should not perform, and Azure provides a range of tools to enforce adherence to these rules.

To support this, we will look at how we can use tagging to define and manage metadata against resources, which in turn can be used in reporting and automated processes to help with governance.

Next, we will look at how Azure...

Technical requirements

This chapter will use the Azure portal (https://portal.azure.com) and Azure PowerShell (https://docs.microsoft.com/en-us/powershell/azure) for examples.

The source code for our sample application can be downloaded from https://github.com/PacktPublishing/Exam-Ref-AZ-304-Microsoft-Azure-Architect-Design-Certification-and-Beyond/tree/master/ch5.

Applying tagging

Every subscription, resource group, and resource within Azure can have metadata assigned in the form of tags. Tags are essentially a set of key/value string pairs that can be applied either via the portal, PowerShell, or Azure Resource Manager (ARM) templates.

There are a few limitations to be aware of. Most resources can use tags, but there are exceptions. See https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-support for details of services that don't.

Tags can only be applied to resource model components, not classic models:

• Tag names are limited to 512 characters, except for storage accounts, which are limited to 256.
• Tag values are limited to 256 characters, except for storage accounts, which are limited to 128.
• A maximum of 50 tags can be used on a resource.
• Tags on a component do not automatically inherit tags from a resource group (but this can be set using a policy).
• Tags cannot contain the following symbols...

Understanding Azure policies

Your IT strategy and governance rules will define ways of working and what should and should not be allowed in your solutions.

An example may be for all resources to be tagged with a cost center so that the associated costs can be billed back to a product owner. Another example could be a requirement to send all diagnostics logs to a centralized management workspace for use by monitoring and security teams.

Whatever the rule, you need some way to either enforce it or report that a component does not implement it – that is, that it is non-compliant. This could be performed manually, and in a traditional on-premise environment, this might be the only option. But when building enterprise-wide systems, manual checks and balances do not scale easily; therefore, an automated method is preferable.

With Azure Policy, we can define and codify the rules of the system in JSON policy definitions. In contrast, authentication and authorization controls such...

Using Azure Blueprints

In the previous two sections, we looked at how to apply rules so that deployed resources meet the compliance rules as defined by the business. However, these constraints are on the resources themselves.

When new subscriptions are created within an Azure tenant, there will often be a set of components that always need to be in place. For example, every new subscription may need a VNet with a pre-defined set of network security group rules, a user-defined route table, a storage account to store encryption certificates, and so on.

One option would be to create a set of ARM templates within which all these items are defined and deploy them through a DevOps pipeline for each new subscription. The problem with this method is that once the components have been deployed, they can be modified. For some services, especially networking and security-related artifacts, this is not what we want.

Azure Blueprints allows us to define and deploy resource groups, resources...

Summary

This chapter has investigated how we can apply and control solutions according to governance rules laid out by the business.

By using tagging, we can add metadata to resources that can be used for reporting and management purposes. Azure policies allow control over all resources to either prevent, modify, or report on non-compliancy.

Finally, through Azure Blueprints, we can ensure core infrastructure, policies, and roles are always applied, and if need be locked down, to subscriptions.

In the next chapter, we look at how we can secure applications through Azure Key Vault, security principles, and managed identities.

Exam scenario

Your customer, Mega Corp, has asked you to ensure all the solutions built within their Azure platform conform to corporate standards. Specifically, they need to ensure the following:

• All virtual machines are domain-joined.
• All virtual machines have the Windows firewall installed and running.
• All resources are tagged to state what environment they belong to (Prod, Dev, Test).
• All subscriptions have a VNet with a default network security group applied that cannot be modified.
• All subscriptions have a storage account deployed to them that cannot be deleted.

They would like to have very few manual steps involved. What options would you suggest?

Further reading

You can check out the following links for more information about the topics that were covered in this chapter:

• Azure tags: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources
• Virtual machine guest configuration: https://docs.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#guest-configuration
• Azure Blueprints: https://docs.microsoft.com/en-us/azure/governance/blueprints/overview