Few tips on Azure

- 18 minutes read - 3622 words
Azure Tech tips Cloud

This article has few points on Azure which I jotted down, during my preparation for Azure architect exam

Azure Basics

You can create an account using an email ID that Microsoft recognises - this could be either one of Microsoft Free accounts (hotmail, live, outlook) or an organisation account that has an Enterprise agreement with Microsoft

When you sign-up, Azure also creates a directory which will either be the organisation domain (e.g., adobe.com) or if it is a personal account, it will your email ID (without the @ symbol and .com).onmicrosoft.com (sajioutlook.onmicrosoft.com)

One account can have multiple subscriptions.

Azure Portal

Access portal by accessing (https://portal.azure.com) You can either go to new Home Page or access one of the dashboards, which can be customised to see the most relevant information.

Managing resources with Resource groups and Tags

Resource group: a logical container. It can contain resources in multiple regions Location of the resource group refers to where the metadata of the resource group is stored

Use Tags (key=value pair) to help with billing etc

Securing resources

Policies can be assigned to Subscriptions or resource groups to enforce certain guidelines (e.g.., every resource created should have tag assigned or resources of a certain type - specific VMs - are only created)

Policies can be found under Subscriptions > Policies

To check Definitions details of different policies, check under Subscriptions > Settings, Policies > Definitions

For further granular permissions use RBAC (Role based Access Control)

  • Assign specific permissions to users by assigning roles to users
  • Permissions available for pre-defined roles can be viewed by going to Subscriptions > Access Control (IAM) > Roles > Select a specific role > Permissions

Governing Azure resources

Azure has the right framework to govern access to resources which can be controlled through RBAC and policies.

Some of the best practice guidelines…

  1. For enterprise, use org IDs and not personal IDs

  2. Use Resource groups to segregate access to applications

  3. Assign policies / access to groups instead of individual IDs. Only for Contributor roles, add users, else assign to Groups

  4. Make Cost Control a priority - implement policies to ensure tags are created

  5. Assign Roles / Policies to Resource groups and not at the individual resource level

  6. Resource will inherit permissions / policies from Resource groups which will inherit from Subscriptions

  7. Enable MFA through Azure AD conditional access policies

  8. Pick the right role for the job, starting with least privilege

  9. Regularly monitor access policies. Use Azure audit to audit activity log

  10. Use Resource lock policies to prevent accidental deletions

  11. Policies, unlike RBAC, are default Allow, explicit Deny

Scripting Groups and tags

az group list - to list all resource groups

az group list -o table - to list in tabular format

az group list |jq -r ‘.[].name’ - using jq to read required information

To apply resource tags,

az resource tag –tags test=maruthi -n mgsvdidiag -g mgs-vdi –resource-type “Microsoft.Storage/storageAccounts”

To list details of only 1 storage account using jq

az storage account list |jq ‘map(select(.name==“mgsvdidiag”))’

To display only tags from the above command,

az storage account list |jq ‘map(select(.name==“mgsvdidiag”).tags)’

OR

az storage account list |jq ‘map(select(.name==“mgsvdidiag”)) | .[].tags’

To build a json array, give key value pairs enclosed in curly braces and multiple elements of the array enclosed in square brackets and then separated using commas

echo ‘[{“name”: “Sajith”, “age”: 15}, {“name”: “John”, “age”: 18}]’ |jq ‘.[].name’

To list all policies

az policy definition list –output table

To show details of a specific policy,

az policy definition show -n 0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56

To create a new policy

az policy definition create –name “cool-tier” –description “to let only cool tier for blob” –rules ‘{ }’

Azure storage

Deciding when to use Azure Blobs, Files, Disks

Blobs, Files, queues, tables will be managed using Storage account.

Data Lake storage is outside of the above and so is Azure recovery service vault, which is used for replication, backups etc

Creating storage account

Name should be unique across Azure

Storage account types

  1. storagev2- general purposev2 - supports all types of storage - blob, files, queues, tables and also supports access tiers - hot, cool (archive is defined at blob level)- for blob storage

  2. storage - general purposev1 - all types of storage above but no access tiers. This is the default

  3. blob storage - only for blobs

Azure unmanaged disks will be stored as page bobs in storage account.

Managed disks are separate resources managed by Azure direct

Azure Storage Explorer - to explore multiple storage accounts across multiple subscriptions

To create Blob container, File shares within the storage account,

az storage container create -for blob containers

az storage share create - for file shares

For managed disks,

az disk create

For unmanaged-disks,

az vm unmanaged-disk attach –new

Managed disks size vary from 32GiB to 32TiB and with type Standard HDD, Standard SSD, Premium SSD Standard HDD offers 2000 IOPS only for disks of size 16 or 32TiB. Up to 4TiB size, standard HDD and SSD offers 60MB/sec or 500 IOPS

To list all storage accounts,

az storage account list

To list storage account keys for a specific storage account,

az storage account keys list -g mgs-vdi -n mgsvdidiag

Storage tiers and managed disks

Performance Premium tier is only for Azure VM disks and once a storage account is created as Premium tier it can’t be changed.

Standard Storage account has a limit of 20,000 IOPS, Premium Storage account 100,000 IOPS?

For Standard disks / storage - only pay for what is used, but for Premium - need to pay for allocated storage

In the VM type, S indicates support for Premium disks - DS2, DS1

Accessing Storage artifacts and Policies

### Shared Access Signature URL with a unique string to access the specific storage service - blob, files, queues, tables

from CLI, it is az storage account generate-sas

SAS can have permissions to specific services (mentioned above) and then to specific resource types (Service / Container / object)

Create a storage account and then generate Shared Access Signature.

az account set -s “subscription name”

az group create -n resource-group-name -l uksouth

az storage account create -n storageaccount -g resource-group-name –kind StorageV2 –sku Standard_LRS –access-tier Hot

Create a blob container (this will work even without setting the above variable)

az storage container create -n myblobcontainer –account-name storageaccount

Created a SAS token from the portal with access to Blob service and all service types. Once the SAS token is created, it needs to be copied.. it is not tracked by Azure and not possible to list

export AZURE_STORAGE_SAS_TOKEN=“019-06-22T18:39:36Z&spr=https&sig=9oVTLeqE7sdwV0%2Fkw%3D”

Downloaded Azcopy to upload files to this container.

azcopy login with my account did not work as specific access must be given before using Azcopy or use SAS token

Note: As an owner of your Azure Storage account, you aren’t automatically assigned permissions to access data. Before you can do anything meaningful with AzCopy, you need to decide how you’ll provide authorization credentials to the storage service.

Using the SAS token, I was able to copy files even without logging in

azcopy cp ./test.sh “https://storageaccount.blob.core.windows.net/myblobcontainer/019-06-22T18:39:36Z&spr=https&sig=9oVTLeqE7sdwV0%2Fkw%3D"

To login using azcopy,

azcopy login –tenant-id=

Note: It is now possible to make a storage account accessible only from specified VNETs

Note: It is also possible to host static web pages in Azure storage using the Web endpoint

https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-static-website-how-to https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-static-website

export AZURE_STORAGE_KEY=$(az storage account keys list -g resourcegroup -n storageaccount | jq ‘.[0].value’)

az storage blob service-properties update –account-name storageaccount –index-document index.html –404-document error.html –static-website true –account-key=$AZURE_STORAGE_KEY

I Was then able to copy the required files using azcopy and using SAS connection string

Storage account name: mystorageaccount

azcopy copy ./error.html “https://mystorageaccount.blob.core.windows.net/$web/?sv=FW%2FK4ydUpsAYNeOop9rJ0uds%3D”

Azure networking

Virtual network (VNET), Subnet, Vnet peering

vnet1: 10.0.0.0/16 - myvnet1 subnet1: 10.0.0.0/24 - mysubnet1 subnet2: 10.0.1.0/24 - mysubnet2 Gateway subnet 10.0.255.224/27 - GatewaySubnet (name must be this) vnet2: 10.1.0.0/16 - myvnet2 subnet3: 10.1.0.0/24 (mysubnet3)

Resource group: mygroup Location: uksouth

az group create -n mygroup -l uksouth
az network vnet create -g mygroup -n myvnet1 --address-prefix 10.0.0.0/16 \
--subnet-name mysubnet1 --subnet-prefix 10.0.0.0/24 
az network vnet subnet create -g mygroup --vnet-name myvnet1 -n mysubnet2 --address-prefix 10.0.1.0/24

Refer the URL below for the Gateway subnet IP address prefix https://blogs.technet.microsoft.com/solutions_advisory_board/2016/12/01/calculating-the-gateway-subnet-address-space-for-azure-virtual-networks/

A virtual network (VNet) in Azure infrastructure services that is connected to other networks must have a gateway subnet, which contains the systems that exchange packets with other networks. Here is an example of a multi-tier application hosted in an Azure virtual network that contains a gateway subnet.



The best practices for defining this subnet are the following:

For the prefix length of the gateway subnet, although it can have a maximum prefix length of 29 (for example, 10.119.255.248/29), the current recommendation from Azure Patterns and Practices is that you use a prefix length of 27.
**When defining the address space of the gateway subnet, use the very last part of the virtual network address space.
For the second recommendation**, you can determine the address space by setting the bits used for the gateway subnet to 0 and the remaining variable bits in the VNet address space to 1. Here is an example with a VNet address space of 192.168.160.0/19 and a 28-bit gateway subnet:

The VNet address space of 192.168.160.0/19 with the last two octets expressed in binary is: 192.168.10100000.00000000
The gateway subnet prefix length is /28 (using the last 4 bits): 192.168.- - - - - - - -.- - - -0000
The VNet address space with reserved bits for the gateway subnet: 192.168.101VVVVV.VVVVGGGG
You now set the V bits to 1 and the G bits to 0: 192.168.10111111.11110000
To get the gateway subnet address space, convert to last two octets to decimal and include the gateway subnet prefix length: 192.168.191.240/28

Based on the above guidelines, the Gateway subnet for the Vnet having address space of 10.0.0.0/16 will be 
10.0.255.224/27

Create the Gateway subnet 10.0.255.224/27

az network vnet subnet create –vnet-name myvnet1 -n GatewaySubnet –address-prefix 10.0.255.224/27 -g mygroup

Get the Public IP address

az network public-ip create -n mypublicip -g mygroup –allocation-method dynamic –dns-name my-vpn-gateway

az network public-ip show -n mypublicip -g mygroup (It won’t show the IP address until it is allocated to the VPN gateway created below)

Create VPN Gateway

az network vnet-gateway create -n mygateway -l uksouth –public-ip-address mypublicip -g mygroup –vnet myvnet1 –gateway-type Vpn –sku VpnGw1 –vpn-type RouteBased –no-wait

https://docs.microsoft.com/en-us/azure/vpn-gateway/create-routebased-vpn-gateway-cli

Second Vnet created

az network vnet create -n myvnet2 -g mygroup –address-prefix 10.1.0.0/16 –subnet-name mysubnet3 –subnet-prefix 10.1.0.0/24

Vnet peering (Vnet peer name : myvnetpeer1 and myvnetpeer2) - it must be created from both ends To create Vnet, we need the ID of the remote Vnet

az network vnet show -n myvnet2 -g mygroup |jq ‘.id’ “/subscriptions/c9cede00-da2a-40b3-afbb-c65edd40fa5b/resourceGroups/mygroup/providers/Microsoft.Network/virtualNetworks/myvnet2”

az network vnet show -n myvnet1 -g mygroup |jq ‘.id’ “/subscriptions/c9cede00-da2a-40b3-afbb-c65edd40fa5b/resourceGroups/mygroup/providers/Microsoft.Network/virtualNetworks/myvnet1”

az network vnet peering create -n myvnetpeer1 -g mygroup –vnet-name myvnet1 –remote-vnet-id “/subscriptions/c9cede00-da2a-40b3-afbb-c65edd40fa5b/resourceGroups/mygroup/providers/Microsoft.Network/virtualNetworks/myvnet2” –allow-vnet-access

az network vnet peering create -n myvnetpeer2 -g mygroup –vnet-name myvnet2 –remote-vnet-id “/subscriptions/c9cede00-da2a-40b3-afbb-c65edd40fa5b/resourceGroups/mygroup/providers/Microsoft.Network/virtualNetworks/myvnet1” –allow-vnet-access –allow-gateway-transit

To Clean-up all resources,

az group delete -n mygroup

Controlling and balancing user traffic

Azure traffic manager

To load balance traffic across regions based on performance, weightage, priority. can balance http/https/tcp traffic both inside and outside Azure Only public end points are available for Traffic manager

Route table

Specific route table entries could be associated with subnets to redirect traffic via proxy etc

Azure load balancer

To create load balancers,

az network lb

Works on Layer-4, configure front end IP, backend pool, health probes
can also do NATing
Both internal and public end points available

#### Azure application gateway

Layer-7 load balancing Also has firewall capability - Web Application Firewall

NIC and IP addresses

NIC is a separate resource in Azure. It needs to be attached to a VM. IP address can be Dynamic or Static

Public IP address is a separate resource. for dynamic public IPs, it will be allocated when it is associated with a VM, Load balancer

Here is a good article on IP address, CIDR, subnetting (ttp://www.enterprisenetworkingplanet.com/netsp/article.php/10953_3561551_2/Networking-101-Understanding-IP-Addresses.htm)

Network Security Group

They are like firewalls to restrict trafiic in and out of Vnet/subnet NSG can be assigned to Subnet or NIC Only one NSG for a subnet or NIC.. multiple NSGs cannot be associated with 1 subnet but 1 NSG can be used for multiple subnets Lower the number of NSG rule, higher the priority. ServiceTags like Internet, VirtualNetwork, AzureLoadBalancer can be used in NSG rules

Domain name services (DNS) in Azure

Using DNS Zones, we can create DNS zone, and DNS records for the specified zone. Azure will provide 4 DNS servers that can handle queries for this zone. Cannot register a new domain using Azure

Azure load balancer config

3 configurations

1. create load balancer with front end ip name, (private or public ip), backend pool

2. health probe

3. create lb rule, nat rules

then Associate with NIC using backend poolname, NAT rule

you can then configure lb rule, NAT rule

az network lb create –frontend-ip-name WebFrontend –public-ip webIP

az network lb probe create name, port, interval

az network lb rule

and then when the NIC is created, associate with the lb through the backendpool id, NAT ID

Azure compute

Create an Azure Linux env https://docs.microsoft.com/en-us/azure/virtual-machines/linux/create-cli-complete

Different VM types available. v1, v2, v3 are advanced versions of the same type/config

For Disks, 500 IOPS is max for HDD (S4..S50) and Standard SSD drives (E4.. E50) up to the 4TiB size. Premium SSD drives support up to 7500 IOPS for 4TiB (P4.. P50)

There are newer disk SKUs in preview (x60-8TiB , x70-16TiB, x80-32TiB) which offers higher IOPS (S80= 2000 IOPS, E80 = 6,000, P80=20,000) (https://azure.microsoft.com/en-us/blog/larger-more-powerful-managed-disks-for-azure-virtual-machines/)

For boot disk - supports up to 2 TiB For data disks - managed disks up to 32TiB,

Max page blob size is 8TiB, max page blob when attached to a VM is 4TiB

For unmanaged disks, sizes less than 128GiB are not supported by default unless the blob tier is explicitly set

VM images and snapshots

A new VM image can be created from a VM snahpshot or by uploading a disk image file to storage account. VM image is available within the region and subcription

Snapshot can be created from a disk direct.. OS disks can be attached to a different VM, once the original VM is deleted, but only as a data disk

Scale sets and Availability sets

Provide fault tolerance against failure and Azure maintenance

Fault domains = 2 (may vary according to region) Update domains = upto 20

VM cannot be allocated to an availability set after creation. VM will have to be recreated AVailability set configuration cannot be changed after creation

VM Scale set is an advanced configuration than availability set.. It is managed by Azure VMs will be created as part of creating Scale Set

Brian’s GitHub repo: (https://github.com/brharr/azure-packt)

Practice Scenario

Create 2 Linux VMs in an Availability set with Load balancer, NAT rules etc Also each VM to have 2 data disks. After creation of VMs and testing, create a snapshot

Part 1: Set the subscription, location and create resource group, storage account

Set the right subscription where the resources to be created

    az account list |jq '.[].name'
    az account set -s "my subscription"

    az group create -g mgsgrpaz302 -l uksouth

    az storage account create -n mgssataz302 -g mgsgrpaz302 --access-tier Hot --kind StorageV2 --sku Standard_LRS

Part 2: Create Vnet, Network Security group and then the subnet

    az network vnet create -n mgsvntaz302 -g mgsgrpaz302 --address-prefix 10.0.0.0/16

    az network nsg create -n mgsnsgaz302 -g mgsgrpaz302
    az network nsg rule list --nsg-name mgsnsgaz302 -g mgsgrpaz302 -o table

Lower the number, higher the priority. Internet and VirtualNetwork are Service Tags

    az network nsg rule create -n mgsnsgaz302-http8080 --nsg-name mgsnsgaz302 -g mgsgrpaz302 \
    --priority 1001 --source-address-prefixes Internet \
    --destination-address-prefixes VirtualNetwork --source-port-ranges '*' \
    --destination-port-ranges 8080 --access Allow --protocol Tcp \
    --description "Allow access to port 8080 from Internet"

    az network nsg rule create -n mgsnsgaz302-ssh22 --nsg-name mgsnsgaz302 -g mgsgrpaz302 \
    --priority 1002 --source-address-prefixes Internet \
    --destination-address-prefixes VirtualNetwork --source-port-ranges '*' \
    --destination-port-ranges 22 --access Allow --protocol Tcp \
    --description "Allow access to port 22 from Internet"

Create subnet with association to NSG

    az network vnet subnet create -n mgssntaz302 -g mgsgrpaz302 --vnet-name mgsvntaz302 --address-prefix 10.0.0.0/24 --network-security-group mgsnsgaz302

Part 3: Create Public IP, Load Balancer and the LB rules and NAT rules

3 main steps for Load balancer.. Creation of LB, creation of probe, Creation of rules

    az network public-ip create -n mgsuipaz302 -g mgsgrpaz302 --dns-name mgsaz302 --allocation-method Dynamic

Same load balancer can handle multiple front end IPs and multiple backend VMs. If used for multi-purpose, best to name the backend pool based on those VMs.

    az network lb create -n mgsnlbaz302 -g mgsgrpaz302 --sku Basic --frontend-ip-name mgsnlbaz302-frontend --backend-pool-name mgsnlbaz302-backend --public-ip-address mgsuipaz302

    az network lb probe create -n mgsnlbaz302-probe -g mgsgrpaz302 --lb-name mgsnlbaz302 --protocol tcp --port 22 --interval 900

NAT rules will be associated with specific VMs/NICs

    az network lb inbound-nat-rule create -n mgsnlbaz302-natrule-ssh1 -g mgsgrpaz302 --lb-name mgsnlbaz302 --protocol Tcp --frontend-port 4221 --backend-port 22

    az network lb inbound-nat-rule create -n mgsnlbaz302-natrule-ssh2 -g mgsgrpaz302 --lb-name mgsnlbaz302 --protocol Tcp --frontend-port 4222 --backend-port 22

LB rule connects the specific front end IP with the specific backend pool (if only 1 set, these can be omitted)

    az network lb rule create -n mgsnlbaz302-http8080 -g mgsgrpaz302 --lb-name mgsnlbaz302 --protocol Tcp --frontend-port 8080 --frontend-ip-name mgsnlbaz302-frontend --backend-port 8080 --backend-pool-name mgsnlbaz302-backend --probe-name mgsnlbaz302-probe

Part 4: Create NIC resources for the VMs, associate them with VNet, subnet,LB name, backend pool, specific NAT rule, subnet

    az network nic create -n mgsnicaz302-1-nic -g mgsgrpaz302 --vnet-name mgsvntaz302 --subnet mgssntaz302 --lb-name mgsnlbaz302 --lb-address-pools mgsnlbaz302-backend --lb-inbound-nat-rules mgsnlbaz302-natrule-ssh1

    az network nic create -n mgsnicaz302-2-nic -g mgsgrpaz302 --vnet-name mgsvntaz302 --subnet mgssntaz302 --lb-name mgsnlbaz302 --lb-address-pools mgsnlbaz302-backend --lb-inbound-nat-rules mgsnlbaz302-natrule-ssh2

Part 5: Create the required Azure Managed disks for data volumes

    az disk create -n mgslvmaz302-1-disk1 -g mgsgrpaz302 --size-gb 32 --sku StandardSSD_LRS
    az disk create -n mgslvmaz302-1-disk1 -g mgsgrpaz302 --size-gb 32 --sku StandardSSD_LRS

    az disk create -n mgslvmaz302-2-disk1 -g mgsgrpaz302 --size-gb 32 --sku StandardSSD_LRS
    az disk create -n mgslvmaz302-2-disk2 -g mgsgrpaz302 --size-gb 32 --sku StandardSSD_LRS

Part 6: Create availability set and then VMs

    az vm availability-set create -n mgsastaz302 -g mgsgrpaz302 --platform-fault-domain-count 2 --platform-update-domain-count 2

To create the ssh keys

ssh-keygen -m PEM -f linux-az302

To get the blob end point for the VM diagnostics.

az storage account show -n mgssataz302 -g mgsgrpaz302 https://mgssataz302.blob.core.windows.net/

To get the VM image name

az vm image list -l uksouth –all –publisher Canonical –offer UbuntuServer –sku 16.04-LTS “urn”: “Canonical:UbuntuServer:16.04-LTS:16.04.201812040”, “version”: “16.04.201812040”

Some images require Terms to be accepted, not for Ubuntu

az vm image accept-terms –urn Canonical:UbuntuServer:16.04-LTS:16.04.201812040

Get the VM size details

az vm list-sizes -l uksouth |jq ‘map(select(.name==“Standard_DS2_v2”))’

Create the VMs with the data disks, NIC, availability set, ssh-keys

    az vm create -n mgslvmaz302-1 -g mgsgrpaz302 \
    --boot-diagnostics-storage 'https://mgssataz302.blob.core.windows.net/' \
    --image "Canonical:UbuntuServer:16.04-LTS:16.04.201812040" \
    --attach-data-disks mgslvmaz302-1-disk1 mgslvmaz302-1-disk2 \
    --size Standard_DS2_v2 --admin-username mgs-user --ssh-key-value ./linux-az302.pub \
    --nics mgsnicaz302-1-nic --availability-set mgsastaz302
        
    az vm create -n mgslvmaz302-2 -g mgsgrpaz302 \
    --boot-diagnostics-storage 'https://mgssataz302.blob.core.windows.net/' \
    --image "Canonical:UbuntuServer:16.04-LTS:16.04.201812040" \
    --attach-data-disks mgslvmaz302-2-disk1 mgslvmaz302-2-disk2 \
    --size Standard_DS2_v2 --admin-username mgs-user --ssh-key-value ./linux-az302.pub \
    --nics mgsnicaz302-2-nic --availability-set mgsastaz302

** It did not work initially as NSG has source address as LoadBalancer, changed to Internet ServiceTag to get it working

az network nsg rule update -n mgsnsgaz302-ssh22 –nsg-name mgsnsgaz302 -g mgsgrpaz302 –source-address-prefixes Internet

Create the above using VM Scale sets and check the hostnames

   az group create -n mgsgrpaz303 -l uksouth
    az storage account create -n mgssataz303 -g mgsgrpaz303 --kind StorageV2 --access-tier Hot --sku Standard_LRS

    az network vnet create -n mgsvntaz303 -g mgsgrpaz303 --address-prefix 10.0.0.0/16

    az network nsg create -n mgsnsgaz303 -g mgsgrpaz303
    
    az network nsg rule create -n mgsnsgaz303-ssh22 --nsg-name mgsnsgaz303 -g mgsgrpaz303 --priority 1001 --source-address-prefixes Internet --destination-address-prefixes VirtualNetwork --source-port-ranges '*' --destination-port-ranges 22 --access Allow --protocol Tcp --description "Allow SSH access from Internet"

az network vnet subnet create -n mgssntaz303 -g mgsgrpaz303 --vnet-name mgsvntaz303 --address-prefix 10.0.0.0/24 --network-security-group mgsnsgaz303

For VM Scale Sets, STandard Static Public IP address needed
az network public-ip create -n mgsuipaz303 -g mgsgrpaz303 --sku Standard --allocation-method Static --dns-name mgsaz303


image: Canonical:UbuntuServer:16.04-LTS:16.04.201812070
VM size: Standard_DS2_v2

az vmss create -n mgssstaz303 -g mgsgrpaz303 --image Canonical:UbuntuServer:16.04-LTS:16.04.201812070 --vm-sku Standard_DS2_v2 --zones 1 2 --admin-username mgs-user --ssh-key-value ./linux-az302.pub --public-ip-address mgsuipaz303 --vnet-name mgsvntaz303 --subnet mgssntaz303 

Azure automatically created the VMs, the load balancer, with rules to access port 80 and NAT rules (50002, 50003) mapped to port 22. VM names had suffix of _2, _3.. and hostnames with random numbers

Azure PaaS

App services

  • Web Apps, Functions, Logic Apps, Mobile Apps - all covered in this area

App service plan

  • Windows or Linux

  • Windows - instance based - backed by VMs

  • Linux - container based

Pricing tier

  1. will be charged 24 x 7 as soon as the App service is deployed until it is deleted
  2. Pricing of Function apps is different - based on execution

Pricing Tiers: Free, Shared, Basic, Standard, Premium

  • Basic - SSL support, 3 instances
  • Standard - gives daily backup, staging slots, Traffic manager
  • Premium - gets more of what Standard offers, also gives SSD

One app service plan could be used for multiple apps, if they have similar requirements

Two simple steps

  1. Create the App service plan in a resource group

    az group create

    az appservice plan create

  2. Create the webapp in that app service plan

    az webapp create

then select a deployment method, FTP user or from Visual Studio or another dev env

az webapp deployment user set –user-name

Azure Service principal

It is an identity created to access Azure resources.

az ad sp create-for-rbac --name mgs-sp
az login --service-principal --username appID --password password --tenant tenantID

Azure Key Vault

create a vault using - az keyvault create

Store secrets, certificates, keys in the Vault

To give an app permission to read the vault, create an identity for the app using,

az webapp identity assign –name “keyvaultdotnetcorequickstart” –resource-group “”

and then give permissions using

az keyvault set-policy –name ‘’ –object-id –secret-permissions get list

To create a self-signed certificate in Vault

az keyvault certificate create –vault-name mgs-vault -n cert1 -p “$(az keyvault certificate get-default-policy)”