Few tips on Azure
- 18 minutes read - 3622 wordsThis article has few points on Azure which I jotted down, during my preparation for Azure architect exam
Azure Basics
You can create an account using an email ID that Microsoft recognises - this could be either one of Microsoft Free accounts (hotmail, live, outlook) or an organisation account that has an Enterprise agreement with Microsoft
When you sign-up, Azure also creates a directory which will either be the organisation domain (e.g., adobe.com) or if it is a personal account, it will your email ID (without the @ symbol and .com).onmicrosoft.com (sajioutlook.onmicrosoft.com)
One account can have multiple subscriptions.
Azure Portal
Access portal by accessing (https://portal.azure.com) You can either go to new Home Page or access one of the dashboards, which can be customised to see the most relevant information.
Managing resources with Resource groups and Tags
Resource group: a logical container. It can contain resources in multiple regions Location of the resource group refers to where the metadata of the resource group is stored
Use Tags (key=value pair) to help with billing etc
Securing resources
Policies can be assigned to Subscriptions or resource groups to enforce certain guidelines (e.g.., every resource created should have tag assigned or resources of a certain type - specific VMs - are only created)
Policies can be found under Subscriptions > Policies
To check Definitions details of different policies, check under Subscriptions > Settings, Policies > Definitions
For further granular permissions use RBAC (Role based Access Control)
- Assign specific permissions to users by assigning roles to users
- Permissions available for pre-defined roles can be viewed by going to Subscriptions > Access Control (IAM) > Roles > Select a specific role > Permissions
Governing Azure resources
Azure has the right framework to govern access to resources which can be controlled through RBAC and policies.
Some of the best practice guidelines…
-
For enterprise, use org IDs and not personal IDs
-
Use Resource groups to segregate access to applications
-
Assign policies / access to groups instead of individual IDs. Only for Contributor roles, add users, else assign to Groups
-
Make Cost Control a priority - implement policies to ensure tags are created
-
Assign Roles / Policies to Resource groups and not at the individual resource level
-
Resource will inherit permissions / policies from Resource groups which will inherit from Subscriptions
-
Enable MFA through Azure AD conditional access policies
-
Pick the right role for the job, starting with least privilege
-
Regularly monitor access policies. Use Azure audit to audit activity log
-
Use Resource lock policies to prevent accidental deletions
-
Policies, unlike RBAC, are default Allow, explicit Deny
Scripting Groups and tags
az group list - to list all resource groups
az group list -o table - to list in tabular format
az group list |jq -r ‘.[].name’ - using jq to read required information
To apply resource tags,
az resource tag –tags test=maruthi -n mgsvdidiag -g mgs-vdi –resource-type “Microsoft.Storage/storageAccounts”
To list details of only 1 storage account using jq
az storage account list |jq ‘map(select(.name==“mgsvdidiag”))’
To display only tags from the above command,
az storage account list |jq ‘map(select(.name==“mgsvdidiag”).tags)’
OR
az storage account list |jq ‘map(select(.name==“mgsvdidiag”)) | .[].tags’
To build a json array, give key value pairs enclosed in curly braces and multiple elements of the array enclosed in square brackets and then separated using commas
echo ‘[{“name”: “Sajith”, “age”: 15}, {“name”: “John”, “age”: 18}]’ |jq ‘.[].name’
To list all policies
az policy definition list –output table
To show details of a specific policy,
az policy definition show -n 0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56
To create a new policy
az policy definition create –name “cool-tier” –description “to let only cool tier for blob” –rules ‘{ }’
Azure storage
Deciding when to use Azure Blobs, Files, Disks
Blobs, Files, queues, tables will be managed using Storage account.
Data Lake storage is outside of the above and so is Azure recovery service vault, which is used for replication, backups etc
Creating storage account
Name should be unique across Azure
Storage account types
-
storagev2- general purposev2 - supports all types of storage - blob, files, queues, tables and also supports access tiers - hot, cool (archive is defined at blob level)- for blob storage
-
storage - general purposev1 - all types of storage above but no access tiers. This is the default
-
blob storage - only for blobs
Azure unmanaged disks will be stored as page bobs in storage account.
Managed disks are separate resources managed by Azure direct
Azure Storage Explorer - to explore multiple storage accounts across multiple subscriptions
To create Blob container, File shares within the storage account,
az storage container create -for blob containers
az storage share create - for file shares
For managed disks,
az disk create
For unmanaged-disks,
az vm unmanaged-disk attach –new
Managed disks size vary from 32GiB to 32TiB and with type Standard HDD, Standard SSD, Premium SSD Standard HDD offers 2000 IOPS only for disks of size 16 or 32TiB. Up to 4TiB size, standard HDD and SSD offers 60MB/sec or 500 IOPS
To list all storage accounts,
az storage account list
To list storage account keys for a specific storage account,
az storage account keys list -g mgs-vdi -n mgsvdidiag
Storage tiers and managed disks
Performance Premium tier is only for Azure VM disks and once a storage account is created as Premium tier it can’t be changed.
Standard Storage account has a limit of 20,000 IOPS, Premium Storage account 100,000 IOPS?
For Standard disks / storage - only pay for what is used, but for Premium - need to pay for allocated storage
In the VM type, S indicates support for Premium disks - DS2, DS1
Accessing Storage artifacts and Policies
### Shared Access Signature URL with a unique string to access the specific storage service - blob, files, queues, tables
from CLI, it is az storage account generate-sas
SAS can have permissions to specific services (mentioned above) and then to specific resource types (Service / Container / object)
Create a storage account and then generate Shared Access Signature.
az account set -s “subscription name”
az group create -n resource-group-name -l uksouth
az storage account create -n storageaccount -g resource-group-name –kind StorageV2 –sku Standard_LRS –access-tier Hot
Create a blob container (this will work even without setting the above variable)
az storage container create -n myblobcontainer –account-name storageaccount
Created a SAS token from the portal with access to Blob service and all service types. Once the SAS token is created, it needs to be copied.. it is not tracked by Azure and not possible to list
export AZURE_STORAGE_SAS_TOKEN=“019-06-22T18:39:36Z&spr=https&sig=9oVTLeqE7sdwV0%2Fkw%3D”
Downloaded Azcopy to upload files to this container.
azcopy login with my account did not work as specific access must be given before using Azcopy or use SAS token
Note: As an owner of your Azure Storage account, you aren’t automatically assigned permissions to access data. Before you can do anything meaningful with AzCopy, you need to decide how you’ll provide authorization credentials to the storage service.
Using the SAS token, I was able to copy files even without logging in
azcopy cp ./test.sh “https://storageaccount.blob.core.windows.net/myblobcontainer/019-06-22T18:39:36Z&spr=https&sig=9oVTLeqE7sdwV0%2Fkw%3D"
To login using azcopy,
azcopy login –tenant-id=
Note: It is now possible to make a storage account accessible only from specified VNETs
Note: It is also possible to host static web pages in Azure storage using the Web endpoint
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-static-website-how-to https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-static-website
export AZURE_STORAGE_KEY=$(az storage account keys list -g resourcegroup -n storageaccount | jq ‘.[0].value’)
az storage blob service-properties update –account-name storageaccount –index-document index.html –404-document error.html –static-website true –account-key=$AZURE_STORAGE_KEY
I Was then able to copy the required files using azcopy and using SAS connection string
Storage account name: mystorageaccount
azcopy copy ./error.html “https://mystorageaccount.blob.core.windows.net/$web/?sv=FW%2FK4ydUpsAYNeOop9rJ0uds%3D”
Azure networking
Virtual network (VNET), Subnet, Vnet peering
vnet1: 10.0.0.0/16 - myvnet1 subnet1: 10.0.0.0/24 - mysubnet1 subnet2: 10.0.1.0/24 - mysubnet2 Gateway subnet 10.0.255.224/27 - GatewaySubnet (name must be this) vnet2: 10.1.0.0/16 - myvnet2 subnet3: 10.1.0.0/24 (mysubnet3)
Resource group: mygroup
Location: uksouth
az group create -n mygroup -l uksouth
az network vnet create -g mygroup -n myvnet1 --address-prefix 10.0.0.0/16 \
--subnet-name mysubnet1 --subnet-prefix 10.0.0.0/24
az network vnet subnet create -g mygroup --vnet-name myvnet1 -n mysubnet2 --address-prefix 10.0.1.0/24
Refer the URL below for the Gateway subnet IP address prefix https://blogs.technet.microsoft.com/solutions_advisory_board/2016/12/01/calculating-the-gateway-subnet-address-space-for-azure-virtual-networks/
A virtual network (VNet) in Azure infrastructure services that is connected to other networks must have a gateway subnet, which contains the systems that exchange packets with other networks. Here is an example of a multi-tier application hosted in an Azure virtual network that contains a gateway subnet.
The best practices for defining this subnet are the following:
For the prefix length of the gateway subnet, although it can have a maximum prefix length of 29 (for example, 10.119.255.248/29), the current recommendation from Azure Patterns and Practices is that you use a prefix length of 27.
**When defining the address space of the gateway subnet, use the very last part of the virtual network address space.
For the second recommendation**, you can determine the address space by setting the bits used for the gateway subnet to 0 and the remaining variable bits in the VNet address space to 1. Here is an example with a VNet address space of 192.168.160.0/19 and a 28-bit gateway subnet:
The VNet address space of 192.168.160.0/19 with the last two octets expressed in binary is: 192.168.10100000.00000000
The gateway subnet prefix length is /28 (using the last 4 bits): 192.168.- - - - - - - -.- - - -0000
The VNet address space with reserved bits for the gateway subnet: 192.168.101VVVVV.VVVVGGGG
You now set the V bits to 1 and the G bits to 0: 192.168.10111111.11110000
To get the gateway subnet address space, convert to last two octets to decimal and include the gateway subnet prefix length: 192.168.191.240/28
Based on the above guidelines, the Gateway subnet for the Vnet having address space of 10.0.0.0/16 will be
10.0.255.224/27
Create the Gateway subnet 10.0.255.224/27
az network vnet subnet create –vnet-name myvnet1 -n GatewaySubnet –address-prefix 10.0.255.224/27 -g mygroup
Get the Public IP address
az network public-ip create -n mypublicip -g mygroup –allocation-method dynamic –dns-name my-vpn-gateway
az network public-ip show -n mypublicip -g mygroup (It won’t show the IP address until it is allocated to the VPN gateway created below)
Create VPN Gateway
az network vnet-gateway create -n mygateway -l uksouth –public-ip-address mypublicip -g mygroup –vnet myvnet1 –gateway-type Vpn –sku VpnGw1 –vpn-type RouteBased –no-wait
https://docs.microsoft.com/en-us/azure/vpn-gateway/create-routebased-vpn-gateway-cli
Second Vnet created
az network vnet create -n myvnet2 -g mygroup –address-prefix 10.1.0.0/16 –subnet-name mysubnet3 –subnet-prefix 10.1.0.0/24
Vnet peering (Vnet peer name : myvnetpeer1 and myvnetpeer2) - it must be created from both ends To create Vnet, we need the ID of the remote Vnet
az network vnet show -n myvnet2 -g mygroup |jq ‘.id’ “/subscriptions/c9cede00-da2a-40b3-afbb-c65edd40fa5b/resourceGroups/mygroup/providers/Microsoft.Network/virtualNetworks/myvnet2”
az network vnet show -n myvnet1 -g mygroup |jq ‘.id’ “/subscriptions/c9cede00-da2a-40b3-afbb-c65edd40fa5b/resourceGroups/mygroup/providers/Microsoft.Network/virtualNetworks/myvnet1”
az network vnet peering create -n myvnetpeer1 -g mygroup –vnet-name myvnet1 –remote-vnet-id “/subscriptions/c9cede00-da2a-40b3-afbb-c65edd40fa5b/resourceGroups/mygroup/providers/Microsoft.Network/virtualNetworks/myvnet2” –allow-vnet-access
az network vnet peering create -n myvnetpeer2 -g mygroup –vnet-name myvnet2 –remote-vnet-id “/subscriptions/c9cede00-da2a-40b3-afbb-c65edd40fa5b/resourceGroups/mygroup/providers/Microsoft.Network/virtualNetworks/myvnet1” –allow-vnet-access –allow-gateway-transit
To Clean-up all resources,
az group delete -n mygroup
Controlling and balancing user traffic
Azure traffic manager
To load balance traffic across regions based on performance, weightage, priority. can balance http/https/tcp traffic both inside and outside Azure Only public end points are available for Traffic manager
Route table
Specific route table entries could be associated with subnets to redirect traffic via proxy etc
Azure load balancer
To create load balancers,
az network lb
Works on Layer-4, configure front end IP, backend pool, health probes
can also do NATing
Both internal and public end points available
#### Azure application gateway
Layer-7 load balancing Also has firewall capability - Web Application Firewall
NIC and IP addresses
NIC is a separate resource in Azure. It needs to be attached to a VM. IP address can be Dynamic or Static
Public IP address is a separate resource. for dynamic public IPs, it will be allocated when it is associated with a VM, Load balancer
Here is a good article on IP address, CIDR, subnetting (ttp://www.enterprisenetworkingplanet.com/netsp/article.php/10953_3561551_2/Networking-101-Understanding-IP-Addresses.htm)
Network Security Group
They are like firewalls to restrict trafiic in and out of Vnet/subnet NSG can be assigned to Subnet or NIC Only one NSG for a subnet or NIC.. multiple NSGs cannot be associated with 1 subnet but 1 NSG can be used for multiple subnets Lower the number of NSG rule, higher the priority. ServiceTags like Internet, VirtualNetwork, AzureLoadBalancer can be used in NSG rules
Domain name services (DNS) in Azure
Using DNS Zones, we can create DNS zone, and DNS records for the specified zone. Azure will provide 4 DNS servers that can handle queries for this zone. Cannot register a new domain using Azure
Azure load balancer config
3 configurations
1. create load balancer with front end ip name, (private or public ip), backend pool
2. health probe
3. create lb rule, nat rules
then Associate with NIC using backend poolname, NAT rule
you can then configure lb rule, NAT rule
az network lb create –frontend-ip-name WebFrontend –public-ip webIP
az network lb probe create name, port, interval
az network lb rule
and then when the NIC is created, associate with the lb through the backendpool id, NAT ID
Azure compute
Create an Azure Linux env https://docs.microsoft.com/en-us/azure/virtual-machines/linux/create-cli-complete
Different VM types available. v1, v2, v3 are advanced versions of the same type/config
For Disks, 500 IOPS is max for HDD (S4..S50) and Standard SSD drives (E4.. E50) up to the 4TiB size. Premium SSD drives support up to 7500 IOPS for 4TiB (P4.. P50)
There are newer disk SKUs in preview (x60-8TiB , x70-16TiB, x80-32TiB) which offers higher IOPS (S80= 2000 IOPS, E80 = 6,000, P80=20,000) (https://azure.microsoft.com/en-us/blog/larger-more-powerful-managed-disks-for-azure-virtual-machines/)
For boot disk - supports up to 2 TiB For data disks - managed disks up to 32TiB,
Max page blob size is 8TiB, max page blob when attached to a VM is 4TiB
For unmanaged disks, sizes less than 128GiB are not supported by default unless the blob tier is explicitly set
VM images and snapshots
A new VM image can be created from a VM snahpshot or by uploading a disk image file to storage account. VM image is available within the region and subcription
Snapshot can be created from a disk direct.. OS disks can be attached to a different VM, once the original VM is deleted, but only as a data disk
Scale sets and Availability sets
Provide fault tolerance against failure and Azure maintenance
Fault domains = 2 (may vary according to region) Update domains = upto 20
VM cannot be allocated to an availability set after creation. VM will have to be recreated AVailability set configuration cannot be changed after creation
VM Scale set is an advanced configuration than availability set.. It is managed by Azure VMs will be created as part of creating Scale Set
Brian’s GitHub repo: (https://github.com/brharr/azure-packt)
Practice Scenario
Create 2 Linux VMs in an Availability set with Load balancer, NAT rules etc Also each VM to have 2 data disks. After creation of VMs and testing, create a snapshot
Part 1: Set the subscription, location and create resource group, storage account
Set the right subscription where the resources to be created
az account list |jq '.[].name'
az account set -s "my subscription"
az group create -g mgsgrpaz302 -l uksouth
az storage account create -n mgssataz302 -g mgsgrpaz302 --access-tier Hot --kind StorageV2 --sku Standard_LRS
Part 2: Create Vnet, Network Security group and then the subnet
az network vnet create -n mgsvntaz302 -g mgsgrpaz302 --address-prefix 10.0.0.0/16
az network nsg create -n mgsnsgaz302 -g mgsgrpaz302
az network nsg rule list --nsg-name mgsnsgaz302 -g mgsgrpaz302 -o table
Lower the number, higher the priority. Internet and VirtualNetwork are Service Tags
az network nsg rule create -n mgsnsgaz302-http8080 --nsg-name mgsnsgaz302 -g mgsgrpaz302 \
--priority 1001 --source-address-prefixes Internet \
--destination-address-prefixes VirtualNetwork --source-port-ranges '*' \
--destination-port-ranges 8080 --access Allow --protocol Tcp \
--description "Allow access to port 8080 from Internet"
az network nsg rule create -n mgsnsgaz302-ssh22 --nsg-name mgsnsgaz302 -g mgsgrpaz302 \
--priority 1002 --source-address-prefixes Internet \
--destination-address-prefixes VirtualNetwork --source-port-ranges '*' \
--destination-port-ranges 22 --access Allow --protocol Tcp \
--description "Allow access to port 22 from Internet"
Create subnet with association to NSG
az network vnet subnet create -n mgssntaz302 -g mgsgrpaz302 --vnet-name mgsvntaz302 --address-prefix 10.0.0.0/24 --network-security-group mgsnsgaz302
Part 3: Create Public IP, Load Balancer and the LB rules and NAT rules
3 main steps for Load balancer.. Creation of LB, creation of probe, Creation of rules
az network public-ip create -n mgsuipaz302 -g mgsgrpaz302 --dns-name mgsaz302 --allocation-method Dynamic
Same load balancer can handle multiple front end IPs and multiple backend VMs. If used for multi-purpose, best to name the backend pool based on those VMs.
az network lb create -n mgsnlbaz302 -g mgsgrpaz302 --sku Basic --frontend-ip-name mgsnlbaz302-frontend --backend-pool-name mgsnlbaz302-backend --public-ip-address mgsuipaz302
az network lb probe create -n mgsnlbaz302-probe -g mgsgrpaz302 --lb-name mgsnlbaz302 --protocol tcp --port 22 --interval 900
NAT rules will be associated with specific VMs/NICs
az network lb inbound-nat-rule create -n mgsnlbaz302-natrule-ssh1 -g mgsgrpaz302 --lb-name mgsnlbaz302 --protocol Tcp --frontend-port 4221 --backend-port 22
az network lb inbound-nat-rule create -n mgsnlbaz302-natrule-ssh2 -g mgsgrpaz302 --lb-name mgsnlbaz302 --protocol Tcp --frontend-port 4222 --backend-port 22
LB rule connects the specific front end IP with the specific backend pool (if only 1 set, these can be omitted)
az network lb rule create -n mgsnlbaz302-http8080 -g mgsgrpaz302 --lb-name mgsnlbaz302 --protocol Tcp --frontend-port 8080 --frontend-ip-name mgsnlbaz302-frontend --backend-port 8080 --backend-pool-name mgsnlbaz302-backend --probe-name mgsnlbaz302-probe
Part 4: Create NIC resources for the VMs, associate them with VNet, subnet,LB name, backend pool, specific NAT rule, subnet
az network nic create -n mgsnicaz302-1-nic -g mgsgrpaz302 --vnet-name mgsvntaz302 --subnet mgssntaz302 --lb-name mgsnlbaz302 --lb-address-pools mgsnlbaz302-backend --lb-inbound-nat-rules mgsnlbaz302-natrule-ssh1
az network nic create -n mgsnicaz302-2-nic -g mgsgrpaz302 --vnet-name mgsvntaz302 --subnet mgssntaz302 --lb-name mgsnlbaz302 --lb-address-pools mgsnlbaz302-backend --lb-inbound-nat-rules mgsnlbaz302-natrule-ssh2
Part 5: Create the required Azure Managed disks for data volumes
az disk create -n mgslvmaz302-1-disk1 -g mgsgrpaz302 --size-gb 32 --sku StandardSSD_LRS
az disk create -n mgslvmaz302-1-disk1 -g mgsgrpaz302 --size-gb 32 --sku StandardSSD_LRS
az disk create -n mgslvmaz302-2-disk1 -g mgsgrpaz302 --size-gb 32 --sku StandardSSD_LRS
az disk create -n mgslvmaz302-2-disk2 -g mgsgrpaz302 --size-gb 32 --sku StandardSSD_LRS
Part 6: Create availability set and then VMs
az vm availability-set create -n mgsastaz302 -g mgsgrpaz302 --platform-fault-domain-count 2 --platform-update-domain-count 2
To create the ssh keys
ssh-keygen -m PEM -f linux-az302
To get the blob end point for the VM diagnostics.
az storage account show -n mgssataz302 -g mgsgrpaz302 https://mgssataz302.blob.core.windows.net/
To get the VM image name
az vm image list -l uksouth –all –publisher Canonical –offer UbuntuServer –sku 16.04-LTS “urn”: “Canonical:UbuntuServer:16.04-LTS:16.04.201812040”, “version”: “16.04.201812040”
Some images require Terms to be accepted, not for Ubuntu
az vm image accept-terms –urn Canonical:UbuntuServer:16.04-LTS:16.04.201812040
Get the VM size details
az vm list-sizes -l uksouth |jq ‘map(select(.name==“Standard_DS2_v2”))’
Create the VMs with the data disks, NIC, availability set, ssh-keys
az vm create -n mgslvmaz302-1 -g mgsgrpaz302 \
--boot-diagnostics-storage 'https://mgssataz302.blob.core.windows.net/' \
--image "Canonical:UbuntuServer:16.04-LTS:16.04.201812040" \
--attach-data-disks mgslvmaz302-1-disk1 mgslvmaz302-1-disk2 \
--size Standard_DS2_v2 --admin-username mgs-user --ssh-key-value ./linux-az302.pub \
--nics mgsnicaz302-1-nic --availability-set mgsastaz302
az vm create -n mgslvmaz302-2 -g mgsgrpaz302 \
--boot-diagnostics-storage 'https://mgssataz302.blob.core.windows.net/' \
--image "Canonical:UbuntuServer:16.04-LTS:16.04.201812040" \
--attach-data-disks mgslvmaz302-2-disk1 mgslvmaz302-2-disk2 \
--size Standard_DS2_v2 --admin-username mgs-user --ssh-key-value ./linux-az302.pub \
--nics mgsnicaz302-2-nic --availability-set mgsastaz302
** It did not work initially as NSG has source address as LoadBalancer, changed to Internet ServiceTag to get it working
az network nsg rule update -n mgsnsgaz302-ssh22 –nsg-name mgsnsgaz302 -g mgsgrpaz302 –source-address-prefixes Internet
Create the above using VM Scale sets and check the hostnames
az group create -n mgsgrpaz303 -l uksouth
az storage account create -n mgssataz303 -g mgsgrpaz303 --kind StorageV2 --access-tier Hot --sku Standard_LRS
az network vnet create -n mgsvntaz303 -g mgsgrpaz303 --address-prefix 10.0.0.0/16
az network nsg create -n mgsnsgaz303 -g mgsgrpaz303
az network nsg rule create -n mgsnsgaz303-ssh22 --nsg-name mgsnsgaz303 -g mgsgrpaz303 --priority 1001 --source-address-prefixes Internet --destination-address-prefixes VirtualNetwork --source-port-ranges '*' --destination-port-ranges 22 --access Allow --protocol Tcp --description "Allow SSH access from Internet"
az network vnet subnet create -n mgssntaz303 -g mgsgrpaz303 --vnet-name mgsvntaz303 --address-prefix 10.0.0.0/24 --network-security-group mgsnsgaz303
For VM Scale Sets, STandard Static Public IP address needed
az network public-ip create -n mgsuipaz303 -g mgsgrpaz303 --sku Standard --allocation-method Static --dns-name mgsaz303
image: Canonical:UbuntuServer:16.04-LTS:16.04.201812070
VM size: Standard_DS2_v2
az vmss create -n mgssstaz303 -g mgsgrpaz303 --image Canonical:UbuntuServer:16.04-LTS:16.04.201812070 --vm-sku Standard_DS2_v2 --zones 1 2 --admin-username mgs-user --ssh-key-value ./linux-az302.pub --public-ip-address mgsuipaz303 --vnet-name mgsvntaz303 --subnet mgssntaz303
Azure automatically created the VMs, the load balancer, with rules to access port 80 and NAT rules (50002, 50003) mapped to port 22. VM names had suffix of _2, _3.. and hostnames with random numbers
Azure PaaS
App services
- Web Apps, Functions, Logic Apps, Mobile Apps - all covered in this area
App service plan
-
Windows or Linux
-
Windows - instance based - backed by VMs
-
Linux - container based
Pricing tier
- will be charged 24 x 7 as soon as the App service is deployed until it is deleted
- Pricing of Function apps is different - based on execution
Pricing Tiers: Free, Shared, Basic, Standard, Premium
- Basic - SSL support, 3 instances
- Standard - gives daily backup, staging slots, Traffic manager
- Premium - gets more of what Standard offers, also gives SSD
One app service plan could be used for multiple apps, if they have similar requirements
Two simple steps
-
Create the App service plan in a resource group
az group create
az appservice plan create
-
Create the webapp in that app service plan
az webapp create
then select a deployment method, FTP user or from Visual Studio or another dev env
az webapp deployment user set –user-name
Azure Service principal
It is an identity created to access Azure resources.
az ad sp create-for-rbac --name mgs-sp
az login --service-principal --username appID --password password --tenant tenantID
Azure Key Vault
create a vault using - az keyvault create
Store secrets, certificates, keys in the Vault
To give an app permission to read the vault, create an identity for the app using,
az webapp identity assign –name “keyvaultdotnetcorequickstart” –resource-group “”
and then give permissions using
az keyvault set-policy –name ‘’ –object-id –secret-permissions get list
To create a self-signed certificate in Vault
az keyvault certificate create –vault-name mgs-vault -n cert1 -p “$(az keyvault certificate get-default-policy)”