Introduction to Azure Resource Manager, Global Azure Bootcamp 2016.04
Download as PPTX, PDF1 like886 views
Azure Resource Manager enables users to deploy, organize, and manage resources through resource groups, which serve as containers for multiple resources across different regions and services. The platform supports template-driven deployments, role-based access control, audit logs, and resource policies to enhance resource management and governance. The presentation also covers tools for deployment using Visual Studio, Azure CLI, and Azure PowerShell, along with best practices for organizing and tagging resources.
Introduction to Azure Resource Manager, Global Azure Bootcamp 2016.04
- 1. INTRODUCTION TO AZURE RESOURCE MANAGER
- 2. Łukasz Kałużny Senior Cloud Architect @ MVP: Microsoft Azure You can find me at: blog.kaluzny.pro @kaluzaaa
- 3. AZURE RESOURCE MANAGER API
- 4. Areas of Focus Deploy Organize Control
- 5. Resource Group container for multiple resources resources exist in one* resource group resource groups can span regions resource groups can span services *and only one RESOURCE GROUP
- 6. Deployment
- 7. Deployment tracks template execution created within a resource group allows nested deployments RESOURCE GROUP
- 8. Deploying with Azure Resource Manager template-driven declarative multi-service multi-region extensible
- 9. @ a glance - template language expressions* base64encode(‘stringtoencode’) concat(‘string’,’to’,’encode’) copyIndex(offset) listKeys(storageAccountResourceId, apiVersion) padLeft(stringToPad,targetLength,paddingCharacter) parameters(‘parameterName’) providers(namespace, resourceType) reference(resourceId,apiVersion) resourceGroup() resourceId(‘namespace/resourceType', ‘resourceName’) subscription() variables(‘variables’)
- 10. Advanced Template Scenarios Resource Extensions VM+DSC/Chef/Puppet/CustomScript/etc. AppService + WebDeploy SQL DB + BACPAC Copies Nested Templates NewOrExisting Patterns
- 11. TOOLS Visual Studio 2015 with Azure SDK https://resources.azure.com/ Azure CLI Azure PowerShell (module)
- 12. DEMO 1 New resource group gabc Deployment demo1.json from portal.azure.com WebApp https://github.com/kaluzaaa/arm-WebAppForArmDemo/blob/master/demo1.json
- 13. DEMO 2 Deployment demo2.json using Azure CLI Deployment app from GitHub Commands azure login azure account set 1a961a9b-cc6a-4523-b095-58cea3bd2731 azure config mode arm azure group deployment create -f "C:Userslukasz.kaluznyDocumentsGitHubarm- WebAppForArmDemodemo2.json" -g gabc -n azure -vv https://github.com/kaluzaaa/arm-WebAppForArmDemo/blob/master/demo2.json
- 14. DEMO 3 Deployment demo5.json using Azure PowerShell Deployment of app.setting, Storage Account, SQL Database & connectionstrings, app.setting Commands Login-AzureRmAccount Select-AzureRmSubscription -SubscriptionId 1a961a9b-cc6a-4523-b095-58cea3bd2731 $tFile = "C:Userslukasz.kaluznyDocumentsGitHubarm-WebAppForArmDemodemo5.json" New-AzureRmResourceGroupDeployment -ResourceGroupName gabc -TemplateFile $tFile -Mode Incremental -Name demo -Verbose https://github.com/kaluzaaa/arm-WebAppForArmDemo/blob/master/demo5.json
- 15. DEMO 4 Export Resource Group as template
- 16. Organize
- 17. Organizing with Azure Resource Manager resource groups linked resources tags
- 18. Resource Group App-centric Resource Groups and Templates SQL DB App Service Virtual Machine My 3 Tier Template
- 19. Resource Group App-centric Resource Groups and Tier-centric Templates SQL DB App Service Virtual Machine My DB Tier Template My Web Tier Template My VM Tier Template
- 20. Resource Group App-centric Resource Groups and Nested Templates SQL DB App Service Virtual Machine My Nested DB Tier Template My Nested Web Tier Template My Nested VM Tier Template
- 21. Resource Group Tier-centric Resource Groups and Templates SQL DB App Service Virtual Machine My DB Tier Template My Web Tier Template My VM Tier Template Resource Group Resource Group
- 22. Resource Tags ▷ Name-value pairs assigned to resources or resource groups ▷ Subscription-wide taxonomy ▷ Each resource can have up to 15 tags
- 23. Tagging Tips ▷ Tag by environment, e.g. dev/test/prod ▷ Tag by role, e.g. web/cache/db ▷ Tag by department, e.g. finance/retail/legal ▷ Tag by responsible party, e.g. Bob
- 24. Control
- 25. Control with Azure Resource Manager role based access control audit logs resource locks Azure Resource Policy
- 26. Role Based Access Control Allows secure access with granular permissions Assignable to users, groups, or service principals Built-in roles make it easy to get started
- 27. Two Key Concepts Role Definitions • describes the set of permissions (e.g. read actions) • can be used in multiple assignments Role Assignments • associate role definitions with an identity (e.g. user/group) at a scope (e.g. resource group) • always inherited – subscription assignments apply to all resources
- 28. Role Based Access Control
- 29. /subscriptions/{id}/resourceGroups/{name}/providers/…/sites/{site} Granular Scopes subscription level – grants permissions to all resources in the sub resource group level – grants permissions to all resources in the group resource level – grants permissions to the specific resource
- 30. Audit Logs journals all write/delete/actions central location common format
- 31. Key Concepts Resource lock Policy which enforces a "lock level" at a particular scope Lock level Type of enforcement; current values include CanNotDelete and ReadOnly Scope: The realm to which the lock level is applied. Expressed as a URI; can be set at the resource group, or resource scope.
- 32. Azure Resource Policy JSON - http://schema.management.azure.com/schemas/2015-10-01-preview/policyDefinition.json { "if" : { <condition> | <logical operator> }, "then" : { "effect" : "deny | audit | append" } } Usage examples: Chargeback: Require departmental tags Geo Compliance: Ensure resource locations Use Approved SKUs Naming Convention Tag requirement
- 33. DEMO $policy = New-AzureRmPolicyDefinition -Name namingPolicy -Policy '{ "if" : { "not" : { "field" : "name", "like" : "test-*" } }, "then" : { "effect" : "deny" } }' $subscription = Get-AzureRmSubscription -SubscriptionId 1a961a9b-cc6a-4523-b095-58cea3bd2731 $resourceGroup = Get-AzureRmResourceGroup -Name gabc $scope = "/subscriptions/" + $subscription.SubscriptionId + "/resourceGroups/" + $resourceGroup.ResourceGroupName New-AzureRmPolicyAssignment -Name serverNaming -PolicyDefinition $policy -Scope $scope
- 34. Thanks! Any questions? You can find me at: @kaluzaaa lukasz.kaluzny@itmagination.pl Presentation template by SlidesCarnival
- 35. GŁÓWNI PARTNERZY KONFERENCJI: PARTNERZY TECHNOLOGICZNI: PARTNERZY KONFERENCJI: PATRONI MEDIALNI: