Skip to main content

Azure Policy - An excellent tool for resource governance inside Azure

The number of Azure Regions increases every day. Just a few days ago two new locations were announced. All the things that are now happing related to the cloud are not only crazy but also scarry.

Scarry from the government and legal perspective. For example inside an Azure Subscription, a user can create storages in any location around the globe. What happens if you based in the UK, you have customer information that is not allowed to leave the country.
You might say that you would train the team that has the rights to create new resources only in Azure Regions that are based in the UK. This solution is not enough because from government perspective you don't have a mechanism that would enforce this.

To enforce something like this, Microsoft Azure is offering Azure Policies. This service is allowing us to define a specific list of rules and actions that are applying automatically to resources that are created under particular Azure Subscription or Azure Resource Group (or even Management Group).

For the above example, you can use one of the default policies that are already defined inside Azure Policies - "Allowed Location". This policy enables us to restrict the locations where users can create new resources. In this way, we can control the locations where resources are created. The users would be allowed to create new resources only in the UK.

Additional to the location policy, some other predefined policies are beneficial like:

  • "Not allowed resource types" - This policy restrict users to create specific resources (Eg.: users cannot create Azure SQL Databases).
  • "Allowed Resource Type" - Allow users to create only specific resources that are defined in the policy
  • "Enforce tag and its value" & "Apply tag and its default value" - These two policies enable us to enforce users to specify specific tags to resources and set particular values in certain conditions.


Another essential feature of policies is so-called "Effect". It represents the action that takes place when a specific policy applies to a resource. There are five effects that you can use:

  1. Deny - Fails the request and generate an audit log
  2. Audit - Accept the request and create an audit log
  3. Append - Add additional fields to the request (Eg. add additional tags)
  4. AuditIfNotExist - When the resource does not exist, enable auditing
  5. DeployIfNotExist - When the resource does not exist, create that specific resource (Eg. each Web App shall have an Application Insight created).


You can read more about Azure Policies on the official documentation (https://docs.microsoft.com/en-us/azure/azure-policy/). But before starting to use them keep in mind the following recommendations:

  • Apply policies at the highest level possible. This policy can be assigned at the next level without any issues.
  • You should reuse policies as much as possible. Features like parameters allow us to reuse policies definition as much as possible. 
  • Don't restrict access from second 1. Try to do a small audit and only after that to define policies that deny specific actions. 
  • For exising environments, start with Audit and only after that Deny specific actions. 

Comments

Popular posts from this blog

How to check in AngularJS if a service was register or not

There are cases when you need to check in a service or a controller was register in AngularJS.
For example a valid use case is when you have the same implementation running on multiple application. In this case, you may want to intercept the HTTP provider and add a custom step there. This step don’t needs to run on all the application, only in the one where the service exist and register.
A solution for this case would be to have a flag in the configuration that specify this. In the core you would have an IF that would check the value of this flag.
Another solution is to check if a specific service was register in AngularJS or not. If the service was register that you would execute your own logic.
To check if a service was register or not in AngularJS container you need to call the ‘has’ method of ‘inhector’. It will return TRUE if the service was register.
if ($injector.has('httpInterceptorService')) { $httpProvider.interceptors.push('httpInterceptorService&#…

ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded

Today blog post will be started with the following error when running DB tests on the CI machine:
threw exception: System.InvalidOperationException: The Entity Framework provider type 'System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer' registered in the application config file for the ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded. Make sure that the assembly-qualified name is used and that the assembly is available to the running application. See http://go.microsoft.com/fwlink/?LinkId=260882 for more information. at System.Data.Entity.Infrastructure.DependencyResolution.ProviderServicesFactory.GetInstance(String providerTypeName, String providerInvariantName) This error happened only on the Continuous Integration machine. On the devs machines, everything has fine. The classic problem – on my machine it’s working. The CI has the following configuration:

TeamCity.NET 4.51EF 6.0.2VS2013
It seems that there …

Fundamental Books of a Software Engineer (version 2018)

More then six years ago I wrote a blog post about fundamental books that any software engineer (developer) should read. Now it is an excellent time to update this list with new entries.

There are 5 different categories of books, that represent the recommended path. For example, you start with Coding books, after that, you read books about Programming, Design and so on.
There are some books about C++ that I recommend not because you shall know C++, only because the concepts that you can learn from it.

Coding

Writing solid codeCode completeProgramming Pearls, more programming pearls(recommended)[NEW] Introduction to Algorithms

Programming

Refactoring (M. Fowler)Pragmatic ProgrammerClean code[NEW] Software Engineering: A Practitioner's Approach[NEW] The Mythical Man-Month[NEW] The Art of Computer Programming

Design

Applying UML and Patterns (GRASP patterns)C++ coding standards (Sutter, Alexandrescu)The C++ programming language (Stroustrup, Part IV)Object-oriented programming (Peter Coad)P…