The number of Azure Regions increases every day. Just a few days ago two new locations were announced. All the things that are now happing related to the cloud are not only crazy but also scarry.
Scarry from the government and legal perspective. For example inside an Azure Subscription, a user can create storages in any location around the globe. What happens if you based in the UK, you have customer information that is not allowed to leave the country.
You might say that you would train the team that has the rights to create new resources only in Azure Regions that are based in the UK. This solution is not enough because from government perspective you don't have a mechanism that would enforce this.
To enforce something like this, Microsoft Azure is offering Azure Policies. This service is allowing us to define a specific list of rules and actions that are applying automatically to resources that are created under particular Azure Subscription or Azure Resource Group (or even Management Group).
For the above example, you can use one of the default policies that are already defined inside Azure Policies - "Allowed Location". This policy enables us to restrict the locations where users can create new resources. In this way, we can control the locations where resources are created. The users would be allowed to create new resources only in the UK.
Additional to the location policy, some other predefined policies are beneficial like:
Another essential feature of policies is so-called "Effect". It represents the action that takes place when a specific policy applies to a resource. There are five effects that you can use:
You can read more about Azure Policies on the official documentation (https://docs.microsoft.com/en-us/azure/azure-policy/). But before starting to use them keep in mind the following recommendations:
Scarry from the government and legal perspective. For example inside an Azure Subscription, a user can create storages in any location around the globe. What happens if you based in the UK, you have customer information that is not allowed to leave the country.
You might say that you would train the team that has the rights to create new resources only in Azure Regions that are based in the UK. This solution is not enough because from government perspective you don't have a mechanism that would enforce this.
To enforce something like this, Microsoft Azure is offering Azure Policies. This service is allowing us to define a specific list of rules and actions that are applying automatically to resources that are created under particular Azure Subscription or Azure Resource Group (or even Management Group).
For the above example, you can use one of the default policies that are already defined inside Azure Policies - "Allowed Location". This policy enables us to restrict the locations where users can create new resources. In this way, we can control the locations where resources are created. The users would be allowed to create new resources only in the UK.Additional to the location policy, some other predefined policies are beneficial like:
- "Not allowed resource types" - This policy restrict users to create specific resources (Eg.: users cannot create Azure SQL Databases).
- "Allowed Resource Type" - Allow users to create only specific resources that are defined in the policy
- "Enforce tag and its value" & "Apply tag and its default value" - These two policies enable us to enforce users to specify specific tags to resources and set particular values in certain conditions.
Another essential feature of policies is so-called "Effect". It represents the action that takes place when a specific policy applies to a resource. There are five effects that you can use:
- Deny - Fails the request and generate an audit log
- Audit - Accept the request and create an audit log
- Append - Add additional fields to the request (Eg. add additional tags)
- AuditIfNotExist - When the resource does not exist, enable auditing
- DeployIfNotExist - When the resource does not exist, create that specific resource (Eg. each Web App shall have an Application Insight created).
You can read more about Azure Policies on the official documentation (https://docs.microsoft.com/en-us/azure/azure-policy/). But before starting to use them keep in mind the following recommendations:
- Apply policies at the highest level possible. This policy can be assigned at the next level without any issues.
- You should reuse policies as much as possible. Features like parameters allow us to reuse policies definition as much as possible.
- Don't restrict access from second 1. Try to do a small audit and only after that to define policies that deny specific actions.
- For exising environments, start with Audit and only after that Deny specific actions.
Comments
Post a Comment