Cloud as a Story - Vunvulea Radu

Just realized a few days ago that there are so many flavors of SQL inside Microsoft Azure that you need to be careful when you decide which one to use. In this post, I want to present the most important flavors of SQL that you can have inside Azure and to define a demarcation line between them. 1.0 SQL Server inside Azure VMs (IaaS) The classical IaaS approach where customer needs to manage the VMs and the SQL Server instance that is running on top of Azure. The list of tasks that you need to do when you run your SQL instances on top of Azure VMs are the same as you would have the SQL Server instances inside your own data-centers. From license, to backup and restoration procedures, all of this needs to be managed by yourself. 2.0 SQL Database (PaaS) The current offer of Azure related to SQL on the PaaS environment is more complex than you would expect. In this moment there are 3 options available, that cover most of the uses cases that you might have. SQL Database (Singleton)...

In this post we will talk about things that you should know and take into account when you want to use SQL Data Sync from/to Azure SQL. What is SQL Data Sync It’s a synchronization service offered around Azure platform that is allowing us out-of-the-box to synchronize multiple databases that can be inside Azure or on-premises. SQL Data Sync it is one of the services that makes our lives 10x time easier. The coolest thing on this service is that you can make the configurations from Azure Portal. This is useful especially when you want to try the service or make a fast configuration. From UX perspective, the experience is wonderful and when you want to automate the process, you  can use PowerShell. Base Concepts Synchronization Group represents a groups of databases that you want to keep in sync. You’ll have all the time a Master database used to sync between all the other databases. In the Master-Slave topology, the Slaves are called Sync Members and  the master is calle...

In the last post , I talked about how I connected the yard gates to the IoT Home solution that I started to develop. Unfortunately, I was not able yet to connect the Paradox alarm system to the solution. It’s not clear for me how to connect the relay as a keyswitch zone, but I hope next weeks to receive some help and resolve the near future. Why? Because the WiFi connection is not stable, there are times when I lose the connection to the devices. This can be annoying, especially because I do not have yet a tracking mechanism that can provide me information related to the current device state. I decided to enhance my solution with tracking capabilities. Until now I didn’t add any logs to the solution because I wanted to see exactly where and what kind of data I should collect. Easily you can add logs capabilities to the system and end up with a bunch of logs that you don't need it. What? In day to day use I observed that I need the following information: When was the last ...

In this post, we will take a look on how Shared Access Signature (SAS) is generated. We would like to understand: How such a signature is generated What are the inputs that are required for it  What does the signature contains I assume that you have base the knowledge’s related to SAS. If not I would recommend to read the following introduction before - https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1 What does the SAS signature token contains? This signature (token) is just a specific HMAC (keyed-hash message authentication code) generated using SHA256 hashing algorithm. There is no magic behind it. Inside this token all the relevant information related to access permissions, expiration date and many more are ‘hashed’. By ‘hashed’ I understand a hash that is generated from the string that contains in clear text all the information related to SAS together with storage account key. For example, for the below SAS ...

In this post I will describe the basic steps that needs to be done to configure App Service Authentication using Azure Active Directory. Out of the box, App Services allows us to put in front of our system an authentication and authorization layer. For basic flows, us described below, the configuration can be done directly from Azure Portal, without having to write a line of code. Step 1: Enable App Service Authentication This step can be done directly from Azure Portal, from “Authentication / Authorization” tab. After this, once you specify that you want to use “Azure Active Directory Provider”, do not forget to select “Log in with Azure Active Directory” from "Action to take when request is not authenticated". This is required if you want to not allow anonymous users to access your web app. By selecting this option, you will redirect unauthenticated users to the login page. Don’t forget to hit “Save” (smile). Step 2: Create and configure Azure AD Application Th...

Azure Time Series Insights it is a great tool that can be used to monitor in near-real time your systems and get useful insights about what is happening behind a scene. In this post, we will talk about things that we need to consider before jumping to prepare a demo with it. There are behaviors that are normal when we go with Time Series Insights in production, but when we are preparing a demo or we want to push mocks data inside it can be annoying (especially when we do not understand the behavior). Context I had to deliver 2 presentations and 3 demos about Time Series Insights and I learned in the hard way this kind of things, too long nights before the demos. Based on them I made a checklist that I hope to be useful to others also. 1. Ingress of mock events One of the most important thing that we need to keep an eye on is the moment when we want to push mock data inside Time Series Insights. In general, we want in a short period to push data for a few days or weeks. There a...

An impressive way to finish the working week. How? Attending to CloudBrew , a conference dedicated to Azure and cloud platform. Every year it's a pleasure for me to take part of such an event. With only two tracks, it's give you the feeling that you are together with friends and you chat about Azure and beer (smile). I had the opportunity to deliver an one hour session about Azure Time Series Insights and PowerBI. If you want to find more about this subjects, you can check the abstract and slides, below. Title : Near-real time reporting in Azure Abstract : One of the most common requirement on a projects nowadays is real time monitoring and reporting. Easy to say, expensive to implement and complex to maintain. In this session we'll take a look on the Azure Services that enable us to fulfil this requirements with minimal effort and with maximum benefits. We have on our radar services like Azure Time Series Insights, Analysis Services and PowerBI. After this se...

During discussion on different cloud projects I observed that people are using “Lift and Shift” terminology with multiple meanings. This can create confusion between different parties, especially when technical team from each team understand a different thing. What is Lift and Shift? Lift and Shift is a migration strategy that is based on the concept of replication 1 to 1 of the environment that exist on-premises inside cloud (Microsoft Azure). This involves the migration of all computation, storage and other services without replacing them with specific Azure services. What is not Lift and Shift? When you have a File Server system on the current infrastructure. Lift and Shift in this case shall not include replacing it with Azure Files. Involves just taking the File Servers instances from on-premises and putting them inside Azure VMs. Another good example is when you migrate a web farm. If you decide to do just a Lift and Shift, than you should just spin Azure VMs where you ...

In this post, we will talk about web endpoint security. Let us start from a basic requirement and see what we need to fulfil it. The web application hosted inside App Services shall not be public available from internet. Context The requirement is simple and clear, but can give us headaches if the team does not cover it from the beginning. Microsoft Azure is offering two options to fulfil it: IP Restrictions App Service integration with VNET VNET with dedicated App Service Environment IP Restrictions App services is allowing us to specify a list of IPs that can access our web application. The feature is similar with the IP restriction functionality offered by IIS and can be configured inside web.config. The difference between this two is the location where these checked is done. Using IP Restrictions the check is done a layer before the IIS. Additional this, the configuration can be done from Azure Portal or using ARM templates. There is no need to modify the configurati...

There are times when you make mistakes, big mistakes like… …deleting an Azure SQL Database… In this post, we will take a look on what are the steps that needs to be done to recover and restore a deleted database. We are in the context where you have a Standard database, without any special features related to backups. Trigger I just realized that I deleted the wrong database and I do not have any custom backups mechanism configured. What should I do? Time is crucial  Time is one of the most important factors. The backups of deleted databases is stored for a limited time. The time window depends based on the instance type. In this time window, you can restore a deleted database without any kind of problems. The retention policies for backups is 7 days for Basic and 35 days for Standard and Premium. Azure SQL Server created automatically backups to your databases. These backups are used to restore a deleted database. Don’t forget that as for on-premises backups, things can g...

In this post, we will talk about a simple problem inside Microsoft Azure: How I can see what my quotas are for Azure Subscription that I am using? Context When you start to use you Azure Subscription more than for playing you realize after a few weeks that you do not know what your current quotas limits are. Additional to this, it is not easy to count the number of instances for each resource. For example if you use multiple Azure Storage in different Resource Groups, how easily you can count the number of Storage accounts that you are using? To make the problem a little more complex, you should know that a part of these quotas are per Azure Region. For example, you have a default limit of 50 VNETs per Azure Region. It means that it would be pretty hard to calculate the total number of VNETs that you are using on each Azure Region. It is not impossible, but you would need to do some additional things. Usage + Quotas Inside Azure Portal, we have a dedicated tile that provide t...

Let’s take a look on what are the current solution on Azure when we want to migrate our local file storage from on-premises to cloud. Context On the current system, let us imagine that we have Windows File Server that it is used to share filers inside the company. The File Server is fully integrated with our Active Directory server and based on roles we allow/restrict access to different folders/files. What we want to do? We want to migrate to Azure this solution in such a way that we don’t need to manage the File Server machines and also to be able to have control on file sharing permissions using user roles (Active Directory integration). Addition to this, we want to be able to attach as a shared folder or partition the shared content on the client machine. Azure Files An extremely powerful solution provided by Microsoft, which allow us to store our files in Azure and share them with others. The SMB protocol is fully supported, meaning that we can attach the shared on ou...

When writing a PoC you need to keep it as simple as possible and prove that from a technology perspective the project vision is feasible and is the right one. One of the fundamentals rules of a PoC is that it needs to cover things that are not general truth (e.g. You don’t want to prove that ASP.NET MVC can render HTML or expose an REST API). Keeping a PoC as simple as possible can become a problem when you want to use customer data not only mocks data. When you have customer sensitive information, which should not be visible even to the development team you might end up in a strange situation. The problem is not related on how you can do this. The biggest problem is the effort that you need to invest to create the deployment scripts or the automation mechanism that would allow the customer to deploy the solution in an isolated environment, where development team would not have access. This effort might require extra development effort that you don’t want to include in a PoC. I...

One of the core services of Microsoft Azure is Azure Storage that is used to store binary content, key-values pair (Azure Tables)  or message queue (Azure Queues). In today's post, we will discover how a small change in Azure Storage capabilities is changing our life and simplify our IT solutions. Current solutions The current maximum capacity of Azure Blob Storage used to be 500TB. Even if this might sounds a lot, there are multiple cases when you had to overcome this limits. If you have a system where devices and users are uploading content to your system, than you can reach easily 2-5TB per day that would force you to use a new Azure Storage account every 3 months. To overcome this limitation, your solution needs to be able to manage Azure Storage accounts automatically. Besides being able to clean and archive content automatically, you will need a system that can create a storage account on the fly and redirect traffic to it. When you use multiple Storage Account, you are f...

The current trends are clear. We should develop software applications using only microservice approach. This sounds goods for new application, where system requirements guides us to go with a microservice approach. But what happens for the other types of systems. We might need to develop a normal web application, with some backend processing behind it. No crazy NFR, no need to scale to 100.000 RPS or similar stuff. Monolithic application As an example let us imagine that, we need to develop a web application that resize our pictures to Instagram size (1x1). There are no special requirements related to availability or scalability and the load on the system is a low. The system is used just by our employees (less than 5.000) for company images that needs to be published on commercial web sites. Of course, we can imagine a state of the art microservice implementation, with different services that scale by themselves. What if we do not need something like this, but is very appealing...

It is not uncommon to configure the firewall and other security and control mechanism like User Defined Routes (UDR) and NGA (Network Security Groups) to restrict access to your Azure Resources. In the moment when we want to do such a thing we need to know the IPs that are used by Azure Infrastructure. Let’s take as example a web application that is hosted inside App Service (using VNETs, Traffic Manager, Azure Storage, Azure SQL and many more). To be able to properly configure the access rules, we need to know what are the IPs used by Azure Storage and Azure SQL in that region, Traffic Manager IPs used for probing and so on. Azure Region IP Range Most of this information can be found in a XML provided by Microsoft ( https://www.microsoft.com/en-us/download/details.aspx?id=41653 ), but I expect that this will not enought. You’ll find inside the document the IP ranges that are used by each Azure Region, but without a tag that specify what IP ranges are used by each Azure Resource i...