[TBD]Useful info related to Azure cloud

Azure Security

1. Azure Security Center

   1. monitoring service that provides visibility of your security posture across all of your services, both on Azure and on-premises.

   2. Automatically apply required security settings to new resources as they come online.

   3. Provide security recommendations that are based on your current configurations, resources, and networks.

   4. Continuously monitor your resources and perform automatic security assessments to identify potential vulnerabilities before those vulnerabilities can be exploited.

   5. Use machine learning to detect and block malware from being installed on your virtual machines (VMs) and other resources. You can also use adaptive application controls to define rules that list allowed applications to ensure that only applications you allow can run.

   6. Detect and analyze potential inbound attacks and investigate threats and any post-breach activity that might have occurred.

   7. Provide just-in-time access control for network ports. Doing so reduces your attack surface by ensuring that the network only allows traffic that you require at the time that you need it to.

2. Azure Sentinel

   1. Collect and act on security data from many different sources

   2. Detect previously undetected threats Minimize false positives by using Microsoft's comprehensive analytics and threat intelligence.

   3. Investigate threats with artificial intelligence Examine suspicious activities at scale, tapping into years of cybersecurity experience from Microsoft.

   4. Respond to incidents rapidly Use built-in orchestration and automation of common tasks.

3. Azure Key Vault

   1. Manage secrets You can use Key Vault to securely store and tightly control access to tokens, passwords, certificates, API keys, and other secrets.

   2. Manage encryption keys You can use Key Vault as a key management solution. Key Vault makes it easier to create and control the encryption keys that are used to encrypt your data.

   3. Manage SSL/TLS certificates Key Vault enables you to provision, manage, and deploy your public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for both your Azure resources and your internal resources.

   4. Store secrets backed by hardware security modules (HSMs) These secrets and keys can be protected either by software or by FIPS 140-2 Level 2 validated HSMs.

4. 
   

Cloud Services

1. Serverless

2. Iaas

   1. Cloud based VM etc

3. Paas

   1. Operating system

   2. SQL DBMS as a setc

4. Saas

   1. Email as service etc

5. Baas - Backup As A Service

6. Daas - Database as a service

7. Idaas - Identity and Access as service

8. ....

Cloud types

1. Private

   1. Single tenant/client

   2. AKA on-premise cloud

   3. Access over private network (Verify it)

2. Public

   1. Multi-tenant/client cloud

3. Hybrid

   1. Mix of public and private

Azure Marketplace

A place where partners, solution providers and independent software vendors can offer customized solutions

Azure solution architect

1. Subject matter expertise in designing cloud and hybrid solutions

   1. networking

   2. compute

   3. storage

   4. security

   5. migration

   6. Business continuity

Tenant handling

Tenant Root group ---> Management groups ----> Subscription groups -----> Resource groups -------> Resource

Example

Tenant Root group ---> (Tailwinds--> Sales, corporate, IT-->Production) ----> Subscription groups -----> Resource groups -------> Resource

Types of Tenants

1. Security

2. Privacy

3. Compliance

4. Transparency

Tips for management group

1. Reduce the number of levels

2. Each level should have unique names

Tips for resource group

1. Group resources which have same life cycle

2. Group by type, app, department etc

3. Apply RBAC and policies to group

4. Use resource lock to avoid individual resource from deletion or change

5. Tag resource

Tips for subscription

1. Consider dedicated shared services subscription. Common services, everyone share

2. Subscription should be different for various environments - Dev, QA, production

Tips for resource policy

1. Apply tags to resource first

2. Create policy to validate the naming convention for management/resource groups

3. Use initiative to combine policies

Azure blueprint -> It consists of

1. ARM(Azure Resource Manager) templates

   1. Provides infrastructure as a code

   2. It is JSON file

2. Resource groups

3. RBAC

4. Policy definitions

Azure Network Security

1. Defense in Depth

   1. Contains seven layers

2. Network Security Group

   1. It allows or deny network traffic to and from resources in an Azure VNet subnet

   2. It runs on priority order

3. Azure Firewall

   1. For example, allow traffic only from the specific FQDN

4. Azure DDoS protection

   1. 
      

Azure cost management

1. Based on

   1. Resource type

   2. Services

   3. Location

2. Cost reduction stretagy

   1. Reserve instance

   2. Bring your own windows License

   3. Spot pricing

3. Cost estimation

   1. Online pricing calculator

   2. Total Cost of Ownership

   3. 
      

Azure SLA

1. Connectivity guarantees

2. 
   

Frameworks

1. WAF (Well Architected Framework)

   1. C- Cost Efficiency

   2. O- Operational Excellence

      1. CICD

      2. Automation

      3. ....

   3. R- Reliability

   4. P- Performance

   5. S- Security

2. CAF (Cloud Architecture Framework)

   1. Define Stretagy

   2. Planning

   3. Ready

Link - Azure Well-Architected Review - Assessments | Microsoft Docs

Microsoft Azure Well-Architected Framework

Migration

1. Lift and shift approach

Database

1. Structured data

   1. SQL

2. Semi Structured data -> It can be stored in blob or no-sql

   1. JSON

   2. YAML

3. Unstructured data -> It can be stored in blob or no-sql

   1. Video

   2. Audio

   3. Image

Use cache, network acceleration, shradding for performance

BLOB -> Binary Large Object

Azure SQL storage

1. SQL virtual machine

2. Single instance

3. Instance pool

4. Single database

5. Elastic Pool

Azure Messaging

1. Azure Queue storage

2. Service bus publish-subscribe topics

   1. Like Azure Queue, but between multiple producers and multiple consumers