Tag IaaS

• Infrastructure as a Service (IaaS)
• Platform as a Service (PaaS)
• Software as a Service (SaaS)
• On-Premise
• Infrastructure as Code (IaC)

Examples I’ve used

What are the differences?

Infrastructure as Code

So what is IaC, Infrastructure as Code? Standardise Infrastructure, Automate deployment and recreate, well-documented code. Exampled formats such as JSON & ARM templates.

DevOps teams will use IaC to recreate production like environments in dev cycles. Validate and Test deployments, prior to a production deployment. The end result being able to deliver a stable and repeatable environment.

Azure Resource Manager

The alternative to just running scripts. Manage your infrastructure resources in a group by templates. In addition, you apply security (RBAC) and tags, then associate costs to the group.

Azure VMs

VMs types and sizes
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sizes

Only supported virtual machine type in Azure is “VHD”. VHDX is not currently supported.

Note : Managed disks are now preferred to use instead of storage accounts in legacy Classic Azure

Before migrating VMs to Azure, identify the workloads are supported in a virtual machine. 3rd party vendors may only support their software as PaaS instead of IaaS

VM availability.

2x VMs are better than 1x. I.E your solution is much better if its scalable. Try to utilise VMs in an “availability set”. Servers suitable for availability sets are identical machines file wise. This would give you high availability in the event of failure.

Alternatively, if you only want 1x a virtual machine (example domain controller or DNS), go for solid state (disks with an “s” in the name) and Microsoft have a better SLA for up time.

Managed Disks or Unmanaged Disks
Managed disks go with the VMs,
Try the Market Place for machine images

Scale sets
Scale sets provide VM auto scaling

• Create rules for scaling
• DSC config
• Pure compute box with data at the backend
  i.e Stateless work loads
  Suggestion, for stateless servers, the backend database wont be SQL, it would be the Azure flat file or Azure Cosmos or some read/cache option.

Disk encryption and Azure Key Vault..thoughts
Requirement? Keys are stored in Azure key vault (secure area, no access).
But the drives aren’t physical, so to steal a physical disk would be very challenging to locate.

To steal an virtual drive and mount, its the administrator mistake? Lost or weak admin password?

Networking
Define the DNS server IP
Defining Peerings for vNETS. This allows routes between vNETS

Public IPs will fall in to a network security group for a default firewall. Its purely a basic firewall.

Use Market place to find a 3rd party firewall to lock down internet facing servers (fastest option)
Alternatively route via on prem firewall (slowest option) or route via another cloud firewall (second fastest)

Network Security Group
Inbound and Outbound security groups

By default network security groups have a public IP address and an RDP allow connection.

Network security groups can be assigned to a network card, a subnet or the subnet a load balancer sits within.

Cost : Networks and Network Security Groups are Free

Create your own route tables. Then you have options to assign routes to a subnet or a virtual machine.

Additionally configure the Windows Firewall settings on a virtual machine.

(My thoughts and opinions, are my own @stephenhackers)

Azure – What are the options?

IaaS, PaaS & SaaS

IaaS – Virtual Servers in the Cloud.
Easiest/ Logical method of moving to the cloud is IaaS. Drag your on prem Virtual Machines in the cloud. Basically transferring your on prem virtual machines in to the Cloud (Azure).
In event of failure on prem option, to run in azure, or migrate to azure
Active Directory – Azure AD connect. In a Hybrid environment

PaaS – Azure App Service
Storage, back and recovery services
More advanced – AI – Audio to Text PaaS

SaaS
Complete Software solution

What is the exam?
Exam : 70-533 Implementing Microsoft Azure Infrastructure Solutions.
Expect 1-4 questions are PowerShell based

In theory, you will need another exam to qualify for the certification MCSE Cloud

Why move to Azure?
DR solutions
Hybrid options
Cost saving option – Turning off services over night will massively save money IaaS.
Auto scaling
Pay As You Go : Azure for your dev environment
SaaS

Location knowledge
Note : Geographic areas and some cost more to host and some have limited features.

West Europe would appear to be the best option for local businesses in Sunderland (UK).

But – Check features are available in a region.
https://azure.microsoft.com/en-gb/regions/services/

Pricing Calculator / Estimator
https://azure.microsoft.com/en-gb/pricing/calculator/

Documentation
Location to learn information https://docs.microsoft.com/en-us/azure/

DevOPS : How to deploy to Azure . https://docs.microsoft.com/en-gb/vsts/deploy-azure/

Market Place : Search for products available on Azure

Azure Services / Categories
Compute, Networking, Data and Storage, Web & Mobile, Other services include AD, automation, logging, monitoring

Azure Portals
https://Portal.azure.com
Or old world
https://account.azure.com

Deployment methodologies
Visual studio or visual studio code (free option)
Resource templates. Json files

Log Analytics and ( Operations Management Suite )
Centralised location for gathering log information
Patch management view
Change management view
Resource monitoring

Thought : Could this be described as a new version of System Center, SCOM, WSUS, but a cloud version?

GitHub 
Github.com/MicrosoftLearning

https://github.com/MicrosoftLearning/20533-ImplementingMicrosoftAzureInfrastructureSolutions/tree/master/Instructions

Resource Groups and RBAC
Setup Resource Groups & Tags
Setup Access Control (IAM) Roles (RBAC)

Basic PowerShell Commands
Add-azureRMaccount
Get-AzureRMsubscription
Get-AzureRMresourceProvider

Networking and Providers
Location Providers – UK is London

From <https://docs.microsoft.com/en-us/azure/expressroute/expressroute-locations-providers>

Azure Virtual Networks
Choose the IP address spaces. Don’t use a subnet where you might duplicate your on prem servers.
Azure utilises some IPs .. So smallest subnet /29 subnet

Azure Load Balancer – Overview
Internal, Internet, Application Gateway, Traffic manager
SSL offload & WAF

Azure DNS
PaaS DNS is quite limited or Create a VM hosting VMs for internal DNS / Domain Controller.

Template Examples
Github.com/Azure-quickstart-templates
Deploy to azure ( for speed, test it out at your own risk )

(My thoughts and opinions, are my own @stephenhackers)