June 11th 2018 Azure Group Subject: Governance in Azure, keep control of your environments. Speaker: Stephane Lapointe, Azure MVP It's very easy to lose control over what's happening in your Azure environments. In this talk, see solutions for managing security, costs, and governance. We'll talk about tools like tags, RBAC, policies, Azure Security Center & Azure Advisors to implement initiatives that will greatly help your management in Azure.

1. Stephane Lapointe
Cloud Solutions Specialist - GSoft
Governance in Azure
keep control of your environments
stephane@lapointe.cloud

2.  Email : stephane@lapointe.cloud
 Twitter : @s_lapointe
 Facebook : stephane.lapointe.azure
 LinkedIn : ca.linkedin.com/in/stephanelapointe
Over 20 years of experience with Microsoft technologies. He is working at
GSoft where he’s a Cloud Solution Specialist.
He is very passionate about everything that touches Microsoft Azure, the
DevOps practice and automation of all sort of things using PowerShell. He is
very dedicated to the Montreal MSDEVMTL community where he is a co-
organizer for the Azure group. He is also an Microsoft Azure MVP & Advisor.

3. You will:
Learn about management groups
Learn about role based access control (RBAC)
Learn about tags
Learn about policies
Learn about Azure Security Center
Learn about Azure Advisor

6. Block Dev/Ops from directly accessing the cloud (portal/api/cli) to attain control
Developers
Operations
Cloud Custodian /
Engineers responsible
for Cloud environment

7. Removing barriers to compliance and enabling velocity
Developers
Built-in controls through
policy instead of workflow
Operations
Cloud Custodian
Team

14. Teams Built-in Role Custom Role
Storage Administrator Storage Account Contributor
Network Operator Network Contributor + Authorization
Network Engineer Network Contributor
Platform Operator Virtual Machine Contributor + Authorization
Platform Engineer Virtual Machine Contributor
Security Engineer Security Admin + Security Manager

16. x15

17. x15

22. User
Code
ARM–CentralizedControlPlane
AzurePolicy
Resource
Config
Requests
Declarative
Always On:
On Change
On Periodic Cadence
On Demand (coming soon)

23. ARM–CentralizedControlPlane
AzurePolicy
Resource
Config
Request
User
Code

24. ARM–CentralizedControlPlane
AzurePolicy
Resource
Config
Request
Cloud
Resource
User
Code

25. ARM–CentralizedControlPlane
Cloud
Resource
Cloud
Resource
Cloud
Resource
AzurePolicy
User
Code

26. Conditions
“equals”: “value”
“like”: “value”
“match”: “value”
“contains”: “value”
“in”: [“val1”, “val2”]
“containsKey”: “keyName”
“exists”: “bool”
+ “not*” variants
Accessors
“field”: “fieldname”
“source”: “action”
Fields
name
kind
type
location
fullName
tags
tags.*
aliases

27. $policy = New-AzureRmPolicyDefinition -Name
costCenterTagPolicyDefinition -Description "Policy to deny
resource creation if no costCenter tag is provided" -Policy '{
"if": {
"not" : {
"field" : "tags",
"containsKey" : "costCenter"
}
},
"then" : {
"effect" : "deny"
}
}'

28. {
"if": {
"not": {
"field": "name",
"like": "namePrefix*nameSuffix"
}
},
"then": {
"effect": "deny"
}
}

29. "properties": {
"displayName": "Allowed VM Skus",
"description": "This policy enables you to specify a set of virtual machine SKUs that your
organization can deploy."
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Compute/virtualMachines"
},
{
"not": {
"field":"Microsoft.Compute/virtualMachines/sku.name",
"in": ["Basic_A0","Basic_A1","Basic_A2","Basic_A3","Basic_A4"]
}
}
]
},
"then": {
"effect": "Deny"
}
}

30. "properties": {
"displayName": "Allowed VM Skus",
"description": "This policy enables you to specify a set of virtual machine SKUs that your
organization can deploy.",
"parameters": {
"listOfAllowedSKUs": {"type": "array"}
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Compute/virtualMachines"
},
{
"not": {
"field":"Microsoft.Compute/virtualMachines/sku.name",
"in": "[parameters('listOfAllowedSKUs’)]"
}
}
]
},
"then": {
"effect": "Deny"
}
}

35. •
https://docs.microsoft.com/en-
us/azure/security/governance-in-azure
•
https://docs.microsoft.com/en-
us/azure/azure-resource-
manager/management-groups-overview
•
https://docs.microsoft.com/en-us/azure/role-
based-access-control/overview
•
https://docs.microsoft.com/en-
us/azure/azure-policy
•
https://azure.microsoft.com/en-
ca/services/security-center/
•
https://azure.microsoft.com/en-
ca/services/advisor/

36. Stephane Lapointe
Cloud Solutions Specialist - GSoft
Governance in Azure
keep control of your environments
stephane@lapointe.cloud
Thank you