An Azure Primer for the AWS Solution Architect - DevOps West 2020

An Azure Primer for the AWS Solution Architect
Given by Derek C. Ashmore
DevOps West 2020
June 10, 2020
©2020 Derek C. Ashmore, All Rights Reserved 1

Who am I?
• Professional Geek
since 1987
• Java/J2EE/Java EE
since 1999
• AWS since 2010
• Azure since 2017
• Specialties
• Application
Transformation
• Infrastructure
Automation
• Yes – I still code!

Discussion Resources
• This slide deck
– https://www.slideshare.net/derekashmore/presentations
• Sample code on my Github
– https://github.com/Derek-Ashmore/
• Slide deck has hyper-links!
– Don’t bother writing down URLs

Agenda
General Overview
Basics (Networking
/ Compute /
Security /
Application
Delivery)
Support
(Automation /
Logging /
Monitoring)
Summary / Q&A

Audience LevelSet
• You are an AWS Professional
– Solution Architect, DevOps
– AWS Cli and/or SDK literate
• You need to come up to speed on Azure
• Azure is a paradigm shift
– Term to term mapping will only get you so far
• I follow the money!
– I’m technology agnostic
– I’ve seen more Azure adoption than AWS lately

Basic Terms for Services
AWS Terms Azure Terms
VPC Virtual Network (Vnet)
EC2 Instance Virtual Machine (VM)
CloudWatch Log Analytics
Account Subscription
Lambda Function
API Gateway API Management
S3 Storage Account
Key Vault Secrets Manager
RDS Azure Database
CloudFormation Azure Resource Manager (ARM)

Resource Groups
– Azure Resource Groups are a grouping of Azure assets of any type
• Frequently used to categorize assets per application
– Deleting a Resource Group will delete all assets belonging to it.
– Resource Groups often mapped to an Active Directory group and tied
to console privileges
– Resource groups commonly used for core concerns
• Applications tend to have a specific resource group
• Networking, Security, and other infrastructure concerns tend to have resource
groups

Resource Groups
• Separating Resources
• Management Support
• Common Services
• Logging
• Alerting
• CI/CD Agents
• Applications
• Additional Applications are
expected
• Additional Common
Services can be added

Management Groups and Subscriptions
Organization Management Group
Account Subscription

Management Groups and Subscriptions

Agenda
General Overview
Basics (Networking
/ Compute /
Security /
Application
Delivery)
Support
(Automation /
Logging /
Monitoring)
Summary / Q&A

Networking Terms
VPC Virtual Network (Vnet)
Instance Virtual Machine
Security Group Network Security Group (NSG)
Elastic Network Interface (ENI) Network Interface (Nic)
Route53 Azure DNS
Direct Connect Express Route
Identical Terms
Subnet
Route Table
Flow logs
Region
Peering
Subnet
Availability Zone

Networking Overview
– Azure Virtual Network (Vnets) == AWS VPC
• They can be peered
• No transitive peering
• Have DNS and DHCP configuration options
• Have world-wide regional options
– Azure Vnet Peering includes routing
• Fewer explicit route tables
– Azure Vnets contain subnets
• The distinction between public and private subnets not as relevant in Azure
– There’s nothing to put in them as public load balancers don’t work the same way.
– The Azure Application Gateway / WAF requires a dedicated subnet
• Availability Zones are not attached to subnets.
– Region Service AZ Cross Reference
– Very new concept to Azure

Network Security Groups
– NSGs are Roughly like AWS Instance Security Groups
• Like AWS, NSG rules have a priority and are stateful
– One NSG per VM NIC or subnet
• No multiple assignments like AWS
– NSG rules cannot reference other NSGs!
• In AWS, Security group rules can allow inbound/outbound traffic to specific security
group members.
• This makes AWS Security groups generic
– Azure Application Security Groups (ASG) are intended to fill that gap
• ASGs are a label for a set of IP Addresses that can be used in NSG rules
• ASGs appear to be seldom used in practice

NSG Example

Connection Troubleshooter
– Enter two IP Addresses
and a port
• Troubleshooter will
identify the NSG rule
prohibiting traffic
– Avoids the issue of
hunting flow logs to
figure out why VMs
can’t communicate

NSG Handling Patterns
– Azure NSGs do tend to be more application specific
• Lack of multiple NSG assignments make them less re-usable than AWS
– Tend to rely on Automation to apply common rules to NSGs
• While you can’t as easily re-use NSG rules, you can automate the “copy”
– Trend toward assigning NSGs to subnets rather than VM Nics
• Reduces the number of assignments
• Causes trend to application-specific subnets.
– Azure Professionals often refer to NSGs as “Firewalls”
• Firewall devices more likely not to be used in Azure

Compute Terms
Instance Virtual Machine (VM)
CloudWatch Log Analytics
Instance Type VM Size
EBS Volume Data Disk
Autoscaling VM Scale Sets
User Data Custom Data
Application Load Balancer Application Gateway
VM Extension
Availability Set
Identical Terms
Subnet
Route Table
Flow logs
Region
Load Balancer
Snapshot
Image**
** - AWS Images are different than Azure Images: Same label, but different construct

Virtual Machines
– Azure Virtual Machines == AWS Instances
• Numerous sizes, types, and pricing
• Placed in subnets
• On demand, spot, and reserved pricing options
• Load balancing and autoscaling support
• Robust Marketplace for images
– Azure images are generalized
• Not a backup as in AWS
• Snapshots of underlying disks needed to restore

Virtual Machines (con’t)
– Azure makes VM Backups and Recoveries easy
• Backups are centrally scheduled and managed
• Recoveries are a very simple action
• AWS Backup launched as a direct response
– Installing software on VMs
• In AWS, userdata script is commonly used.
• Azure has several options
– Customdata script if the image implements Cloud-Init
» Script changes will cause re-creation of the VM!
– Implement a VM Extension
» there are Custom Script extensions for Windows and Linux

Virtual Machines (con’t)
– Automation for VMs often include
• NIC creation
• NIC Log Analytics configuration
• VM Extensions for
– Domain joins
– Log Analytics configuration
– Bootstrap custom scripts

Storage Terms
EBS Volume Data Disk
S3 Bucket Blob Storage
EFS File Storage
S3 Object Container
Glacier Archive Blob Storage
SQS** Queue Storage
DynamoDB** Table Storage
Identical Terms
Key
** - AWS considers SQS and DynamoDB separate services while Azure considers them a “storage” construct.

Security
– Azure has IAM policies too
• Azure IAM Policies can affect change!
– Examples from the field
» Install VM Extensions
» Install Log Analytics
• Policies are assigned to
– Organizations
– Subscriptions
– Resource Groups
• Policies are not assigned to roles or users as in AWS
– Azure has Principals too
• Active Directory Constructs
– User and Group
• Azure Service Constructs
– Service Principals, Managed Identities
– Azure has Roles too
• Roles are assigned to principals
• Many Azure-defined roles provided

Security (con’t)
– Azure does VM security differently
• No IAM roles for VMs as with AWS
• VMs can be assigned one Managed Identity
– Managed identities are then assigned IAM privileges
– Managed identities can be assigned to multiple VMs
– Trend toward policies that Audit only
• Policies that install software on VMs have complications
– Software is often O/S specific
» Policies are replete with image name conditions to determine O/S
» Policies frequently miss new images and are not properly applied
– Error messages are often not easy to debug
– Custom scripts (bash or PowerShell) are easier to maintain

PaaS Database Options
Database Type Serverless AWS Database Dialects Azure Database Dialects
Relational No Microsoft SQL Server Microsoft SQL Server
No MySQL MySQL
No PostgreSQL PostgreSQL
No MariaDB MariaDB
No Oracle
Both Aurora**
NoSQL Yes DynamoDB** Table Storage**
Yes Cassandra (Cosmos DB)
Yes MongoDB (Cosmos DB)
Yes Gremlin (Cosmos DB)
** - Cloud-specific database types.

Application Delivery
• Azure CDN
• Publishes static content
using edge locations
• Static content can reside in
storage accounts (like S3
buckets)
• Azure Application Gateway
• Publishes dynamic content
• WAF service available
• Azure Active Directory
• Provides security

Agenda
General Overview
Basics (Networking
/ Compute /
Security /
Application
Delivery)
Support
(Automation /
Logging /
Monitoring)
Summary / Q&A

Automation
– AWS CloudFormation Template == Azure ARM Template
• ARM Templates exclusively Json
• Azure Console exports ARM templates for most constructs
– Common ARM template creation tactic
» Create the object you want a template for using the Console
» On the last step before creation, you’ll be given an opportunity to export an ARM
template for what you’re trying to create
» Genericize that exported ARM template and execute using PowerShell
» Do Not create from scratch manually!
– Terraform works well, but sometimes lags behind on new features
• It’s rare, but sometimes Terraform is required to execute an ARM template for
new features

Automation (con’t)
– Use Managed Identities for your pipeline agents
• Similar to granting AWS IAM instance roles to your pipeline agents
• Service Principals are less secure due to its use of OAUTH and OAUTH
credentials
– The Azure Security Center will want all Resource Groups to have a
delete lock
• Terraform shops will find this inconvenient

Logging and Monitoring
• Azure Log Analytics
• Receives event and metrics
• Can alert on specific
conditions
• Event and metric
generation must be
specifically configured
• AWS Cloudwatch
• Instances configured for
application-level log files
• Most services just require
IAM privileges for logging

High-level Observations
– Azure encourages manual use of the console
• Azure makes "clicky-clicky" easy
– Some tasks can only be done using the console
• Take from the field: Individual disk restore
– New features arrive in the console first
• SDKs get new features later
• DevOps people will learn Powershell and ARM templates
– Sometimes no other way
– AWS implements “Eat your own Dog Food”
• SDK and Cli are first class citizens
– Percentage of features integrated with Active Directory
• Beefing up A/D skills was required for me
• Playing with some features requires A/D setup unlike AWS

Knowledge Acquisition Tactics
– Adopt a mentor
• Somebody experienced in the space at an SA level
• Understand the paradigm shifts before you criticize
– Target concepts you need first
• Like AWS, Azure is too vast to learn soup-to-nuts immediately
– For non-sensical errors in automation
• Attempt the same action using the console
• Often the errors on the console are clearer than what’s reported by the
underlying API

Further Reading
• This slide deck
– https://www.slideshare.net/derekashmore/presentations
• Azure for AWS Professionals
– https://docs.microsoft.com/en-us/azure/architecture/aws-professional/
• AWS to Azure Services Comparison
– https://docs.microsoft.com/en-us/azure/architecture/aws-professional/services

Questions?
• Derek Ashmore:
– Blog: www.derekashmore.com
– LinkedIn: www.linkedin.com/in/derekashmore
• Connect Invites from attendees welcome
– Twitter: https://twitter.com/Derek_Ashmore
– GitHub: https://github.com/Derek-Ashmore
– Book: http://dvtpress.com/

An Azure Primer for the AWS Solution Architect - DevOps West 2020

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to An Azure Primer for the AWS Solution Architect - DevOps West 2020

Similar to An Azure Primer for the AWS Solution Architect - DevOps West 2020 (20)

Recently uploaded

Recently uploaded (20)

An Azure Primer for the AWS Solution Architect - DevOps West 2020