Stephane Lapointe: Governance in Azure, keep control of your environments

Stephane Lapointe
Cloud Solutions Specialist - GSoft
Governance in Azure
keep control of your environments
stephane@lapointe.cloud

 Email : stephane@lapointe.cloud
 Twitter : @s_lapointe
 Facebook : stephane.lapointe.azure
 LinkedIn : ca.linkedin.com/in/stephanelapointe
Over 20 years of experience with Microsoft technologies. He is working at
GSoft where he’s a Cloud Solution Specialist.
He is very passionate about everything that touches Microsoft Azure, the
DevOps practice and automation of all sort of things using PowerShell. He is
very dedicated to the Montreal MSDEVMTL community where he is a co-
organizer for the Azure group. He is also an Microsoft Azure MVP & Advisor.

You will:
Learn about management groups
Learn about role based access control (RBAC)
Learn about tags
Learn about policies
Learn about Azure Security Center
Learn about Azure Advisor

Block Dev/Ops from directly accessing the cloud (portal/api/cli) to attain control
Developers
Operations
Cloud Custodian /
Engineers responsible
for Cloud environment

Removing barriers to compliance and enabling velocity
Developers
Built-in controls through
policy instead of workflow
Operations
Cloud Custodian
Team

Teams Built-in Role Custom Role
Storage Administrator Storage Account Contributor
Network Operator Network Contributor + Authorization
Network Engineer Network Contributor
Platform Operator Virtual Machine Contributor + Authorization
Platform Engineer Virtual Machine Contributor
Security Engineer Security Admin + Security Manager

User
Code
ARM–CentralizedControlPlane
AzurePolicy
Resource
Config
Requests
Declarative
Always On:
On Change
On Periodic Cadence
On Demand (coming soon)

AzurePolicy
Resource
Config
Request
User
Code

AzurePolicy
Resource
Config
Request
Cloud
Resource
User
Code

Cloud
Resource
Cloud
Resource
Cloud
Resource
AzurePolicy
User
Code

Conditions
“equals”: “value”
“like”: “value”
“match”: “value”
“contains”: “value”
“in”: [“val1”, “val2”]
“containsKey”: “keyName”
“exists”: “bool”
+ “not*” variants
Accessors
“field”: “fieldname”
“source”: “action”
Fields
name
kind
type
location
fullName
tags
tags.*
aliases

$policy = New-AzureRmPolicyDefinition -Name
costCenterTagPolicyDefinition -Description "Policy to deny
resource creation if no costCenter tag is provided" -Policy '{
"if": {
"not" : {
"field" : "tags",
"containsKey" : "costCenter"
}
},
"then" : {
"effect" : "deny"
}
}'

{
"if": {
"not": {
"field": "name",
"like": "namePrefix*nameSuffix"
}
},
"then": {
"effect": "deny"
}
}

"properties": {
"displayName": "Allowed VM Skus",
"description": "This policy enables you to specify a set of virtual machine SKUs that your
organization can deploy."
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Compute/virtualMachines"
},
{
"not": {
"field":"Microsoft.Compute/virtualMachines/sku.name",
"in": ["Basic_A0","Basic_A1","Basic_A2","Basic_A3","Basic_A4"]
}
}
]
},
"then": {
"effect": "Deny"
}
}

"properties": {
"displayName": "Allowed VM Skus",
"description": "This policy enables you to specify a set of virtual machine SKUs that your
organization can deploy.",
"parameters": {
"listOfAllowedSKUs": {"type": "array"}
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Compute/virtualMachines"
},
{
"not": {
"field":"Microsoft.Compute/virtualMachines/sku.name",
"in": "[parameters('listOfAllowedSKUs’)]"
}
}
]
},
"then": {
"effect": "Deny"
}
}

•
https://docs.microsoft.com/en-
us/azure/security/governance-in-azure
•
us/azure/azure-resource-
manager/management-groups-overview
•
https://docs.microsoft.com/en-us/azure/role-
based-access-control/overview
•
us/azure/azure-policy
•
https://azure.microsoft.com/en-
ca/services/security-center/
•
https://azure.microsoft.com/en-
ca/services/advisor/

Stephane Lapointe
Cloud Solutions Specialist - GSoft
Governance in Azure
keep control of your environments
stephane@lapointe.cloud
Thank you

Stephane Lapointe: Governance in Azure, keep control of your environments

More Related Content

What's hot

Similar to Stephane Lapointe: Governance in Azure, keep control of your environments

More from MSDEVMTL

Recently uploaded

Stephane Lapointe: Governance in Azure, keep control of your environments

Editor's Notes