Flashcards
Azure Architectural Components
Cards in this deck (16)
- 1Organizing structure of resources in Azure 4 Levels; Management groups, Subscriptions, Resource groups & ResourcesAzure Subscriptions
- Can provision resources
- Logical unit of azure services that links to an Azure account
- Identity in Azure Active Directory or in a directory that Azure AD trusts - 2Can have multiple subscriptions with different billing modelsBilling Boundary
- How an azure account is billed for using azure
- multiple subscriptions for different billing requirements
- Separate billing and invoice reports for each subscription can be generated - 3Access Control Boundary - Applies access management policies at subscription level - Good for different organizational structures such as different departments- Can control and manage access to resources that users have specific subscriptions with
- 4Create additional subscriptions to separate; - Environments (testing, security, isolate data) - Organizational Structures- Billing (manage and track costs based on needs. One subscription for production & one for testing)
- Subscription Limits (needs to be considered. Max number of Azure ExpressRoute circuits per subscription is 10) - 5Can set up multiple invoices with same billing account. Create billing profiles.Azure Management Groups
- Organize subscriptions into containers & apply governance conditions
- Subscriptions within a management group automatically inherit conditions applied and must trust the same Azure AD tenant - 6Example; Provide user access to multiple subscriptions. Can create one role based access control (RBAC) assignment on the management groupFacts;
- 10,000 management groups supported in single directory
- Management group tree can support up to 6 levels of depth - 7- Each management group & subscription can support one parent - Each management group can have many children- All subscriptions and management groups are within a single hierarchy in each directory
- 8Azure Resource Groups - VM's, Application Gateway Instances, Azure Cosmos DB Instances - Resources must belong to a group & can be moved between resource groups- Can't be nested
Logical Grouping; Provide organization
Lifecycle; good for nonproduction environments & testing
Authorization; Apply RBAC - 9Azure Resource Manager - Provides layer, enables to create, update & delete resources in Azure account - Features like access control, locks & tags to add security- Authenticates & authorizes the request from any Azure tools, API's or SDK's
- Consistent results & capabilities in the different tools because using the same API - 10- Functionality initially released through API's will be in the portal within 180 days of release - All capabilities are also avaliable through PowerShell, Azure CLI, REST, API's & client SDK'sBenefits
- Manage infrastructure through templates & JSON file
- Monitor resources as a group
- Deploy resources in a consistent state through lifecycle - 11- Define dependencies & deploy in correct order - Access control to all services - Logically organize with tags - View billing costs for group of resources that share same tagAzure Regions
- Geographical area containing one or multiple datacenters, networked together with low - latency network - 12- Specific VM sizes or storage types only available in certain regions - some global Azure services don't require a particular region, Azure AD, Azure traffic manager & Azure DNSGives flexibility to bring applications closer to users. Provides better scalability & redundancy. Also preserve data residency.
- 13Special Azure Regions - US DoD Central, US Gov Virginia, US Gov Iowa - China (21 Vianet maintains data centers) - Good for compliance & legal purposesAzure Availability Zones
- Physically separate datacenters within an Azure region
- Isolation boundary; if one goes down, the other continues working - 14- Connected through high speed, fiber -optic networks - Mainly for VM's, managed disks, load balancers & SQL databasesServices that support;
1. Zonal Services - pin resource to specific zone
2. Zone redundant services - platform replicates automatically - 15Azure Region Pairs Created in case of large disaster that can affect 2 datacenters- always paired with another region in the same geography at least 300 miles away
- can provide reliable resources & data redundancy - 16Advantages - 1 region out of each pair is prioritized to make sure restored as quickly as possible - Updates rolled out one region at a time to minimize downtime- data resides in the same geography as it's pair for tax and law enforcement jurisdiction purposes