Control access, policies, locks, tags and costs — AZ-104 Hoofdstuk 3

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Toegang beheren met Azure RBAC
Abonnementen, beleid, locks, tags en kosten beheren

Give access with Azure RBAC

A role assignment = who (security principal) + what (role) + where (scope). Rights are inherited down the tree.

Built-in role	Can do
Owner	Everything, also give access to others
Contributor	Create and change everything, but not give access
Reader	Only look
User Access Administrator	Only manage access
Virtual Machine Contributor, Storage Blob Data Reader …	One service, often data access

$az role assignment create --assignee sg-web-admins-OBJECT-ID --role "Virtual Machine Contributor" --resource-group rg-web-prod
$az role assignment list --resource-group rg-web-prod -o table
$az role definition list --name "Contributor" --query "[].permissions[0].actions"

Onthoud

Scope from big to small: management group → subscription → resource group → resource. Give the smallest role at the smallest scope that works (least privilege).

3.2

Write a custom role

When no built-in role fits, define one in JSON: allowed Actions, excluded NotActions, data DataActions, and where it can be used (AssignableScopes).

role-vm-operator.json

{
  "Name": "VM Operator",
  "Description": "Start, stop and restart VMs, nothing else",
  "Actions": [
    "Microsoft.Compute/virtualMachines/read",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/powerOff/action",
    "Microsoft.Compute/virtualMachines/restart/action"
  ],
  "NotActions": [],
  "AssignableScopes": ["/subscriptions/SUB_ID"]
}

$az role definition create --role-definition role-vm-operator.json

3.3

Enforce rules with Azure Policy

A policy checks resource settings. An initiative is a group of policies. An assignment applies them to a scope. The effect decides what happens.

Effect	What it does
Deny	Block the create or change
Audit	Allow, but mark as non-compliant
Append / Modify	Add or change properties (for example add a tag)
DeployIfNotExists	Deploy something extra (for example an agent)
AuditIfNotExists	Report when something extra is missing
Disabled	Policy is off

$az policy definition list --query "[?displayName=='Allowed locations'].name" -o tsv
$az policy assignment create --name allowed-locations --scope /subscriptions/SUB_ID --policy e56962a6-4747-49cd-b67b-bf8b01975c4c --params '{"listOfAllowedLocations":{"value":["westeurope","northeurope"]}}'
$az policy state summarize --resource-group rg-web-prod

Op het werk

Existing resources are not changed by a new Modify or DeployIfNotExists policy. Create a remediation task for them.

3.4

Protect resources with locks

A lock stops deletion (CanNotDelete) or every change (ReadOnly), even for Owners — until the lock is removed.

$az lock create --name keep-db --lock-type CanNotDelete --resource-group rg-data-prod
$az lock list --resource-group rg-data-prod -o table
$az lock delete --name keep-db --resource-group rg-data-prod

Let op

ReadOnly can break normal work: on a storage account it blocks listing the keys, on a VM it blocks starting it. Use CanNotDelete for most cases.

3.5

Organise with tags

Tags are name/value pairs (env=prod, owner=it, costcenter=4400) for reports, costs and automation.

$az group update --name rg-web-prod --tags env=prod owner=it
$az tag update --resource-id RESOURCE_ID --operation Merge --tags app=shop
$az resource list --tag env=prod -o table

Onthoud

Tags are not inherited from the resource group. Use the policy "Inherit a tag from the resource group" to copy them.

3.6

Manage subscriptions and management groups

Use management groups to apply one policy or role to many subscriptions at once; move subscriptions between them when the organisation changes.

$az account management-group create --name mg-production
$az account management-group subscription add --name mg-production --subscription sub-prod
$az account management-group list -o table

3.7

Watch and control costs

Cost Management shows where the money goes. Budgets send alerts before you overspend. Advisor suggests savings.

Cost Management → Cost analysis: group by resource group, service or tag.
Budgets → Add: an amount per month, alerts at 50 %, 80 %, 100 %.
Advisor → Cost: unused disks, oversized VMs, reservation advice.

Op het werk

Shut down dev VMs at night (auto-shutdown), delete unattached disks and old snapshots, and use reservations or savings plans for servers that run all the time.

Alle commando's in dit hoofdstuk

az