arm Archives - Apostolidis Cloud Corner

Deploy VM from Azure SIG in new Resource Group

Pantelis Apostolidis — Thu, 04 Feb 2021 15:03:12 +0000

Deploy VM from Azure SIG in new Resource Group

This is a template that first creates a Resource Group, and then it deploys a Virtual Machine from an image version of the Shared Image Gallery. It provides the Public IP and Hostname for outputs.

Currently it only asks for the SIG image version and an environment value to create the naming convention of the resources.

GitHub: https://github.com/proximagr/ARMTemplates/blob/master/VM-from-SIG-in-new-RG/VM-from-SIG-in-new-RG.json

{
    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "galleryimageversion": {
            "type": "string",
            "defaultValue": "10.0.2"
        },
        "envname": {
            "type": "string",
            "defaultValue": "test"
        }
    },
    "variables": {
        "basename": "[concat(parameters('envname'),substring(deployment().name,0,6))]",
        "rgname": "[concat('rg-', substring(variables('basename'), 0, 10))]",
        "region": "francecentral"
    },
    "resources": [
        {
            "name": "[variables('rgname')]",
            "type": "Microsoft.Resources/resourceGroups",
            "apiVersion": "2019-10-01",
            "location": "[variables('region')]",
            "dependsOn": [
            ],
            "tags": {
            }
        },
        {
            "type": "Microsoft.Resources/deployments",
            "resourceGroup": "[variables('rgname')]",
            "dependsOn": [
                "[resourceId('Microsoft.Resources/resourceGroups',variables('rgname'))]"
            ],
            "apiVersion": "2019-10-01",
            "name": "nestedTemplate1",
            "properties": {
                "expressionEvaluationOptions": {
                    "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                    "galleryImageVersionName": {
                        "value": "[parameters('galleryimageversion')]"
                    },
                    "envname": {
                        "value": "[parameters('envname')]"
                    }

                },
                "template": {
                    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                    "contentVersion": "1.0.0.0",
                    "parameters": {
                        "galleryImageVersionName": {
                            "type": "string"
                        },
                        "envname": {
                            "type": "string"
                        }
                    },
                    "variables": {
                        "basename": "[concat(parameters('envname'),substring(deployment().name,0,6))]",
                        "pubipname": "[concat( 'pip-',variables('basename'))]",
                        "pubipdns": "[concat( 'vm-',variables('basename'))]",
                        "region": "francecentral",
                        "adminUsername": "uiadmin",
                        "adminPassword": "ThisIs1Password!",
                        "galleryName": "demosig",
                        "galleryImageDefinitionName": "demoid",
                        "nicName": "[concat( 'nic-',variables('basename'))]",
                        "addressPrefix": "10.0.0.0/24",
                        "subnetName": "[concat( 'sub-',variables('basename'))]",
                        "subnetPrefix": "10.0.0.0/24",
                        "vmName": "[concat( 'vm-',variables('basename'))]",
                        "virtualNetworkName": "[concat( 'vnet-',variables('basename'))]",
                        "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]",
                        "networkSecurityGroupName": "[concat( 'nsg-',variables('basename'))]"
                    },
                    "resources": [
                        {
                            "name": "[variables('pubipname')]",
                            "type": "Microsoft.Network/publicIPAddresses",
                            "apiVersion": "2019-11-01",
                            "location": "[variables('region')]",
                            "tags": {
                                "displayName": "publicIPAddress1"
                            },
                            "properties": {
                                "publicIPAllocationMethod": "Static",
                                "dnsSettings": {
                                    "domainNameLabel": "[variables('pubipdns')]"
                                }
                            }
                        },
                        {
                            "comments": "Simple Network Security Group for subnet [variables('subnetName')]",
                            "type": "Microsoft.Network/networkSecurityGroups",
                            "apiVersion": "2019-08-01",
                            "name": "[variables('networkSecurityGroupName')]",
                            "location": "[variables('region')]",
                            "properties": {
                                "securityRules": [
                                    {
                                        "name": "default-allow-22",
                                        "properties": {
                                            "priority": 1000,
                                            "access": "Allow",
                                            "direction": "Inbound",
                                            "destinationPortRange": "22",
                                            "protocol": "Tcp",
                                            "sourceAddressPrefix": "*",
                                            "sourcePortRange": "*",
                                            "destinationAddressPrefix": "*"
                                        }
                                    },
                                    {
                                        "name": "default-allow-3389",
                                        "properties": {
                                            "priority": 1001,
                                            "access": "Allow",
                                            "direction": "Inbound",
                                            "destinationPortRange": "3389",
                                            "protocol": "Tcp",
                                            "sourceAddressPrefix": "*",
                                            "sourcePortRange": "*",
                                            "destinationAddressPrefix": "*"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Microsoft.Network/virtualNetworks",
                            "name": "[variables('virtualNetworkName')]",
                            "apiVersion": "2016-03-30",
                            "location": "[variables('region')]",
                            "dependsOn": [
                                "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]"
                            ],
                            "properties": {
                                "addressSpace": {
                                    "addressPrefixes": [
                                        "[variables('addressPrefix')]"
                                    ]
                                },
                                "subnets": [
                                    {
                                        "name": "[variables('subnetName')]",
                                        "properties": {
                                            "addressPrefix": "[variables('subnetPrefix')]",
                                            "networkSecurityGroup": {
                                                "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]"
                                            }
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Microsoft.Network/networkInterfaces",
                            "name": "[variables('nicName')]",
                            "apiVersion": "2016-03-30",
                            "location": "[variables('region')]",
                            "properties": {
                                "ipConfigurations": [
                                    {
                                        "name": "ipconfig1",
                                        "properties": {
                                            "privateIPAllocationMethod": "Dynamic",
                                            "publicIPAddress": {
                                                "id": "[resourceId('Microsoft.Network/publicIPAddresses',variables('pubipname'))]"
                                            },
                                            "subnet": {
                                                "id": "[variables('subnetRef')]"
                                            }
                                        }
                                    }
                                ]
                            },
                            "dependsOn": [
                                "[resourceId('Microsoft.Network/publicIPAddresses/', variables('pubipname'))]",
                                "[resourceId('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]"
                            ]
                        },
                        {
                            "type": "Microsoft.Compute/virtualMachines",
                            "name": "[variables('vmName')]",
                            "apiVersion": "2019-07-01",
                            "location": "[variables('region')]",
                            "properties": {
                                "hardwareProfile": {
                                    "vmSize": "Standard_F8s_v2"
                                },
                                "osProfile": {
                                    "computerName": "[variables('vmName')]",
                                    "adminUsername": "[variables('adminUsername')]",
                                    "adminPassword": "[variables('adminPassword')]"
                                },
                                "storageProfile": {
                                    "imageReference": {
                                        "id": "[resourceId('Microsoft.Compute/galleries/images/versions', variables('galleryName'), variables('galleryImageDefinitionName'), parameters('galleryImageVersionName'))]"
                                    }
                                },
                                "networkProfile": {
                                    "networkInterfaces": [
                                        {
                                            "id": "[resourceId('Microsoft.Network/networkInterfaces',variables('nicName'))]"
                                        }
                                    ]
                                }
                            },
                            "dependsOn": [
                                "[resourceId('Microsoft.Network/networkInterfaces/', variables('nicName'))]"
                            ]
                        }
                    ],
                    "outputs": {
                        "publicipn": {
                            "type": "string",
                            "value": "[reference(variables('pubipname')).dnsSettings.fqdn]"
                        },
                        "publicipa": {
                            "type": "string",
                            "value": "[reference(variables('pubipname')).ipAddress]"
                        }
                    }
                }
            }
        }
    ],
    "outputs": {
        "hostname": {
            "type": "string",
            "value": "[reference('nestedTemplate1').outputs.publicipn.value]"
        },
        "ipaddress": {
            "type": "string",
            "value": "[reference('nestedTemplate1').outputs.publicipa.value]"
        }
    }
}

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Deploy VM from Azure SIG in new Resource Group appeared first on Apostolidis Cloud Corner.

Compliance Report using Azure Policy

Pantelis Apostolidis — Tue, 07 Jan 2020 07:37:01 +0000

Compliance Report using Azure Policy

Azure Policy is a powerful tool for Azure Governance. With Azure Policy we can define rules for all Azure Subscriptions the we manage. We can use this rules for simple limitation actions, like permitting only specific VM Series and Sizes that can be created and also more complex rule sets that helps you standardize the whole Azure deployment. At my previous posts, we learned How to limit the Azure VM Sizes and How to enforce tags for resources creation

At the current post we will learn how to use Azure Policy to have a compliance report for our deployment. We will learn this by using an example. Then we will create two Virtual Networks and we will add a Network Security Group only to the first one. Finally we will use the Policy to audit whether the Subnets have assigned the NSG or Not.

First we need two Virtual Networks. You can create the Virtual Networks using the Azure Portal or using ARM template, like mine from my Github account: https://github.com/proximagr/ARMTemplates/blob/master/2vnets.json

After applying the template you will have two VNETs like that:

Then we will a Network Security Group (NSG) only to the MyVNET01 Virtual Network. Again using Azure Portal, PowerShell or my ARM Template for NSG

Assign the NSG to the MyVNET01 VIrtual Network

Add the Policy

Go to Azure Policy -> Definitions and click the “+ Policy definition” to create a new policy definition.

At the New Policy definition page, select the subscription (location) that the policy will be saved, then add a name. in this case we will use the sample policy template from Microsoft docs so I will add the same name.

Copy the policy Json text from https://docs.microsoft.com/en-us/azure/governance/policy/samples/nsg-on-subnet and paste it at the POLICY RULE below and Save.

At the “effect” part of the Json, change the “deny” to “audit”.

If you search for “NSG” you will see our new policy definition, ready to be assigned.

Click on the definition’s name to open it and press Assign.

I will just target the “ComplianceReport” Resource Group

At the parameters, I added the Resource ID of the NSG, “MyNSG01”

Evaluate the results

To check the compliance, go to Policy – Compliance page and search for nsg. You have to wait for about 15 minutes for the compliance policy to evaluate the resources.

If you search “nsg” you will see that the “Audit NSG on Subnet” policy is 50% compliant. Click on the policy’s name to view more details.

The assignment details page will open where we can see what resources are not compliant.

Click on the three dots (…) next to the non-compliant subnet and select “view compliance details” to check why this resource is not compliant.

The compliance details reports that the value is null and what the required (target) value must be.

If you want to trigger an on-demand compliance check, you need to make a POST request. You can follow my post Validate Azure Resource Move with Postman to create the access Token and then use it to make a POST request to the Resource Group sung this POST:

https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{YourRG}/providers/Microsoft.PolicyInsights/policyStates/latest/triggerEvaluation?api-version=2018-07-01-preview

Source:

https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects
https://docs.microsoft.com/en-us/azure/governance/policy/samples/nsg-on-subnet
https://docs.microsoft.com/en-us/azure/governance/policy/how-to/get-compliance-data#evaluation-triggers

Pantelis Apostolidis

www.cloudcorner.gr

The post Compliance Report using Azure Policy appeared first on Apostolidis Cloud Corner.

Azure Portal | Playing with Disk Snapshot

Pantelis Apostolidis — Mon, 07 Oct 2019 20:34:36 +0000

Azure Portal | Playing with Disk Snapshot

Disk Snapshot is a powerful tool to manage Azure VMs. It’s simple to create and can help the administrators in various tasks. It’s a fast and efficient way to have a crash-consistent Disk of a Virtual Machine, before performing tasks, updates, configuration changes, application installations, etc. Of course the last line of defence is the Azure Backup, but using the Snapshot you don’t need to wait the whole Backup / Restore times. With snapshots there are two main options to recover the VM. One is using the “swap OS Disk” functionality, which gives you the ease to swap the Operating System disk with one click. The other option is to create a new VIrtual Machine. Beware, if you want to make Azure VM clones, you need to generalize the VM with Sysprep and Capture the VM. Using the Snapshot option you will have an identical VM, with the same IDs.

Snapshot

The first step is to create a snapshot from the Virtual Disk. Open the Azure VM, go to Disks, select the OS Disk and press “Create Snapshot”. You don’t actually need to stop the VM. Windows Server operating system stays fully consistent, but no one can guarantee the consistency of any databases currently running. Think of it like the Hyper V CheckPoint functionality. We make checkpoints all the time and we revert to them even in production.

The Create snapshot screen will open. Fill in a name and disk account type (Standard / Premium) and press create.

At this point I will create a folder at the VM for revision

Create a Disk

To make the snapshot functional, we need to create a Managed Disk resource.

At the Create managed disk wizard, select the Region that the Snapshot resides. Then select “Source type” Snapshot and select it. At the Size, select a disk size at least the same as the source disk.

Swap OS Disk

Now that we have created the managed disk, it’s time to use the Swap OS Disk functionality. We have proceeded with the Azure VM’s updates, software updates, configuration changes, and finally we need to roll back those changes. Go to the VM’s Disks and press “Swap OS Disk”

at the “Swap OS Disk” wizard, select the managed disk that we created.

In the background, the Azure Platform will stop, deallocate the VM and it will re-crate it with the selected OS disk. As you see at the next screenshot the OS disk is the managed disk that we created from teh snapshot.

I Started the VM and logged in. The folder I created after the snapshot of course is missing 🙂

New Azure VM

The other option is to create a new Virtual Machine using the Snapshot. As I wrote before, beware, if you want to make Azure VM clones, you need to generalize the VM with Sysprep and Capture the VM. Using the Snapshot option you will have an identical VM, with the same IDs.

To create a VM from the Snapshot, just open the Managed Disk that you created from the Snapshot and press Create VM.

The Create a virtual machine wizard will open, and at the Operating System Image section, it will have selected the image from the disk. This process is identical to creating a new Hyper V VM from an existing virtual disk.

Follow the Create a virtual machine wizard exactly the same as creating any Azure VM.

More e-apostolidis.gr posts about managed disks: https://www.e-apostolidis.gr/tag/managed-disks/

Pantelis Apostolidis

www.cloudcorner.gr

The post Azure Portal | Playing with Disk Snapshot appeared first on Apostolidis Cloud Corner.

Azure Policy | Enforce tags for resource creation

Pantelis Apostolidis — Mon, 02 Sep 2019 14:38:55 +0000

Azure Policy | Enforce tags for resource creation

Azure Governance

After the previous post about how to use Azure Policy to limit the Azure VM sizes, I continue the series of posts about Azure Governance with a video guide on how to enforce tags for resource creation. The idea is to explain through examples and how-to-guides, the tools that Microsoft Azure provides to help the administrators to enforce rules to all subscriptions. Some examples of those rules are, to help the organizations to stay compliant with their corporate standards, to standardize the resources creation and management, to manage the permissions and access controls, etc.

Azure Policy

Azure Policy is a powerful tool for Azure Governance. We can define rules for all Azure Subscriptions the we manage. We can use this rules for simple limitation actions, like permitting only specific VM Series and Sizes that can be created and also more complex rule sets that helps you standardize the whole Azure deployment.

Enforce tags for resource creation

So, why tags? Why we need to add tags to all Azure resources? The Microsoft Azure environments are getting bigger and bigger and managed by multiple people and teams. That makes it difficult to understand who created a resource and what is the purpose of that resource. Another critical matter that we need tags is Cost Management. At the Azure Cost Management Portal, we can sort and arrange the resource cost using the Tags. This way we can provide an expense dashboard with the actual cost of the resources per department, project or whatever tags we have added to the Resource.

Guide: Video

View my video guide on how to use Azure Policy to enforce tags for resource creation

You can find more at Microsoft Docs: https://docs.microsoft.com/en-us/azure/governance/policy/

Pantelis Apostolidis

www.cloudcorner.gr

The post Azure Policy | Enforce tags for resource creation appeared first on Apostolidis Cloud Corner.