DEV Community: Adebayo Ebofin

Creating an EC2 Instance on AWS and Installing IIS server on it

Adebayo Ebofin — Mon, 23 Dec 2024 13:52:30 +0000

Table of content

What is AWS?
What is EC2?
What is IIS?
Step-by-step guide to create an Amazon EC2 instance and install IIS (Internet Information Services) on it (a) Log in / sign up to AWS Management console (b) Connect to Instance (c) Install IIS on the Instance (d) Verify IIS installation

What is AWS?
Amazon Web Services (AWS) is a comprehensive cloud computing platform offered by Amazon. It provides a wide range of cloud-based services, including compute power, storage, databases, machine learning, networking, and more, designed to help businesses build, deploy, and scale applications efficiently and cost-effectively.

What is EC2?
Amazon EC2 (Elastic Compute Cloud) is a service provided by Amazon Web Services (AWS) that offers scalable virtual servers in the cloud. EC2 enables users to run applications and workloads on virtual machines with customizable configurations of CPU, memory, storage, and networking.

What is IIS?
IIS (Internet Information Services) is a web server software developed by Microsoft for hosting websites, applications, and services. It runs on the Windows operating system and is used to serve both static content, like HTML files, and dynamic content, such as ASP.NET applications.

Here is a step-by-step guide to create an Amazon EC2 instance and install IIS (Internet Information Services) on it:

a. Log in/sign up to AWS Management console

In the AWS Console, search for and select EC2 under Services.

*Launch an Instance:
Click on Launch Instance.

*Give the EC2 a name( I choose crown)

*Add a tag

*Select region for your EC2 Instance (I choose us-west 2)

*Choose an Amazon Machine Image (AMI):

Select a Windows-based AMI from the drop down (e.g., Microsoft Windows Server 2025, Microsoft windows server 2025 core Base, Microsoft Windows Server 2022 Base or Microsoft window server 2025 Base).((I choose Microsoft Window Server 2025 Base)

Choose an Instance Type:

*Select an instance type (e.g., t3.micro for free tier-eligible).

*Create new key: To create new keypair click create new key, give the keypair a name(I choose instancekeypair),ensure the keypair type RSA is choosen, then click create a key pair and ensure the keypair file is downloaded

*Configure Security Group:

Create a new security group with the following rules:
RDP Allow you to connect to your instance
HTTP : Allow access for web traffic.

*Click Launch instance:

b. Connect to the EC2 Instance

*Select RDP client tab, click the connect using RDP client and download the remote desktop file (RDP file)

*Select get password

*Select upload private key file to upload private key file

*Select decrypt password

*Copy password

*Open the downloaded RDP file, connect by pasting the copied password and click ok

*Connected

c. Install IIS on the Instance
*Search for power shell from your desktop and run as administrator

Run the following command to list all features related to IIS to confirm what is available:
Get-WindowsFeature -Name Web-

*Enter the command
Install-WindowsFeature -Name Web-Server -IncludeAllSubFeature -IncludeManagementTools
press enter

Wait for it to finish loading
*Notice the **Exit code* says successful

d. Verify IIS Installation
Exit the remote server to AWS management console
On the instance navigate to the public IPv4 address of the instance. Copy IP address

*Paste the IP address in a new tab on your browser.

*Press enter and observe the web server that was deployed was successful accessed from the public internet.

*To ensure you don't run out your credit on AWS, Terminate and delete Instance immediately after usage.

Creating an S3 Bucket in AWS and generate a pre - signed URL

Adebayo Ebofin — Fri, 20 Dec 2024 15:31:15 +0000

Table of contents

What is an S3 bucket?
What is a pre-signed URL in an S3 bucket in AWS?
Step- by-step in creating S3 bucket
a. creating a folder b. uploading a file
creating a pre-signed URLs

An S3 bucket in AWS (Amazon Web Services) is a logical container for storing objects (files, data, and metadata) in Amazon Simple Storage Service (Amazon S3). It serves as the foundational storage unit in AWS and allows you to store, retrieve, and manage data in a scalable, secure, and cost-effective manner.
A pre-signed URL in the context of an AWS S3 bucket usually refers to a pre-signed URL. A pre-signed URL allows users to access a specific object in an S3 bucket without requiring direct permissions to the bucket.

This is particularly useful when you want to grant temporary, secure access to a private object in S3 for downloading or uploading purposes.

Step by step in creating S3 bucket
*sign up/log in to AWS Console:

Go to AWS Management Console.
*In the search bar, type "S3" and select S3 from the services list.

*Click "Create bucket":

Provide Bucket Name: Enter a unique bucket name (e.g., adexbucket).

Select Region: Choose the AWS region where the bucket will be created (e.g., US West 2 *Configure Settings: Leave Block Public Access settings as is (enabled by default).

*Disable Versioning .You can Enable Versioning as well when you want to keep multiple versions of objects to protect against accidental overwrites, deletions, or data loss.

Add tag :In adding tag, key is the "name" while value "crown"

*For Encryption and other setting ,leave as default

Create bucket Scroll down and click Create bucket.

*Successfully created bucket. Click on bucket to open

4a. creating folders
click create a folder to store file, videos, pictures etc

Give the folder a name(adexfolder) and select create folder

create a folder for videos and pictures using the same steps

*Successfully created folders for different purposes

b. uploading file
open the September picture folder and click on upload

*Click Add file and select the picture then click upload to upload the selected picture

Successful uploaded to September picture

open the October video folder and click on upload

Successful uploaded to October video folder

Creating pre - signed URLs
Open the image file Uploaded to September-pictures.
Click Object actions at the top right.
In the drop down select Share with a presigned URL.

Set the Number of minutes or hours you want the presigned URL to
last for. Setting to 45 minutes.
Click Create presigned URL.

Successfully created presigned URL

Paste the URL in a browser to test it .

Repeat the same for October video. Open the video file folder for October video
Click Object actions at the top right.
In the drop down select Share with a presigned URL.

Successfully created presigned URL

Paste the URL in a browser to test it .

Creating A Window Virtual Machine, RDP into it, Add a data disc to window virtual machine.

Adebayo Ebofin — Thu, 14 Nov 2024 23:41:14 +0000

What is a virtual machine?
A virtual machine is like a computer within a computer. It's a software-based version of a physical machine, complete with its own: CPU: Processes instructions
Memory (RAM): Stores data while the VM is running
Storage: Holds files and applications
Network interface: Allows it to connect to the internet or other networks.
What is RDP?
RDP stands for Remote Desktop Protocol. It's a network communication protocol developed by Microsoft that allows users to connect to and control another computer remotely. This means you can access and interact with a remote computer's desktop, files, and applications as if you were sitting in front of it.

What is a data disc?
A data disc is a type of disc used to store electronic data, such as files and applications.
It's similar to an audio CD but is specifically designed for storing data.

Here are step by step to create virtual machine, RDP into it and add a data disc
A .1 search for virtual machine
in the search bar and click on the virtual machine

Start the Creation Process To Do: Click the “Create” button to start the virtual machine creation process. Choose “Create a virtual machine hosted by Azure”.

Enter Project Details To Do: Select the appropriate subscription and create a resource group by clicking the “Create resource group” button and giving it a name(vmrg) and click ok .

Enter Virtual Machine Details To Do: Provide information about your virtual machine, such as the name, operating system (choose either Ubuntu Server 20.04 or Windows Server Datacenter -x64 G2), size, and other configuration settings. Leave other options as default. (I choose window 10pro version from the drop down)

Create an Administrator Account To Do: Choose “Password” for the authentication type. Use “Azureuser” for the username and “Password123@# for the password.

Select Inbound Port Rules To Do: Select SSH if you chose a Linux VM and RDP if it’s a Windows VM. This allows IP addresses to connect to the VM.(I choose RDP)

Check Licensing To Do: By default, this is unchecked. Click the box to check it.

Disable Boot Diagnostics To Do: Click “Next” until you reach the “Boot diagnostics” in the Monitoring tab, and click on “Disable”.

Review and Create and create To Do: Click on the “Review + Create” button. If the validation passes, the deployment will proceed. If not, note any recommendations, fix them, and try again. Deployment might take 3-5 minutes.

Check the Status To Do: If the VM is running, the task has succeeded.

Access the Virtual Machine To Do: Once the virtual machine is deployed, click on the “Connect” button in the virtual machine blade in the Azure portal.

Download RDP File To Do: Click “Native RDP”, select, and wait for the configured sign to be displayed on the right-hand side. Download the RDP file.

Connect to the VM To Do: Open the RDP file from your local computer and click on “Connect”. Enter the admin details created during the VM setup.

B. Install a data disk in a virtual machine
Having successfully created a virtual machine, here are step by step to install a data disk in a virtual machine

Open the virtual machine created and click on the disk under setting

Click on + create and attach a new disk under under data disks

Select LUN to input the total number of disc you want to add (I choose 5) and give your disk a name (I used datadisk) , For storage type select SSD for fast response time (I choose standard SSD) also select the size of your data disk (I choose 10) then select apply

To make use of datadisk added to the virtual machine you must format it first to do that
a. Go to overview, click on connect

b. Download RDP File
To Do: Click “Native RDP”, select, and wait for the configured sign to be displayed on the right-hand side. Download the RDP file.

c. Connect to the VM
To Do: Open the RDP file from your local computer and click on “Connect”. Enter the admin details created during the VM setup
d. Search for disk management in the search bar of the virtual machine that you login into and click on format and create hard disk partition

e. Select ok to initialize a disk before logical disk manager can access it

f. Scroll down and right click on 9.98GB unallocated to select new simple volume that you will click on to format the disk

g. Continue to click next

h. When you get to a place that says perform a disk format ,at the volume label box write Datadisk as the name this name is generally used by azure then click next till it gets to finish

i. Datadisk is formatted and ready for use

Creating an azure compute Gallery , capture the image of VM and store in compute Gallery and create VMSS

Adebayo Ebofin — Thu, 14 Nov 2024 23:37:27 +0000

Table of Content
A. What is Azure compute gallery?
B. What is Virtual Machine Scale Set?
C. What is orchestrated mode in Virtual Machine Scale Set(VMSS)?
D. Step by step in creating Virtual Machine
E. Step by step in creating compute gallery
F. Step by step in creating Virtual Machine Scale Set

A. What is azure compute Gallery?
An Azure Compute Gallery (formerly known as Shared Image Gallery) is a service that allows you to create and share custom virtual machine (VM) images in Azure. It acts as a centralized repository for storing and managing these images, enabling you to quickly provision new VM instances based on them.

B. What is virtual Machine Scale Set?
An Azure Virtual Machine Scale Set (VMSS) is a service that allows you to create and manage a group of identical, load-balanced virtual machines (VMs). The number of VM instances within the scale set can automatically increase or decrease based on predefined rules or real-time demand.

Key benefits of using VMSS:
Auto-scaling: Automatically adjust the number of VM instances to handle varying workloads.
Load balancing: Distribute traffic evenly across VM instances for optimal performance.
High availability: Ensure application uptime by distributing VMs across availability zones.
Simplified management: Manage a large number of VMs as a single unit.
Cost-effectiveness: Pay only for the resources you need, scaling up or down as required.
C. What is orchestrated mode in VMSS?
Orchestrated mode in Azure Virtual Machine Scale Sets (VMSS) is a new feature that offers greater flexibility and control over individual VM instances within a scale set. It provides two main modes:

Uniform Orchestration:

This is the traditional mode where all VM instances are identical and managed as a single unit.
The scale set handles all VM operations, including scaling, updates, and maintenance.
Offers limited flexibility for customization and management of individual VMs.
Flexible Orchestration:

This new mode allows for more granular control over individual VM instances.
You can manage VMs using standard Azure IaaS VM APIs, providing more flexibility for customization and configuration.
Supports different VM sizes and configurations within a single scale set.
Offers better support for advanced scenarios like custom scripts, extensions, and specific networking configurations.
Key benefits of Flexible Orchestration:

Greater flexibility: Customize and manage individual VMs like regular VMs.
Improved scalability: Scale to larger numbers of instances and support a wider range of VM sizes.
Enhanced control: Fine-tune VM configurations and maintenance operations.
Simplified management: Use familiar IaaS VM management tools and APIs.
When to use Flexible Orchestration:

Custom VM configurations: When you need to customize individual VMs with different configurations, such as specific software installations or network settings.
Advanced scenarios: For complex scenarios that require fine-grained control over VM lifecycle and operations.
Large-scale deployments: When you need to scale to a large number of VM instances with diverse requirements.
By understanding the differences between the two modes, you can choose the best option for your specific workload and requirements.

D. Step by step in creating Virtual Machine

Search for virtual machine in the search bar and click on the virtual machine

Start the Creation Process To Do: Click the “Create” button to start the virtual machine creation process. Choose “Create a virtual machine hosted by Azure”.

Enter Project Details To Do: Select the appropriate subscription and create a resource group by clicking the “Create resource group” button and giving it a name(vmrg) and click ok .

Enter Virtual Machine Details To Do: Provide information about your virtual machine, such as the name, operating system (choose either Ubuntu Server 20.04 or Windows Server Datacenter -x64 G2), size, and other configuration settings. Leave other options as default. (I choose window 10pro version from the drop down)

Create an Administrator Account To Do: Choose “Password” for the authentication type. Use “Azureuser” for the username and “Password123@# for the password.

Select Inbound Port Rules To Do: Select SSH if you chose a Linux VM and RDP if it’s a Windows VM. This allows IP addresses to connect to the VM.(I choose RDP)

Check Licensing To Do: By default, this is unchecked. Click the box to check it.

Disable Boot Diagnostics To Do: Click “Next” until you reach the “Boot diagnostics” in the Monitoring tab, and click on “Disable”.

Review and Create and create To Do: Click on the “Review + Create” button. If the validation passes, the deployment will proceed. If not, note any recommendations, fix them, and try again. Deployment might take 3-5 minutes.

Check the Status To Do: If the VM is running, the task has succeeded.

Access the Virtual Machine To Do: Once the virtual machine is deployed, click on the “Connect” button in the virtual machine blade in the Azure portal.

Download RDP File To Do: Click “Native RDP”, select, and wait for the configured sign to be displayed on the right-hand side. Download the RDP file.

Connect to the VM To Do: Open the RDP file from your local computer and click on “Connect”. Enter the admin details created during the VM setup.

E. Creating a compute gallery
Here are step by step in creating a compute gallery

search for compute galleries in the search bar and select

Select + create

Give your resource group a name (I choose cgrg) and click ok

Give name to your compute gallery (I choose cg1) and description(Place to store our virtual machine images) then click review + create

Click create

Go back to the Virtual machine created and click on image at the drop down of capture

7.Select compute gallery name created from the drop down of select a gallery at Target azure compute gallery also choose either Generalized: VMs created from this image require hostname, admin user, and other VM related setup to be completed on first boot or
Specialized: VMs created from this image are completely configured and do not require parameters such as hostname and admin user/password (I choose specialized)

Select create new at the target Vm definition and give it a name (I choose firstimage)then click ok

9.Put the version number (I choose 0.0.1)leave others as default setting, select review + create

Select create

11.Once the deployment is complete Click on go to resource

F. Here are step by step to create VMSS

Having successfully created azure compute gallery click + create VMSS

Give your VMMSS a name

3.YOU have option of either autoscaling or manual update your virtual machine scale set (I choose manual) then click review + create

Click create

Click go to resource

Under availability +scaling click on scaling then input the number of vmss you want to create then click on save

View the VMSS created

Creating Azure Dev Test Labs

Adebayo Ebofin — Wed, 30 Oct 2024 00:19:12 +0000

Azure DevTest Labs is a cloud-based service that enables you to quickly create, manage, and secure environments for development, testing, and training purposes.

It provides a self-service portal where developers and testers can easily spin up virtual machines (VMs) with pre-configured software and settings.
Here are step by step in creating Dev Test Labs
a. In azure portal search for dev test labs and select

b. Click on +create

c. Give your resource group a name and click ok(Devrg)

d. Give your lab a name (lab1) and then choose any public environment of your choice either on or off (on)

e. Select Auto -shutdown, enable it to on, input the time you want it to shut-down(7pm), activate send notification before shut-down to No

f. Select review + create

g. Select create

CREATING A LIBRARY WEB APP USING AZURE APP SERVICE

Adebayo Ebofin — Mon, 28 Oct 2024 07:34:37 +0000

Table of content

Azure app service a. What is azure app service? b. Step by step in creating library web app
Deployment slot in azure app service a. What is deployment slot? b. step by step in creating deployment slot
Monitoring using app service a. What is monitoring? b. step by step in creating monitoring using app service

What is Azure app service?
Azure App Service is a fully managed Platform as a Service (PaaS) offering from Microsoft Azure that allows you to build, deploy, and scale web apps, mobile back ends, and RESTful APIs in the programming language of your choice without managing infrastructure.

Here are step by step in creating a library web app using azure app service a. In azure portal search for app services

b. At the drop down of + create select web App

c. create a New Resource Group( I named it webapprg)

d. Give your web app a name of your choice (libraryapp) also select code

e. Select your Runtime stack (I choose .NET 6 (LTS) which automatically selected window as operating system also select region

uploads.s3.amazonaws.com/uploads/articles/59vbr2em86aaevnnkqps.png)

f. Give your plan a name and click ok (libraryapplan)

g. Choose your pricing plan from drop down (I choose standard)

h. Add tag by clicking on tag write name and web app name (libraryapp), select review + create.

i. select create

j. Go to chatgpt to generate a code by typing sample HTML, CSS, JavaScript application for library all in one file

k. Go to library app created and select deployment center under deployment slot provided you are picking your code from any continuous deployment or manual deployment

l. In the search bar search for advance tools and select then click on the Go

m. Click on debug console and select CMD

n. Click on site

o. Click on wwwroot

p. Click on the pencil icon of hostingstart.html

q. Remove the default code

r. Paste code copy from chatgpt and click save
s. Go back to libraryapp created and click on default domain to view the library created

2a. What is deployment slot?
In Azure App Service, a deployment slot is a feature that allows you to host different versions of your application in separate environments within the same App Service instance. Each slot has its own configuration settings, environment variables, and can be used to test or stage your application without affecting the production version.

Key Benefits:
Staging and Testing: You can deploy your app to a staging slot to test changes before swapping it with the production slot.

Zero-Downtime Deployments: By swapping slots, you can achieve near-instant updates with minimal downtime.

Isolated Environments: Each slot can have different settings, enabling you to test with different configurations.

Easy Rollbacks: If a deployment in production goes wrong, you can quickly swap back to the previous version.

b. Step by step in creating deployment slot

Having created the new app with different features by following the step by step process in creating the initial app you will click on deployment slot under deployment

For the new app created type 10% at the traffic slot that is out of 100% of the traffic using the one in production let 10% be viewing this to access it if ok then click save

Maybe after 3months of testing and everything is ok and you want to replace the one in production with the new one for 100% traffic you will click swap then start swap

3a. What is monitoring using app service?
Monitoring your Azure App Service is crucial for ensuring its optimal performance, availability, and security.
b. Step by step in creating monitoring

Select Alert under monitoring and click on create alert rule

Select the signal name from the drop down (Http server Errors) then select review + create

Select create

Provide storage for the IT department testing and training

Adebayo Ebofin — Mon, 07 Oct 2024 16:46:08 +0000

Table of content
A. What is azure storage
i. Key features of azure storage
ii. Types of data
B. Steps in creating storage account

A. What is azure storage
Azure Storage is a cloud storage solution provided by Microsoft that allows you to store and access data in the cloud. It offers highly available, massively scalable, durable, and secure storage for a variety of data objects.

i. Key features of azure storage
a. Scalability:scalability in Azure Storage refers to the ability of the service to automatically adjust its capacity to meet changing storage needs. This means that as your data grows or shrinks, Azure Storage can dynamically scale up or down to accommodate the increased or decreased storage requirements.
Azure storage can scale horizontally by adding or removing storage accounts to increase or decrease storage capacity. It can also scale
Vertically by increasing or decreasing the performance tier to optimize for different workloads and finally it can scale up automatically by scaling up or down based on predefined rules or metrics, ensuring that your storage resources are always aligned with your application's needs.
b. Durability: Durability in Azure Storage refers to the reliability and persistence of data stored within the service. It ensures that your data is protected against loss due to hardware failures, software errors, or other unforeseen events.
c. Security:Security in azure storage is a measures put in place to protect your data from unauthorized access and potential threats. Examples are
Data Encryption
At-rest encryption: Azure Storage encrypts data while it's stored on disk, providing protection against unauthorized access even if the physical storage device is compromised.
In-transit encryption: Data is encrypted during transmission between your application and Azure Storage, safeguarding it from eavesdropping or interception.
Access Controls
Role-based access control (RBAC): You can granularly control who has access to your storage resources by assigning roles with specific permissions.
Shared access signatures (SAS): You can generate temporary access tokens that grant limited permissions to specific users or applications, enabling secure data sharing.
Network Security
Virtual private networks (VPNs): You can connect your on-premises network to Azure Storage using a VPN, providing a secure and private connection.
Private endpoints: You can create private endpoints for your storage accounts, restricting access to only within your virtual network, enhancing security.
Compliance and Certifications
Industry certifications: Azure Storage adheres to various industry standards and certifications, such as HIPAA, GDPR, and PCI DSS, ensuring that it meets stringent security requirements.
Regular audits and assessments: Microsoft regularly conducts security audits and assessments to identify and address potential vulnerabilities.
Threat Detection and Protection
Azure Security Center: This service provides advanced threat protection for your Azure resources, including storage accounts, by continuously monitoring for suspicious activity and anomalies.
Azure Monitor: You can use Azure Monitor to set up alerts and notifications for security-related events, enabling you to proactively respond to potential threats.
By combining these security measures, Azure Storage provides a robust and secure environment for storing and managing your data.
d.Performance tiers: Performance tiers in Azure Storage refer to the different levels of performance and cost that you can choose for your storage accounts. These tiers allow you to optimize your storage solution for different workloads and performance requirements.
Main performance tiers available in Azure Storage are:
Standard: This is the most cost-effective tier, suitable for general-purpose workloads that don't require extremely high performance.
Premium: This tier offers higher performance than Standard, making it ideal for applications that require faster data access and lower latency.
Premium Block Blob: This is a specialized tier designed for storing large amounts of block blobs efficiently. It offers even higher performance than the standard Premium tier.
ii. Types of data.

Blob Storage: Designed for storing large amounts of unstructured data like images, videos, documents, and audio files.
File Storage: Provides a familiar file share experience in the cloud, allowing you to access files from multiple servers or applications.
Queue Storage: A reliable queue service for storing messages and processing them asynchronously.
Table Storage: A NoSQL database service for storing structured data in key-value pairs. Ideal for storing large amounts of structured data that don't require a relational database schema.
Disk Storage: A managed disk service that provides highly durable and reliable storage for virtual machines. .6. Archive Storage: A cost-effective storage solution for long-term data retention. Designed for infrequently accessed data that needs to be stored for extended periods. Offers lower storage costs compared to other storage options.
Data Lake Storage Gen2: A highly scalable and performing storage solution for big data analytics and machine learning .

B. Steps in creating storage account

Here are steps in creating Azure storage
NOTE: The IT department needs to prototype different storage scenarios and to train new personnel. The content isn't important enough to back up and doesn't need to be restored if the data is overwritten or removed. A simple configuration that can be easily changed is desired.
Skilling tasks
Create a storage account.
Configure basic settings for security and networking.

Create a resource group and a storage account.
Steps 1.Create and deploy a resource group to hold all your project
resources.

*In the Azure portal, search for and select Resource groups

*Select + Create.

Give your resource group a name. For example, storagerg.
Select a region. Use this region throughout the project.
Select Review and create to validate the resource group.

Select Create to deploy the resource group.

Step 2.Create and deploy a storage account to support testing and training.
*In the Azure portal, search for and select Storage accounts

*Select + Create.

A.On the Basics tab, select your Resource group
B. Provide a Storage account name. The storage account name must be unique in Azure
C. Set the Performance to Standard.
D. Select Review, and then Create.

*select create

*Wait for the storage account to deploy and then Go to resource

Configure simple settings in the storage account.
1.The data in this storage account doesn’t require high availability or durability. A lowest cost storage solution is desired.

In your storage account, in the Data management section, select the Redundancy blade.

*Select Locally-redundant storage (LRS) in the Redundancy drop-down.

Be sure to Save your changes.

Refresh the page and notice the content only exists in the primary location.

2.The storage account should only accept requests from secure connections
A.In the Settings section, select the Configuration blade
B.Ensure Secure transfer required is Enabled.

3.Developers would like the storage account to use at least TLS version 1.2
A. In the Settings section, select the Configuration blade.
B. Ensure the Minimal TLS version is set to Version 1.2.

4.Until the storage is needed again, disable requests to the storage account.
A. In the Settings section, select the Configuration blade.
B. Ensure Allow storage account key access is Disabled.
C. Be sure to Save your changes

5.Ensure the storage account allows public access from all networks.
A. In the Security + networking section, select the Networking blade.
B. Ensure Public network access is set to Enabled from all networks.
C. Be sure to Save your changes

Azure storage account with required configuration setting had been successfully created.
Kindly subscribe for more update.

Provide storage for the public website

Adebayo Ebofin — Mon, 07 Oct 2024 16:45:50 +0000

Introduction
Public Storage in azure is a cloud-based storage solution offered by Microsoft Azure. It provides a highly scalable, durable, and secure platform for storing various types of data, including unstructured data like images, videos, and documents.

NOTE: The company website supplies product images, videos, marketing literature, and customer success stories. Customers are located worldwide and demand is rapidly expanding. The content is mission-critical and requires low latency load times.
Here are steps in providing a public storage:
Skilling tasks

Create a storage account with high availability.
Ensure the storage account has anonymous public access.
Create a blob storage container for the website documents.
Enable soft delete so files can be easily restored.
Enable blob versioning.

Create a storage account with high availability.

Create a storage account to support the public website.

a. In the portal, search for and select Storage accounts.

b. Select + Create.

c. For resource group select new. Give your resource group a name and select OK.

d. Set the Storage account name to public website. Make sure the storage account name is unique by adding an identifier.
e. Take the defaults for other settings.
f. Select Review and then Create.

g. Wait for the storage account to deploy, and then select Go to
resource.

This storage requires high availability if there’s a regional outage. Additionally, enable read access to the secondary region.

a. In the storage account, in the Data management section, select the Redundancy blade.
b. Ensure Read-access Geo-redundant storage is selected.
c. Review the primary and secondary location information.

Information on the public website should be accessible without requiring customers to login.

a. In the storage account, in the Settings section, select the Configuration blade.
b. Ensure the Allow blob anonymous access setting is Enabled.
c. Be sure to Save your changes.

Create a blob storage container with anonymous read access

The public website has various images and documents. Create a blob storage container for the content. a. In your storage account, in the Data storage section, select the Containers blade. b. Select + Container. c. Ensure the Name of the container is public. d. Select Create

Customers should be able to view the images without being authenticated. Configure anonymous read access for the public container blobs. a. Select your public container. b. On the Overview blade, select Change access level. c. Ensure the Public access level is Blob (anonymous read access for blobs only). d. Select OK.

Practice uploading files and testing access.

For testing, upload a file to the public container. The type of file doesn’t matter. A small image or text file is a good choice. a. Ensure you are viewing your container. b. Select Upload. c. Browse to files and select a file. Browse to a file of your choice. d. Select Upload.

e. Close the upload window, Refresh the page and ensure your file was uploaded.

Determine the URL for your uploaded file. Open a browser and test the URL. a. Select your uploaded file. b. On the Overview tab, copy the URL. c. Paste the URL into a new browser tab. d. If you have uploaded an image file it will display in the browser. Other file types should be downloaded

Configure soft delete

It’s important that the website documents can be restored if they’re deleted. Configure blob soft delete for 21 days. a. Go to the Overview blade of the storage account. b. On the Properties page, locate the Blob service section. c. Select the Blob soft delete setting. d. Ensure the Enable soft delete for blobs is checked. e. Change the Keep deleted blobs for (in days setting is 21. f. Notice you can also Enable soft delete for containers. g. Don’t forget to Save your changes.

If something gets deleted, you need to practice using soft delete to restore the files. a. Navigate to your container where you uploaded a file. b. Select the file you uploaded and then select Delete. c. Select OK to confirm deleting the file.

d. On the container Overview page, toggle the slider Show deleted blobs. This toggle is to the right of the search box.
e. Select your deleted file, and use the ellipses on the far right, to g. Undelete the file.
h. Refresh the container and confirm the file has been restored

Configure blob versioning

It’s important to keep track of the different website product document versions. a. Go to the Overview blade of the storage account. b. In the Properties section, locate the Blob service section. c. Select the Versioning setting. d. Ensure the Enable versioning for blobs checkbox is checked. e. Notice your options to keep all versions or delete versions after. f. Don’t forget to Save your changes.

Provide private storage for internal company documents

Adebayo Ebofin — Mon, 07 Oct 2024 16:45:32 +0000

Introduction
Private storage in Azure refers to a storage account that is only accessible from within your virtual network (VNet). This is achieved through the use of Azure Private Endpoints.

Azure Private Endpoints are network interfaces that provide secure, private connectivity to Azure services within your VNet. By creating a private endpoint for your storage account, you can access your data without exposing it to the public internet.

Benefits of using private storage in Azure:

Enhanced security: Reduces the risk of unauthorized access to your data.
Reduced attack surface: Eliminates public-facing endpoints, making it harder for attackers to target your storage.
Compliance: Helps meet compliance requirements that mandate data isolation and protection.
Improved performance: In some cases, using a private endpoint can improve network latency and performance.
How it works:

Create a private endpoint: Within your VNet, you create a private endpoint that is assigned a private IP address from your VNet's address space.
Connect to a service: The private endpoint then connects to the Azure service you want to access, such as a storage account. This connection is made through a private link, ensuring that your data remains within your private network.
Secure access: Once connected, you can access the service using the same connection strings and authorization mechanisms you would use if you were accessing it publicly.

NOTE: The company needs storage for their offices and departments. This content is private to the company and shouldn't be shared without consent. This storage requires high availability if there's a regional outage. The company wants to use this storage to back up the public website storage.
Here are steps in creating private storage
Skilling tasks

Create a storage account for the company private documents.
Configure redundancy for the storage account.
Configure a shared access signature so partners have restricted access to a file.
Back up the public website storage.
Implement lifecycle management to move content to the cool tier.

Create a storage account and configure high availability.

Create a storage account for the internal private company documents. a. In the portal, search for and select Storage accounts.

b. Select + Create.

c. Select the Resource group created in the previous lab.
d. Set the Storage account name to private. Add an identifier to the name to ensure the name is unique.
e. Select Review, and then Create the storage account.

f. Wait for the storage account to deploy, and then select Go to resource.

This storage requires high availability if there’s a regional outage. Read access in the secondary region is not required. Configure the appropriate level of redundancy.

a. In the storage account, in the Data management section, select the Redundancy blade.
b. Ensure Geo-redundant storage (GRS) is selected.
c. Refresh the page.
d. Review the primary and secondary location information.
e. Save your changes.

Create a storage container, upload a file, and restrict access to the file.

Create a private storage container for the corporate data.

a. In the storage account, in the Data storage section, select the Containers blade.
b. Select + Container.

c. Ensure the Name of the container is private.
d. Ensure the Public access level is Private (no anonymous access).
e. As you have time, review the Advanced settings, but take the defaults.
f. Select Create.

For testing, upload a file to the private container. The type of file doesn’t matter. A small image or text file is a good choice. Test to ensure the file isn’t publically accessible.

a. Select the container.
b. Select Upload.
c. Browse to files and select a file.
d. Upload the file.

e. Select the uploaded file.
f. On the Overview tab, copy the URL.

g. Paste the URL into a new browser tab.
h. Verify the file doesn’t display and you receive an error.

An external partner requires read and write access to the file for at least the next 24 hours. Configure and test a shared access signature (SAS).

a. Select your uploaded blob file and move to the Generate SAS tab.
b. In the Permissions drop-down, ensure the partner has only Read permissions.
c. Verify the Start and expiry date/time is for the next 24 hours.
d. Select Generate SAS token and URL.

e. Copy the Blob SAS URL to a new browser tab.
f. Verify you can access the file. If you have uploaded an image file it will display in the browser. Other file types will be downloaded.

Configure storage access tiers and content replication.

To save on costs, after 30 days, move blobs from the hot tier to the cool tier. a. Return to the storage account. b. In the Overview section, notice the Default access tier is set to Hot.

c. In the Data management section, select the Lifecycle management blade.
d. Select Add rule.

e. Set the Rule name to movetocool.
f. Set the Rule scope to Apply rule to all blobs in the storage account.
g. Select Next.

h. Ensure Last modified is selected.
i. Set More than (days ago) to 30.
j. In the Then drop-down select Move to cool storage.
k. As you have time, review other lifecycle options in the drop-down.
l. Add the rule.

The public website files need to be backed up to another storage account. a. In your storage account, create a new container called backup. Use the default values. Refer back to Lab 02a if you need detailed instructions.

b. Navigate to your publicwebsite storage account. This storage account was created in the previous exercise.
c. In the Data management section, select the Object replication blade.
d. Select Create replication rules.

e. Set the Destination storage account to the private storage account.
f. Set the Source container to public and the Destination container to backup.
g. Create the replication rule.

h. Optionally, as you have time, upload a file to the public container. Return to the private storage account and refresh the backup container. Within a few minutes your public website file will appear in the backup folder.

Provide shared file storage for the company offices

Adebayo Ebofin — Mon, 07 Oct 2024 16:45:12 +0000

Introduction
Shared file storage is a system that allows multiple users to access and share files from a central location. It's like a digital filing cabinet that everyone can contribute to and retrieve from.

Benefits of Shared File Storage:
a. Centralized Access: All files are stored in one place, making them easy to find and manage.
b. Collaboration: Multiple users can work on the same files simultaneously, improving teamwork and efficiency.
c. Version Control: Different versions of a file can be tracked and accessed, ensuring that you always have the most up-to-date information.
d. Security: Access can be controlled, protecting sensitive data from unauthorized users.
e. Scalability: Shared file storage can easily be expanded to accommodate growing storage needs.

NOTE: The company is geographically dispersed with offices in different locations. These offices need a way to share files and disseminate information. For example, the Finance department needs to confirm cost information for auditing and compliance. This file shares should be easy to access and load without delay. Some content should only be accessed from selected corporate virtual networks.

Here are steps to follow in creating shared file storage:
Skilling tasks

Create a storage account specifically for file shares.
Configure a file share and directory.
Configure snapshots and practice restoring files.
Restrict access to a specific virtual network and subnet.

Create and configure a storage account for Azure Files.

Create a storage account for the finance department’s shared files. a. In the portal, search for and select Storage accounts. b. Select + Create. c. For Resource group select Create new. Give your resource group a name and select OK to save your changes. d. Provide a Storage account name. Ensure the name meets the naming requirements. e. Set the Performance to Premium. f. Set the Premium account type to File shares. g. Set the Redundancy to Zone-redundant storage. h. Select Review and then Create the storage account. i. Wait for the resource to deploy. j. Select Go to resource. Create and configure a file share with directory.
Create a file share for the corporate office. a. In the storage account, in the Data storage section, select the File shares blade. b. Select + File share and provide a Name. c. Review the other options, but take the defaults. d. Select Create
Add a directory to the file share for the finance department. For future testing, upload a file. a. Select your file share and select + Add directory. b. Name the new directory finance. c. Select Browse and then select the finance directory. d. Notice you can Add directory to further organize your file share. e. Upload a file of your choosing. Configure and test snapshots.
Similar to blob storage, you need to protect against accidental deletion of files. You decide to use snapshots. a. Select your file share. b. In the Operations section, select the Snapshots blade. c. Select + Add snapshot. The comment is optional. Select OK d. Select your snapshot and verify your file directory and uploaded file are included. 2.Practice using snapshots to restore a file. a. Return to your file share. b. Browse to your file directory. c. Locate your uploaded file and in the Properties pane select Delete. Select Yes to confirm the deletion. d. Select the Snapshots blade and then select your snapshot. e. Navigate to the file you want to restore, f. Select the file and the select Restore. g. Provide a Restored file name. h. Verify your file directory has the restored file. Configure restricting storage access to selected virtual networks.
This tasks in this section require a virtual network with subnet. In a production environment these resources would already be created. a. Search for and select Virtual networks. b. Select Create. Select your resource group. and give the virtual network a name. c. Take the defaults for other parameters, select Review + create, and then Create. d. Wait for the resource to deploy. e. Select Go to resource. f. In the Settings section, select the Subnets blade. g. Select the default subnet. h. In the Service endpoints section choose Microsoft.Storage in the Services drop-down. i. Do not make any other changes. j. Be sure to Save your changes.
The storage account should only be accessed from the virtual network you just created. Learn more about using private storage endpoints.. a. Return to your files storage account. b. In the Security + networking section, select the Networking blade. c. Change the Public network access to Enabled from selected virtual networks and IP addresses. d. In the Virtual networks section, select Add existing virtual network. e. Select your virtual network and subnet, select Add. f. Be sure to Save your changes. g. Select the Storage browser and navigate to your file share. h. Verify the message not authorized to perform this operation. You are not connecting from the virtual network.

Provide storage for a new company app

Adebayo Ebofin — Mon, 07 Oct 2024 16:44:53 +0000

Introduction
Azure Storage is a cloud-based storage solution offered by Microsoft Azure. It provides a highly scalable, durable, and secure platform for storing and managing various types of data. Azure Storage offers several services, each designed to meet specific storage needs.

Here are steps to create azure storage for company new app:
NOTE: The company is designing and developing a new app. Developers need to ensure the storage is only accessed using keys and managed identities. The developers would like to use role-based access control. To help with testing, protected immutable storage is needed.
Skilling tasks
Create the storage account and managed identity.
Secure access to the storage account with a key vault and key.
Configure the storage account to use the customer managed key in the key vault
Configure an time-based retention policy and an encryption scope.

Create the storage account and managed identity

Provide a storage account for the web app. a. In the portal, search for and select Storage accounts.

b. Select + Create.

c. For Resource group select Create new. Give your resource group a name and select OK to save your changes.

d. Provide a Storage account name. Ensure the name is unique and meets the naming requirements.

e. Move to the Encryption tab.
f. Check the box for Enable infrastructure encryption.
g. Notice the warning, This option cannot be changed after this storage account is created.

h. Select Review + Create.
i. Wait for the resource to deploy.

Provide a managed identity for the web app to use. a. Search for and select Managed identities.

b. Select Create.

c. Select your resource group.
d. Give your managed identity a name.
e. Select Review and create, and then Create.

Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs.

a. Search for and select your storage account.

b. Select the Access Control (IAM) blade.
c. Select Add role assignment (center of the page).

d. On the Job functions roles page, search for and select the Storage Blob Data Reader role.

e. On the Members page, select Managed
identity.

f. Select Select members, in the Managed identity drop-down select User-assigned managed identity.
g. Select the managed identity you created in the previous step.
h. Click Select and then Review + assign the role.

i. Select Review + assign a second time to add the role assignment.

j. Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.

Secure access to the storage account with a key vault and key

To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions. a. In the portal, search for and select Resource groups.

b. Select your resource group, and then the Access Control (IAM) blade.
c. Select Add role assignment (center of the page).

d. On the Job functions roles page, search for and select the Key Vault Administrator role.

e. On the Members page, select User, group, or service principal.
f. Select Select members.

g. Search for and select your user account. Your user account is shown in the top right of the portal.
h. Click Select and then Review + assign.

i. Select Review + assign a second time to add the role assignment.

j. You are now ready to continue with the lab.

Create a key vault to store the access keys.

a. In the portal, search for and select Key vaults.
b. Select Create.

c. Select your resource group.

d. Provide the name for the key vault. The name must be unique.

e. Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.
f. Select Review + create.

g. Wait for the validation checks to complete and then select Create.

h. After the deployment, select Go to resource.

i. On the Overview blade ensure both Soft-delete and Purge protection are enabled.

Create a customer-managed key in the key vault.

a. In your key vault, in the Objects section, select the Keys blade.

b. Select Generate/Import and Name the key.
c. Take the defaults for the rest of the parameters, and Create the key.

Configure the storage account to use the customer managed key in the key vault

Before you can complete the next steps, you must assign the Key Vault Crypto Service Encryption User role to the managed identity. a. In the portal, search for and select Resource groups. b. Select your resource group, and then the Access Control (IAM) blade. c. Select Add role assignment (center of the page).

d. On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.

e. On the Members page, select Managed identity.
f. Select Select members, in the Managed identity drop-down select User-assigned managed identity.

g. Select your managed identity.
h. Click Select and then Review + assign.

i. Select Review + assign a second time to add the role assignment.

Configure the storage account to use the customer managed key in your key vault. a. Return to your the storage account. b. In the Security + networking section, select the Encryption blade. c. Select Customer-managed keys.

=
d. Select a key vault and key. Select your key vault and key.
e. Select to confirm your choices.

f. Ensure the Identity type is User-assigned.

g. Select an identity.

h. Select your managed identity then select Add.
i. Save your changes.

j. If you receive an error that your identity does not have the correct permissions, wait a minute and try
again.

Configure an time-based retention policy and an encryption scope.

The developers require a storage container where files can’t be modified, even by the administrator. .

a. Navigate to your storage account.

b. In the Data storage section, select the Containers blade.
c. Create a container called hold. Take the defaults. Be sure to Create the container.

d. Upload a file to the container.

e. In the Settings section, select the Access policy blade.
f. In the Immutable blob storage section, select + Add policy.

g. For the Policy type, select time-based retention.
h. Set the Retention period to 5 days.
i. Be sure to Save your changes.

j. Try to delete the file in the container.
k. Verify you are notified failed to delete blobs due to policy.

The developers require an encryption scope that enables infrastructure encryption. Learn more about infrastructure encryption.

a. Navigate back to your storage account.
b. In the Security + networking blade, select Encryption.
c. In the Encryption scopes tab, select Add.
d. Give your encryption scope a name.
e. The Encryption type is Microsoft-managed key.
f. Set Infrastructure encryption to Enable.
g. Create the encryption scope.

h. Return to your storage account and create a new container.
i. Notice on the New container page, there is the Name and Public access level.
j. Notice in the Advanced section you can select the Encryption scope you created and apply it to all blobs in the container.