DEV Community: Yemi G

Creating a Windows Server Virtual Machine and deploying a Windows Server.

Yemi G — Tue, 04 Jun 2024 04:20:23 +0000

In Azure Portal, select Virtual Machine

Select Create Azure Virtual machine

Select Resource Group

Enter Virtual machine name

Select Image

Enter Username & Password

Select Inbound ports

Select Licensing and confirm

In the Monitoring Tab, disable Diagnostics

Select Review + Create, then select create

Go to Resource

Connect to Virtual machine

Select Local machine

Ensure it's configured

Download RDP

Click downloads and enter password
You should have access into the Virtual machine

Search for Power Shell in the VM and run as Administrator

Use the below Install windows command to Install windows in the Virtual Machine

Copy the Public IP address and paste it in a browser to confirm you have successfully deployed a windows server.

Creating a Linux Virtual Machine with Ubuntu Server using Password Authentication.

Yemi G — Tue, 04 Jun 2024 02:23:31 +0000

In the portal, search for Virtual Machine

Select Create

Select Azure Virtual machine

Select Resource Group

Enter Virtual machine name

Select image as Ubuntu Server

Select Adminstration Type to be Password

Enter Username and password

Select Allow selected ports for Public inbound ports

Select inbound ports

Go to Monitoring Tab

Disable Diagnostics

Go to Tag tab and add a name and value

Select Review + Create, confirm validation and select create

Go to Resource and select IP address

Increase the timeout to your preferred time and save your changes

Open PowerShell on your local computer

Enter "ssh, your username and your VM IP address" and click Enter

It will ask if you want to continue, type "yes"

Type your password - Note, Linux will not display your password as you type it.

Then you will get connected to your Virtual machine.

Implementing Role-Based Access Control, Managed Identities, and Protected Immutable Storage

Yemi G — Mon, 03 Jun 2024 01:02:17 +0000

Create the storage account and managed identity

Provide a storage account for the web app.

In the portal, search for and select Storage accounts.

Select + Create.

For Resource group select Create new. Give your resource group a name and select OK to save your changes.

Provide a Storage account name. Ensure the name is unique and meets the naming requirements.

Move to the Encryption tab.

Check the box for Enable infrastructure encryption.

Notice the warning, This option cannot be changed after this storage account is created.

Select Review + Create.

Wait for the resource to deploy.

2.** Provide a managed identity for the web app to use. **

Search for and select Managed identities.

Select Create.

Select your resource group.

Give your managed identity a name.

Select Review and create, and then Create.

*Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs. *

Search for and select your storage account.

Select the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Storage Blob Data Reader role.

On the Members page, select Managed identity.

Select Select members, in the Managed identity drop-down select User-assigned managed identity.

Select the managed identity you created in the previous step.

Click Select and then Review + assign the role.

Select Review + assign a second time to add the role assignment.

Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.

Secure access to the storage account with a key vault and key

*To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions. *

In the portal, search for and select Resource groups.

Select your resource group, and then the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Key Vault Administrator role.

On the Members page, select User, group, or service principal.

Select Select members.

Search for and select your user account. Your user account is shown in the top right of the portal.

Click Select and then Review + assign.

Select Review + assign a second time to add the role assignment.

You are now ready to continue with the lab.

Create a key vault to store the access keys.

In the portal, search for and select Key vaults.

Select Create.

Select your resource group.

Provide the name for the key vault. The name must be unique.

Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.

Select Review + create.

Wait for the validation checks to complete and then select Create.

After the deployment, select Go to resource.

On the Overview blade ensure both Soft-delete and Purge protection are enabled.

Create a customer-managed key in the key vault.

In your key vault, in the Objects section, select the Keys blade.

Select Generate/Import and Name the key.

Take the defaults for the rest of the parameters, and Create the key.

Configure the storage account to use the customer managed key in the key vault

Before you can complete the next steps, you must assign the Key Vault Crypto Service Encryption User role to the managed identity.

In the portal, search for and select Resource groups.

Select your resource group, and then the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.

On the Members page, select Managed identity.

Select Select members, in the Managed identity drop-down select User-assigned managed identity.

Select your managed identity.

Click Select and then Review + assign.

Select Review + assign a second time to add the role assignment.

*Configure the storage account to use the customer managed key in your key vault. *

Return to your the storage account.

In the Security + networking section, select the Encryption blade.

Select Customer-managed keys.

Select a key vault and key. Select your key vault and key.

Select to confirm your choices.

Ensure the Identity type is User-assigned.

Select an identity.

Select your managed identity then select Add.

Save your changes.

Configure an time-based retention policy and an encryption scope.

*The developers require a storage container where files can’t be modified, even by the administrator. *

Navigate to your storage account.

In the Data storage section, select the Containers blade.

Create a container called hold. Take the defaults. Be sure to Create the container.

Upload a file to the container.

In the Settings section, select the Access policy blade.

In the Immutable blob storage section, select + Add policy.

For the Policy type, select time-based retention.

Set the Retention period to 5 days.

Be sure to Save your changes.

Try to delete the file in the container.

Verify you are notified failed to delete blobs due to policy.

*The developers require an encryption scope that enables infrastructure encryption. *

Navigate back to your storage account.

In the Security + networking blade, select Encryption.

In the Encryption scopes tab, select Add.

Give your encryption scope a name.

The Encryption type is Microsoft-managed key.

Set Infrastructure encryption to Enable.

Create the encryption scope.

Return to your storage account and create a new container.

Notice on the New container page, there is the Name and Public access level.
Notice in the Advanced section you can select the Encryption scope you created and apply it to all blobs in the container.

Optimising Global Content Delivery: Ensuring Low Latency for Expanding Worldwide Demand

Yemi G — Mon, 27 May 2024 05:44:12 +0000

Create a storage account to support the public website.

In the portal, select storage accounts

Select "+ Create"

Create new resource group and select "OK"

Name storage account

Select "Review and Create"

Select "Create"

Select Go to Resourcce

This storage requires high availability if there’s a regional outage. Additionally, enable read access to the secondary region,

In the Data management section

Select Redundancy

Select Read-access geo-redundant storage

Review primary and secondary location

Information on the public website should be accessible without requiring customers to login.

In the settings section

Ensure Allow Blob anonymous access is Enabled

Save your changes

Create a blob storage container with anonymous read access
The public website has various images and documents. Create a blob storage container for the content

In your storage account, select Data storage and select Containers blade

Select "+ Container"

Name the container

Select "Create"

**
Customers should be able to view the images without being authenticated. Configure anonymous read access for the public container blobs**

Select the public container

Select change access level

Ensure public access level is Blob

Select "OK"

Practice uploading files and testing access
For testing, upload a file to the public container. The type of file doesn’t matter

Select "Upload" from the Container

Upload file

Copy URL annd paste in a new browser tab

File should display

Configure soft delete
It’s important that the website documents can be restored if they’re deleted

Go to the overview blade of the storage account

On the properties page, loacte blob service section

Select the Blob soft delete setting

Ensure the Enable soft delete for blobs is checked.

Change the Keep deleted blobs for (in days setting is 21.

Don’t forget to Save your changes.

If something gets deleted, you need to practice using soft delete to restore the files.

Navigate to your container where you uploaded a file.
Select the file you uploaded and then select Delete.

Select OK to confirm deleting the file.

On the container Overview page, toggle the slider Show deleted blobs. This toggle is to the right of the search box.
Select your deleted file, and use the ellipses on the far right, to Undelete the file.

Refresh the container and confirm the file has been restored.

Configure blob versioning

*It’s important to keep track of the different website product document versions. *

Go to the Overview blade of the storage account.

In the Properties section, locate the Blob service section.
Select the Versioning setting.

Ensure the Enable versioning for blobs checkbox is checked.

Notice your options to keep all versions or delete versions after.
Don’t forget to Save your changes.

As you have time experiment with restoring previous blob versions.
Upload another version of your container file. This overwrites your existing file.
Your previous file version is listed on Show deleted blobs page.

Prototyping different cloud storage scenarios

Yemi G — Mon, 27 May 2024 04:31:54 +0000

Create a resource group and a storage account.

In Azure portal, select Resource groups

Click "+ Create"

Name Resource group

Select Region

Select "Review + create"

Select "Create"

Create and deploy a storage account to support testing and training

In the portal, search for Storage account and select "+ Create"

Select Resource group

Name storage account

Set Performance to Standard

Select "Review and Create"

Select "Create"

Select "Go to Resource"

Configure simple settings in the storage account.

In Data Management

Select "Redundancy"

Select Locally - redundant storage in Redundancy dropdown

Click Save

Refresh page and notice the content only exist in primary location

The storage account should only accept requests from secure connections

In the Settings section

Select Configuration blade

Ensure Secure transfer required is enabled

Developers would like the storage account to use at least TLS version 1.2.

Minimal TLS version should be 1.2

Until the storage is needed again, disable requests to the storage account.

Disable "Allow storage account key access"

Save your changes

Ensure the storage account allows public access from all networks.

In Security + Networking, select "Networking"

Ensure Public Network access is Enabled from all networks

Save your changes

Setting Up Cloud Storage Accounts, Configuring File Shares, Snapshots, and Network Restrictions

Yemi G — Mon, 27 May 2024 02:59:17 +0000

Create and configure a storage account for Azure Files.

In the portal, type "Storage account" in the search field

Select "Storage account"

Select "+ Create"

Create new Resource Group, name it and click "OK"

Insert storage name

Set Performance to Premium

Set Premium account type to File shares

Set Redundancy to Zone-redundant storage

Select "Review and Create"

Select "Create"

Go to resource

Create and configure a file share with directory

In the data storage section

Select "File shares"

Select "+ File share"

Provide a name

Select "Create"

Add a directory to the file share for the finance department

Select "Add directory"

Name directory finance

Click "OK"

Select "Browse"

Select finance directory

Upload a file

Configure and test snapshots

Select "Operations"

Select "Snapshot"

Select "+ Add Snappshot"

Comment is optional, select "OK"

Return to Fileshare and Browse to view file directory

Locate uploaded file and select "delete"

Confirm deletion

Select Snapshot blade

Select your snapshot

Navigate the file you want to restore

Select "Restore"

Provide restore file name

Select "OK"

Verify your file has been restored

Configure restricting storage access to selected virtual networks.

In the search field, type "Virtual Networks" and select it

Select "+ Create"

Use the default for other parameter, give the Virtual network a name

Select "Review + Create"

Select "Create"

Select "Go to resource"

In the settings section

Select "Subnets"

Select the default subnet

In the service endpoints section

Select Microsoft.storage in the services dropdown

Click "Save"

The storage account should only be accessed from the virtual network you just created. Learn more about using private storage endpoints.

Return to the file storage account

Select "Networking" blade

In the public network access, select "Enabled from selected virtual networks and IP addresses"

In the Virtual network section, select "+ Add existing network virtual network"

Select your virtual network and subnets

Select "Add"

Save changes

Select "Storage browser"

Navigate to your file share

Verify you are not authorised to perform this operation

Setting Up Secure Cloud Storage: Restricted Access, Partner Sharing, Website Backup, and Lifecycle Management

Yemi G — Mon, 27 May 2024 01:16:16 +0000

Create a storage account and configure high availability.

In Azure Portal, search for "storage account"

Select "Storage account"

Select "Create"

*Insert Resource Group previously created name
*

*Insert Storage account name
*

Select "Redundancy" to be Geo-redundant storage (GRS)

Select "Review + Create"

Check Validation and select "Create"

Create a storage container, upload a file, and restrict access to the file.

In the storage account, select "Data storage" and select "containers"

Select "+ Container"

Name the container

Ensure access level is private

Select "Create"

Upload File to Container
Select Container

Select "Upload"

Select File and upload

Select the file and copy file URL to check if file will be accessed

Paste URL to a new tab, verify file doesn't display

An external partner requires read and write access to the file for at least the next 24 hours. Configure and test a shared access signature (SAS)

Select the uploaded blob file and click the "Generate SAS tab"

Ensure the partner has only read permission

Set start/expiry time for the next 24 hours

Select "Generate SAS token and URL"

Copy the Blob SAS URL to a new browser tab to verify accessibility, file should be accessible.

Configure storage access tiers and content replication.
Return to storage account

Notice the default access tier is set to hot

In the Data Management section

Select "Lifecycle management"

Select "Add a rule"

Add Rule name

Select Rule scope to apply rule to all blobs in your storage account

Select "Next"

Select "Last modified"

Set days

Select "Move to cool storage"

Add rule

The public website files need to be backed up to another storage account

Create a new container

Select "Create"

Navigate to another storage account, click on "Data management"

Select "Object replication"

Select "Create replication rules"

Set Destination storage account to the Private storage previously created

Set Source Container as mainpublic and Destination Container as backup

Select "Create"

How to create a Virtual Machine that is highly available.

Yemi G — Fri, 24 May 2024 03:56:38 +0000

Click on Virtual Machines from the Azure Services

Click on "Create"

Click on Azure Virtual Machine

Enter Resource Group name

Enter Virtual Machine Name

Select Availability zone, selecting more than one zone makes it highly available

Select Image

Create administrator account and enter username and password

*Select inbound ports
*

Check Licensing

In the "Monitoring" Tab

*Disable Diagnostics *

It is advised to create a load balancer when high availability is required.

Click Review + Create

Check Validation

Click "Create"

Confirm Deployment

Click on "Go to Resource"

Click on "Connect"

Select Native RDP & Click "Select"**

Ensure all configurations are ticked green and configured

Download RDP File

Further installation settings will be required and you will be able to access your virtual machine.

How to Create a Virtual Machine (Windows 11 Pro)

Yemi G — Fri, 24 May 2024 02:19:49 +0000

Login to Azure Portal

Locate the search field

In the search field, type virtual machine

Select Virtual machine from the list of options

Click "Create"

Select Azure Virtual Machine

Create a Virtual Machine

Create new Resource Group

Name Resource Group

Enter Virtual Machine Name

Select Image "Windows 11 Pro, Version 22H2..."

Authentication Type as password and enter username and password

Select inbound port rule as "RDP"

Check Licensing

Click on "Monitoring" Tab

Disable Diagnostics in Monitoring Tab

Review and Create

Validation

Click "Create"

Confirm Deployment

*Click on "Go to resource" *

Click on "Connect"

Select Native RDP & Click "Select"

Ensure all configurations are ticked green and configured

Download RDP File

Further installation settings will be required and you will be able to access your virtual machine.

Creating Azure Resource Group

Yemi G — Mon, 13 May 2024 05:55:51 +0000

Click on Resource Group

Resource Group

Click on "Create"

Create a Resource Group page

Type in Resource Group

Select "Region"

Click "Review and Create"

Validation Confirmation

Click on "Create"

Resource Group Created

Cloud Concept

Yemi G — Wed, 08 May 2024 19:38:43 +0000

Virtualisation is a technology that allows for the creation of virtual replicas of computer resources such as servers, operating systems, and applications, enabling the production of virtual instances. These virtual instances can run on a single physical server or host, maximising hardware utilisation. By separating resources from the underlying hardware, virtualisation allows multiple virtual machines to run independently on the same physical server without interfering with each other.

Scalability refers to a system's ability to handle increasing workloads by adding resources, either manually or automatically, to accommodate the additional demand. In Azure, this means scaling out to increase capacity during peak periods and returning to normal levels when the peak subsides.

Agility refers to a cloud customer's capability to quickly develop, test, and deploy applications using cloud resources. Agility enables rapid responses to critical business needs and objectives.

High availability refers to a collection of technologies that minimise IT downtime by ensuring the continuous operation of IT services through the use of redundant, fault-tolerant components within the same data enter. High availability means that services remain uninterrupted, providing consistent up-time. In everyday terms, it’s like saying, "The power won't go out," ensuring that nothing disrupts your work.

A fault-tolerant cloud infrastructure maintains uninterrupted services by seamlessly adapting to and recovering from unexpected disruptions. This essential capability underpins the development of reliable and resilient cloud solutions, ensuring continuity and minimising downtime.

Global reach allows businesses to operate globally by storing data in the region closest to their customers which ensures efficient access and a seamless user experience.

The difference between scalability and elasticity is primarily in how they address resource adjustments. Scalability handles predictable growth, while elasticity deals with real-time, automatic adjustments.