Azure Virtual Machine – Best Practices

Provisioning a VM in Azure involves more components than  the VM itself. With adaptation of ARM Azure has decomposed the VM into set of services.There are compute, networking, storage and other peripheral elements. While provisioning the VM (either from Portal or Template) We should always consider these services as individuals and then provide their references where needed. For example Create the VNet and appropriate subnets and while  creating the VM provide  Subnet as reference.That way  it becomes easy to manage and change things on demand ex- You can detach & attach NIC cards  if in case your communication model changes.

Here is high level decomposition of services which constitute a Virtual Machine in Azure-

• Resource Group- A Resource group work as container for set of resources who shares same life cycle and management policies.As stated before VM is actually combination of multiple service glued togather, we do need Resource Group to hold them in one basket.

• Virtual Network-With ARM way of deployment each VM has to be deployed inside a Virtual Network to provide isolation/control on provisioned infrastructure.Once VNet in place we have to divide this further into subnet (VLAN concept in data center) and that is where individual VM will be provisioned.in nutshell it help you defines internal addressing.

• Virtual Machine- For IaaS VM has been primary construct. Now when you are migrating the VM from onprem, you can directly convert the machines into VHD's( Azure supports only VHD, support for VHDX is not yet facilitated).To achieve this we can make use of waagent( if your workload is Linux based)or sysprep ( on Windows front) . Once thats in-place we should port them to Azure storage.While provisioning the VM reference those VHD files from blob storage. On other hand if you are creating a fresh VM you can choose the same from the list of published images on azure gallery.

• OS Disk- It's VHD file backed by Azure storage to provide persistence operating disk for Azure VM's. Because of it's persistence it's immune from host machine going down.

• Temporary disk- This is ephemeral storage given to you free of cost by Azure.Any VM when gets created will always come with temporary disk (the D: drive on Windows). This disk is stored on a physical drive on the host machine. Because it's not backed by Azure storage it's tagged with Machines life cycle events.There is high chance of losing the data even during the reboot of VM. That limits the use of this storage only for the data which is temporary in nature.

• Data Disks- Just like OS disk this also gets stored on Azure storage as Page Blob. In contrast to temporary Disk this provides persistent storage for  application data. 

• Public IP - When provisioned, VM will get a private IP from the list of available ips in specified subnet. But that cant be used for public communication like RDP till you have VPN connectivity in place.To facilitate the same you can create one Public IP and associate that with aforementioned VM.

• NIC- NIC's(Network Interface Cards) are essential for any Virtual Machine being provisioned in Azure. It encapsulates all the network and communication related informations. With ARM you can associate multiple NIC's on given VM( selected tier has to support that).Given the circumstances you can detach the NIC from one VM and attach the same to another.

• NSG- NSG (Network Security Groups) are used to control the flow of traffic in and out of your VM. It's an extension to ACL's(Access Control Lists) which were used uding the classic model. Under this you can control the traffic(allow/deny) at different level, it presents the opportunity to get associated with subnet ,NIC or both. It's bi-directional in nature which means you can control ingress and egress both the traffic.

• Diagnostics- Diagnostic logging provides you appropriate logs which could latter be used for troubleshooting purpose.

Having discussed the major components, let's dive deep into some of the Best Practices-

1.Use Azure Managed Disks With VMs

When you choose this you don’t have to worry about placing the disks across multiple storage accounts in order to ensure you stay within the scalability limits for the storage accounts.Now it's Azure responsibility to do this management for you. - Azure handles that for you.Earlier to improve IOPS(input output operations per second) you have the responsibility to place each data disks into single storage account.Moreover it provides additional benefits like-Support for Azure backUp Service,simple and scalable VM deployment along with granular access control 

2.Preventing Charges For Azure VM When Not In Use

One thing about Azure worth considering is that it makes distinction between "stopped" and "deallocated" states of the VM. You are charged when the VM status is stopped, but not when the VM is deallocated.

If you are operating from Azure Portal, press of Stop button will always deallocates the VM. However, if you are shutting it down through the OS while logged in, the VM goes into stopped mode , while in stopped mode VM's will still be charged.

Same holds true in case of deletion - When you delete delete a VM, the VHDs that are associated with this will not automatically get deleted. That means you can safely delete the VM without losing data. However, you will still be charged for storage. To avoide unnecessary incur you have got to delete the file from blob storage.

Best Practices for Creating Azure Resource Manager Templates -Part II

This post is second part of the series : Best Practices for Creating ARM Template, If you haven't already seen please go ahead and check the First part- Best Practices For Creating ARM template

11. Use ARM Template expression function such as trim(), toLower() as a data cleaning measure to ensure input consistency

12. ARM Termination Protection-For Critical Resource always implement Resource Lock

For resources where you have to constrain the ability to commit write actions and protect against accidental deletions, Azure Resource Lock can be a way to go.Check more on how to implement Resource Lock-

{
  "type": "extensions",
  "name": "Microsoft.EnterpriseCloud.Monitoring",
  "apiVersion": "[variables('apiVersion')]",
  "location": "[resourceGroup().location]",
  "dependsOn": [
    "[concat('Microsoft.Compute/virtualMachines/', variables('vmName'))]"
  ],
  "properties": {
    "publisher": "Microsoft.EnterpriseCloud.Monitoring",
    "type": "MicrosoftMonitoringAgent",
    "typeHandlerVersion": "1.0",
    "autoUpgradeMinorVersion": true,
    "settings": {
      "workspaceId": "[parameters('workspaceId')]"
    },
    "protectedSettings": {
      "workspaceKey": "[parameters('workspaceKey')]"
    }
  }
}

13. EnableLog Analytics To Azure VM's- Use OMS

If you are using VMs in Azure you should always opt for some monitoring and analyzing capabilities for them.OMS offers log analytic capabilities that enable you to collect and analyze machine data from virtually any source.Using data generated across devices, operating systems, workloads and user actions, OMS provides instant access to critical information through one integrated console. You can troubleshoot across multiple data sources and easily identify the root cause of operational and security issue.

Log Analytics (OMS) supports a majority of Windows and Linux variations available in Azure today,and because it's been pitched as IT management solution for the hybrid cloud you can manage any instance in any cloud, including on-premises, Azure, AWS, Windows Server, Linux, VMware, and OpenStack

{

  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",

  "contentVersion": "1.0.0.0",

  "parameters": {

    "lockedResource": {

      "type": "string"

    }

  },


  "resources": [

    {

      "name": "[concat(parameters('lockedResource'), '/Microsoft.Authorization/utLock')]",

      "type": "Microsoft.Storage/storageAccounts/providers/locks",

      "apiVersion": "2015-01-01",

      "properties": {

        "level": "CannotDelete"

      }

    }
  ]
} 

The OMS Workspace ID and OMS Workspace Key are required to onboard the OMS Service and can be found in the OMS Portal under Settings > Connected Sources

14. Tag the resources properly

Tagging provides you the ability to include metadata about your resource.Common use cases are to include references to environment types, team or division , individuals accountable.It provides subscription wide taxonomy The benefit of tags is that they can be pulled together in billing roll up or within a summary view.

"tags": { "
   "ProjectName": "[parameters(projectName)]",
   "EnvironmentType" :"[parameters('environmentType')]"
} ,

15. Have the habit for pre-deployment validation

Azure Resource Manager as it stand today has two-part validation: before and during deployment. The before deployment checks whether a template is syntactically correct and that it would be accepted by the Azure Resource Manager. Then the during deployment validation (runtime) checks for resource dependencies within your Azure subscription. The templates may seem valid, but until they are deployed as there is no fool-proof way to guarantee that it is a working template. However, as a good practice when deploying templates, make pre-deployment validation a habit as it will catch most obvious errors detected by Azure Resource Manager.

16. Don't Pass your Passwords as Plain-text:Use Azure key Vault With ARM Template

With template-based deployments that include passwords stored in parameter files (or other insecure stores), there is always the risk of leaking the password should someone access the particular file.

As an It guy we should always took to lock down environments so that only the right groups of users can login and modify the configurations.

Once you have stored your passwords as a Secret in a Key Vault, its ready to be accessed via ARM Template.

The way you can supply Key Vault Secrets to ARM templates is via use of parameters file.

"osProfile": {
    "computername": "[variables('vmName')]",
    "adminUsername": "[parameters('adminUsername')]",
    "adminPassword": "[parameters('adminPassword')]"
}

We can feed in the Secret we pushed to our Key Vault using the below snippet in our parameters file.

"adminPassword": {
     "reference": {
        "keyVault": {
   "id": "/subscriptions/{subscription-guid}/resourceGroups/{keyvault-rg}/providers/Microsoft.KeyVault/vaults/ProvisioningVault"
        },
        "secretName": "LocalAdminPass"
      }
  }

 Separation of Keys from Deployments
A best practice is to maintain separate ARM templates for-

Creation of vaults (which will contain the key material) 
Deployment of the VMs (with URI references to the keys contained in the vaults)

17. Include the Output Section
Whenever possible return some output to validate the Deployment.With Outputs section, users can specify values that are returned from deployment.For example,  you could return the URI to access a deployed resource.

"outputs":{
  "siteUri" : {
"type" : "string",
"value": "[concat('http://',reference(resourceId('Microsoft.Web/sites', parameters('siteName'))).hostNames[0])]"
   }
}

18. Use Audit Logs For Deployment Operations

Audit logs would be your first place for troubleshoot because it contains all write operations (PUT, POST, DELETE) performed on your resources.
It also helps you determine who made what changes to the subscription(s) and related Azure resources.In Future these logs can be processed for audit compliance purpose as well.

19. Disable Windows Automatic Updates  

To disable windows updates at provisioning time it self, you have to disable the same under "windowsConfiguration" Setting.This particular section comes under osProfile -

 "osProfile": {
          "computerName": "[variables('vmName')]",
          "adminUsername": "[parameters('adminUsername')]",
          "adminPassword": "[parameters('adminPassword')]",
          "windowsConfiguration": {
            "enableAutomaticUpdates": false
           }
          },

P.S.:IT's been written with - Azure Compute Provider schema version - 2015-08-01

20. Template Formatting 

• Pass your template through a JSON validator to remove extraneous commas, parenthesis, brackets that may cause an error during deployment. Try JSONlint or a linter package for your favorite editing environment (Visual Studio Code, Atom, Sublime Text, Visual Studio, etc.)
• Format your JSON for better readability. You can use a JSON formatter package for your local editor. In Visual Studio, format the document with Ctrl+K, Ctrl+D. In VS Code, use Alt+Shift+F. If your local editor doesn't format the document, you can use an online formatter.

ARM TEMPLATES KNOWN LIMITATIONS-

1. ARM Template file size can't exceed beyond 1 mb 
2. ARM Parameter Template file Size can't exceed beyong 64 kb 
3. If parameter name value contains "." character, the arm template deployment will fail in azure portal(bug).EG-My.Database 
4. Variables doesn't support ARM template expression function such as "reference()"

Related Articles : Best Practice For Creating ARM Template

Part 1: Best Practices For Creating ARM template

Part 2: Best Practices For Creating ARM template

Best Practices for Creating Azure Resource Manager Templates- Part I

Azure Resource Manager (ARM) is the new set of APIs for deploying and managing Microsoft Azure services, From Microsoft point of view they are terming this as revolutionized way of resource management.

AWS has had this capability for quite sometimes, they have named it as CloudFormation. While ARM Templates and CloudFormation are quite identical in their behavior and are trying to achieve similar goals, under the hood there are some basic differences which is beyond the context of this article.

Though Microsoft has got a large repository of ARM Quick Start Templates which is accessible here... yet being a new service overall documentation of ARM is still evolving. At times it's difficult to find samples sufficing your custom requirements, if you are caught into that space there are few tips which definitely would help you.Under this article i will outline few important considerations while authoring your own ARM Template-

1. Best Authoring Tool For ARM Template :Visual Studio 2015

The ability to author and manage ARM Templates within Visual Studio 2015 is contained within the “Azure Resource Group” project template. This integration of ARM template and VS2015 has given developers a sense of belonging towards solution-oriented templates. Here with this they can visualize the resources and parameters using JSON outline. With Visual Studio you can add resources easily, make great inbuilt IntelliSense and validation of Visual Studio JSON editor. It also offers support for wizard based deployment, as part of best practices you can integrate your artifacts and deployment templates with source control.

2. A tool for assistance:Azure Resource Explorer

This is an essential tool for anybody writing ARM templates. It can be a great way to understand the resource hierarchy and find where to put configuration. You can deploy a resource using the portal and use the resource explorer to see the JSON schema for the resource you just created you can make a change in the Portal and then find the corresponding entries in Resource Explorer and include it to your template! That way it can help you figure out the settings for your templates. https://resources.azure.com/

3. Version your Azure Resource Manager Templates

ContentVersion is a required element of ARM Template structure. This specifies Version of the template (such as 1.0.0.0). You can provide any value for this element. When deploying resources using the template, this value can be used to make sure that the right template is being used. Another benefit is it makes template artifact-able with version control.

{

  "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",

   "contentVersion": "",

   "parameters": {  },

   "variables": {  },

   "resources": [  ],

   "outputs": {  }

}

4. Use Latest version of the resource provider API

{

   "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",

   "contentVersion": "",

   "parameters": {  },

   "variables": {  },

   "resources": [  ],

   "outputs": {  }

}

Location of the JSON schema file that describes the version of the template language. This will pull in the proper version of all the child schemas. to get the latest Api Version for the resource providers you’re going to use keep checking this 

Always try to use the updated Schema. But in general you should be able to stick with the top level schema.

5. Use Input Parameters

Under this section specify values you can input while deploying the resources. These parameter values enable you to customize the deployment by providing values that are tailored for a particular environment, Site Name , Region etc.. To our benefit this makes the While template configurable and maintainable.

"parameters": {
   "siteName": {
      "type": "string",
      "minLength": 2,
      "maxLength": 60
   },
   "siteLocation": {
      "type": "string",
      "minLength": 2
   },
   "hostingPlanName": {
      "type": "string"
   },  
   "hostingPlanSku": {
      "type": "string",
      "allowedValues": [
        "Free",
        "Shared",
        "Basic",
        "Standard",
        "Premium"
      ],
      "defaultValue": "Free"
   },
   "instancesCount": {
      "type": "int",
      "maxValue": 10
   }
   
}

For region Mapping always go with Drop-down,that can be achieved by specifying values in allowed value section..   

6. Work With Variables

Variables in ARM template can be used to simplify the template.Under this section we construct values that can be used throughout our template. Cases where same thing (ie Connection String) has to used multiple places it's not worthy repeating the same string again & again.Any sort of human errors will result in failure during the deployment. Instead, we can assign these things as a value to a variable and refer that variable within the template as needed. Also, variables in ARM template language will let us expand or construct other variable values.

"variables": {
   "connectionString": "[concat('Name=', parameters('username'), ';Password=', parameters('password'))]"
}

7. Decompose The Larger Deployment– Using Linked Templates

As part of ARM Template best practice considerations It's recommended to separate your template into multiple templates,if applicable, into multiple target-specific templates. Think of this as creating re-usable code. You can leverage the re-usable parts of your code within multiple aspects of your application or the deployment.

Template linking enables you to link to and execute another template,It enables you to decompose your deployment into a set of targeted, purpose-specific templates. Just as with decomposing an application into a number of code classes, decomposition provides benefits in terms of testing, re-use, and readability.

You create a link between two templates by adding a deployment resource within the main template that points to the linked template. You set the templateLink property to the URI of the linked template.

"resources": [ 
  { 
     "apiVersion": "2015-01-01", 
     "name": "nestedTemplate", 
     "type": "Microsoft.Resources/deployments", 
     "properties": { 
       "mode": "incremental", 
       "templateLink": {
          "uri": "https://www.contoso.com/AzureTemplates/newStorageAccount.json",
          "contentVersion": "1.0.0.0"
       }, 
       "parameters": { 
          "StorageAccountName":{"value": "[parameters('StorageAccountName')]"} 
       } 
     } 
  } 
] 

It's also takes care of any limit imposed by Microsoft from Template size prospective...

8. Deploying multiple instances of resources: Use copy Object

you’ll want to deploy multiple instances of a given resource,For example- multiple web servers or your Hadoop cluster might have multiple data nodes.Within the resource to create the same multiple times, you can define a copy object that specifies the number of times to iterate.You can use the copyIndex() function in a template to provide details about the current index of the loop being executed(Current Iteration).

"parameters": { 
  "count": { 
    "type": "int", 
    "defaultValue": 3 
  } 
}, 
"resources": [ 
  { 
      "name": "[concat('examplecopy-', copyIndex())]", 
      "type": "Microsoft.Web/sites", 
      "location": "East US", 
      "apiVersion": "2015-08-01",
      "copy": { 
         "name": "websitescopy", 
         "count": "[parameters('count')]" 
      }, 
      "properties": {
          "serverFarmId": "hostingPlanName"
      }
  } 
]

9. Defining Resource Dependencies:Use DependsOn

For a given resource, there can be other resources that must exist before the resource is deployed. For an Example- Say for a given VM, you may be dependent on having a database resource successfully provisioned.You define this relationship by marking one resource as dependent on the other resource. You can define dependencies on other resources using dependsOn and resources property of a resource. A dependency can also be specified using the reference function.

{
  "type": "Microsoft.Compute/virtualMachineScaleSets",
  "name": "[variables('namingInfix')]",
  "location": "[variables('location')]",
  "apiVersion": "2016-03-30",
  "tags": {
    "displayName": "VMScaleSet"
  },
  "dependsOn": [
    "storageLoop",
    "[concat('Microsoft.Network/loadBalancers/', variables('loadBalancerName'))]",
    "[concat('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]"
  ],
  ...
}

Above example shows a virtual machine scale set that is dependent on a load balancer, virtual network, and a loop that creates multiple storage accounts.

10. Define Api Versions for different Resource Providers as variables instead of parameters, Much easier to find and replace.

Related Articles : Best Practice For Creating ARM Template

Part 1: Best Practices For Creating ARM template

Part 2: Best Practices For Creating ARM template

Azure Resource Lock: Safeguard Your Critical Resources

Prevention is better than Cure – There were quite a few instances when I thought I should have applied this logic. This has even more significance if you are playing around public cloud more so while dealing with mission critical resources there. There must have been numerous occasions when you would have to protect you resources from some unwarranted human actions, to put it bluntly we are seeking a solution prevent other users in organization from accidentally deleting or modifying critical resources.

Azure has given us couple of ways to apply that level of control, firstly with role-based access control (RBAC), With the Reader and various Contributor roles RBAC is a great way to help protect resources in Azure. You can effectively limit the actions that a user can take against a resource. However, even with one of the Contributor roles, it is still possible to delete specific resources. This makes it very easy to accidently delete an item. 

Azure Lock provides you the options using which you can effetely control any such adventure. Unlike RBACK, you use management locks to apply a restriction across all users and roles. To learn about setting permissions for users and roles, see Azure Role-based Access Control. Using Resource lock you can lock a particular subscription, a particular resource group or even a specific resource. With this in place authorize users can still be able to read or modify the resources but they CAN NOT breach that lock and delete the same.

To make this happen you have to apply the Resource Lock Level to aforementioned scopes. You can set the lock level to CanNotDelete or ReadOnly(As of now these two are the only options supported). CanNotDelete means authorized users can still read and modify a resource, but they can't delete it. ReadOnly means authorized users can only read from a resource, but they can't modify or delete it.

When you apply a lock at a parent scope, all child resources inherit the same lock.

One point worth mentioning here is that you will also need to be in either an Owner or User Access Administrator role for the desired scope, because to play with Resource Lock it’s prerequisite to have access to Microsoft.Authorization/* or Microsoft.Authorization/locks/* actions(only these two have appropriate permissions).

Create Resource Lock Using ARM Template

With Azure Resource Manager template we can lock the resources at the time of its creation. An ARM template is a JSON-formatted template file which provide a declarative way to define the deployment of Azure resources. 

Here is the example of how to create a lock on particular Storage Account-

{

  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",

  "contentVersion": "1.0.0.0",

  "parameters": {

    "lockedResource": {

      "type": "string"

    }

  },

  "resources": [

    {

      "name": "[concat(parameters('lockedResource'),
'/Microsoft.Authorization/utLock')]",

      "type": "Microsoft.Storage/storageAccounts/providers/locks",

      "apiVersion": "2015-01-01",

      "properties": {

        "level": "CannotDelete"

      }

    }

  ]

}

If you see the example clearly the name of storage account coming via parameter while the most important section to be noticed is how the lock (utLock) has been created by concatenating the resource name with /Microsoft.Authorization/ and the name of the lock.

Create Resource Lock using PowerShell

Placing a resource lock on an entire group could be helpful in situations where you want to ensure no resources in that group are deleted. With below example I have tried to create a resource lock on a particular resource Group” UT-RG”

New-AzureResourceLock -LockLevel CanNotDelete `
 -LockNotes 'No deleting!' `
 -LockName 'utLock' `
 -ResourceGroup 'UT-RG' -Verbose

To remove the resource Lock make use of Remove-AzureResourceLock cmdlet, make sure you are providing proper ResourceId.

> Remove-AzureResourceLock -ResourceId '/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/UT-RG/providers/Microsoft.Storage/storageAccounts/utsrt/providers/Microsoft.Authorization/locks/utLock'
#Deleting Resource Group 
Remove-AzureresourceGroup -Name 'UT-RG' -Force -Verbose

Off late Azure has brought this support to ARM Portal as well, to achieve the similar things via portal click the Settings blade for the resource, resource group, or subscription that you wish to lock, select Locks.Once prompted Give the lock a name and lock level and you are immune to those talked about unwanted situations.It gives you options to lock an entire subscription to ReadOnly if malicious activity was detected.