Forem: Dumka Esaenwi

Implementing Secure Access and Immutable Storage in App Development Using Role-Based Access Control and Managed Identities"

Dumka Esaenwi — Thu, 17 Oct 2024 00:59:10 +0000

Establish the managed identity and storage account.

1. Give the web app a storage account.

Look for and choose Storage accounts on the portal.**
Click + Create.
Choose Create new under Resource group. To save your changes,
choose OK after giving your resource group a name.
Give the name of your Storage account. Make that the name satisfies the naming standards and is unique.
Go to the tab for encryption.
Enable infrastructure encryption by checking the box.
Take note of the notice that once this storage account is created, it cannot be modified.
Click on Review + Create.
Await the resource's deployment. 2. Give the web application a controlled identity to utilize.
Look for Managed identities and click on it.
Choose "Create."
Decide which resource group to use.
Give a name to your managed identity.
Choose Review and then click on Create.

3. Assign the managed identity the appropriate permissions. All the identity has to do is read and list blobs and containers.

Find and choose your storage account.
Choose the blade for access control (IAM).
On the page, select Add role assignment in the center.
Look for and choose the Storage Blob Data Reader role from the list of job duties roles on the page.
Click Managed identity under Members.
Choose Select members, then choose User-assigned managed identity from the Managed identity drop-down menu.
Choose the managed identity that you established in the preceding stage.
Click Select and then Review + assign the position. To add the role assignment, select Review + assign again.

Secure access to the storage account with a key vault and key

1. To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions.

Look for and select Resource groups in the portal.
Then, select the Access Control (IAM) blade after selecting your resource group.
On the page, select Add role assignment in the center.
Locate and pick the Key Vault Administrator role from the list of job functions roles.
Choose User, group, or service principal from the Members page.
Choose a member from the list.
Locate and choose your user account. In the upper right corner of the site, you can see your user account.
After selecting, click Review + assign.
To add the role assignment, select Review + assign again.
You can now carry out the remaining tasks in the lab.

Learn more about how to provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control.

2. To keep the access keys safe, construct a key vault.

Look for and choose Key vaults in the portal.
Choose "Create."
Decide which resource group to use.
Tell us the name of the key vault. The name needs to be distinct.
Ensure Azure role-based access control (recommended) is chosen on the Access configuration tab.
Click Review + Create.
After the validation checks are finished, choose Create.
Choose Go to resource once the deployment is complete.
Make sure that Purge and Soft-delete protection are turned on for the Overview blade.

Create a customer-managed key in the key vault. In your key vault, in the Objects section, select the Keys blade. Select Generate/Import and Name the key.

Take the defaults for the rest of the parameters, and Create the key.

Configure the storage account to use the customer managed key in the key vault

Before you can complete the next steps, you must assign the Key Vault Crypto Service Encryption User role to the managed identity. Learn more about how to use a system-assigned managed identity to authorize access

In the portal, search for and select Resource groups.
Select your resource group, and then the Access Control (IAM) blade.
Select Add role assignment (center of the page). On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.
On the Members page, select Managed identity.
Select Select members, in the Managed identity drop-down select User-assigned managed identity.
Select your managed identity.
Click Select and then Review + assign.
Select Review + assign a second time to add the role assignment.

Configure the storage account to use the customer managed key in your key vault. Learn more about customer managed keys on an existing storage account.

Return to your the storage account.
In the Security + networking section, select the Encryption blade.
Select Customer-managed keys.
Select a key vault and key. Select your key vault and key.
Select to confirm your choices.
Ensure the Identity type is User-assigned.
Select an identity.
Select your managed identity then select Add.
Save your changes. If you receive an error that your identity does not have the correct permissions, wait a minute and try again.

Configure an time-based retention policy and an encryption scope.

The developers require a storage container where files can’t be modified, even by the administrator. Learn more about blob immutable storage.

Navigate to your storage account.
In the Data storage section, select the Containers blade.
Create a container called hold. Take the defaults. Be sure to Create the container.
Upload a file to the container.
In the Settings section, select the Access policy blade.
In the Immutable blob storage section, select + Add policy.
For the Policy type, select time-based retention.
Set the Retention period to 5 days. Be sure to Save your changes. Try to delete the file in the container. Verify you are notified failed to delete blobs due to policy.

The developers require an encryption scope that enables infrastructure encryption. Learn more about infrastructure encryption.

Navigate back to your storage account.
In the Security + networking blade, select Encryption.
In the Encryption scopes tab, select Add.
Give your encryption scope a name.
The Encryption type is Microsoft-managed key.
Set Infrastructure encryption to Enable.
Create the encryption scope.
Return to your storage account and create a new container.
Notice on the New container page, there is the Name and Public access level.
Notice in the Advanced section you can select the Encryption scope you created and apply it to all blobs in the container.

By following these steps, you will have successfully created a secure storage account and managed identity in Azure, enhancing the overall security and compliance of your web applications.

How to Implement a Secure and Efficient File Sharing Solution for a Geographically Dispersed Company.

Dumka Esaenwi — Sat, 28 Sep 2024 12:50:00 +0000

INTRODUCTION
In today’s globalized business environment, companies often have teams across different locations. A secure and efficient file-sharing solution is crucial for maintaining productivity and ensuring data security. This article will guide you through setting up a file-sharing solution using Azure Files, focusing on creating and configuring storage accounts, file shares, directories, snapshots, and restricting access to selected virtual networks.

Step 1: Create and configure a storage account for Azure Files.

1. Make a storage account to hold the shared files of the finance department. Find out more about Azure Files deployment storage accounts.

Look for and choose Storage accounts on the portal.
Click + Create.
Choose Create New under the Resource group. To save your changes.
choose OK after giving your resource group a name.
Give the name of your Storage account. Make sure the name satisfies the naming specifications.
Put Performance on Premium.
Select "File shares" as the Premium account type.
Select Zone-redundant storage for Redundancy.
After choosing Review, create the storage account.

Await the resource's deployment.
Click "Go to resource."

>>>Learn more about storage accounts for Azure Files deployments.

Create and configure a file share with directory.

1. Establish a Corporate Office File Share.

Choose the File shares blade located in the Data storage part of the storage account.
After choosing + File sharing, enter a Name.
Examine the alternative choices, but choose the defaults.
Choose "Create."

2. Create a Directory in the Finance Department's File Share

Choose + Add directory after selecting your file sharing.
Give the new financial directory a name.
After choosing Browse, pick the finance directory.
You can further organize your file sharing by adding a directory, as you can see.
Select and upload a file.

## Step 3: Configure and test snapshots.
1. Use snapshots to prevent unintentional file deletion.

Choose the file share that you have.
Choose the Snapshots blade located in the Operations section.
Click + Add Snapshot. It's not required to remark. Click OK.
After choosing your snapshot, make sure the uploaded file and file directory are present. 2. Practice Restoring a File Using Snapshots
Go back to the file-sharing location.
Open your file directory and browse.
Find the file you uploaded, then choose Delete from the
Properties box. To confirm the deletion, choose Yes.
Choose your snapshot by first selecting the Snapshots blade.
Locate the file that needs to be restored.
After choosing the file, choose Restore.
Give the name of the restored file.
Confirm that the recovered file is in your file directory.

Step 4: Configure restricting storage access to selected virtual networks.

1. Using Subnet, Create a Virtual Network

Locate and choose virtual networks.
Choose "Create." Name the virtual network and choose your resource group.
Accept the other parameters as they are, choose Review + Create, and finally click Create.
After allowing the resource to deploy, choose Go to resource.
Choose the Subnets blade located in the Settings section.
Choose the subnet that is defaulted.
Select Microsoft under the Service endpoints section.The Services drop-down menu's storage.
Don't alter anything else.
Remember to save your modifications.

2. Limit Your Storage Account Getting into the Virtual Network

Go back to the file storage account you used.
Choose the Networking blade located in the Security + networking section.
Modify the Public network access from specific virtual networks and IP addresses to Enabled.
Choose Add existing virtual network under Virtual networks.
After choosing your subnet and virtual network, click Add. Remember to save your modifications.
Choose the Storage browser and open your file sharing location.
Check that you are not permitted to carry out this action. The virtual network is not where you are connected from.

You can ensure that your data is safe and only available to authorized individuals by implementing a secure and effective file sharing solution for your geographically distributed firm by following these steps. This configuration makes use of Azure Files to offer a reliable and scalable solution catered to your company's requirements.

Implementing Secure and Highly Available Storage Solutions for Company Data and Website Backup

Dumka Esaenwi — Thu, 26 Sep 2024 13:09:04 +0000

INTRODUCTION

A vital component of any company's digital infrastructure is data storage, particularly for the safekeeping, high availability, and backup of sensitive information and website content. This article will walk you through the process of utilizing cloud-based technology to build up a backup solution for a company's public website and a highly accessible and secure storage solution for internal corporate data.

The intention is to guarantee that firm data is accessible, backed up, and securely stored—even in the event of regional outages. Additionally, we'll put security measures in place including limiting access and managing file upload permissions. Your company can safeguard important resources and guarantee continuity in the event of an interruption by adhering to this guidance.

Create a storage account and configure high-availability

Step 1: Setting Up an Internal Private Document Storage Account
First things first: open a cloud storage account. This account will be the main location for internal corporate documents.

1. Establish a Storage Account:

Go to the portal, type "Storage accounts" into the search field, and click on it.

To add a new storage account, click the + Create button.

Either form a new resource group or choose an already-existing one from a prior lab.
Make sure the name you enter for your storage account is globally unique. Put a label on it, such as "private," to set it apart from other accounts.
After examining the parameters, click Review and then click Create. The process of deployment will start.

Click Go to resource to open the storage account after it has been installed.

2. Set up High Availability:

You will install Geo-Redundant Storage (GRS) because this storage account needs to be accessible even in the event of a regional outage, without necessitating read access in a backup area.
Proceed to the Redundancy blade located in the Data management section.
Make sure you use Geo-Redundant Storage (GRS), which duplicates data to a different location to guarantee high availability. Check the primary and secondary location details by refreshing the page.
To validate your redundancy settings, save your modifications.

Create a storage container, upload a file, and restrict access to the file.

1. Establish a private data storage container for the company.

Choose the Container blade located in the Data storage portion of the storage account. Choose + Container.
Make sure the container's name is private. Achieve Private access for the Public (no anonymous access). As you have time, study the Advanced settings, but take the defaults.
Choose "Create."

2. Upload a file to the private container for testing. The kind of file is irrelevant. A tiny picture or text document is a wise option. Verify that the file cannot be accessed by the general public.

Choose the receptacle.
Click on Upload.
Choose a file by browsing the files.
Transfer the file online.
Choose the file that was uploaded.
Copy the URL from the Overview tab.

Open a new browser tab and paste the URL there. Make sure an error message appears and the file doesn't display.

3. For the next 24 hours at least, an external partner needs to be able to read and write to the file. Establish a shared access signature and test it (SAS).
>>>>>Click here to Learn more about Shared Access Signatures.

Choose the blob file you uploaded, then select the Generate SAS tab.

Make sure the partner only has Read access in the access drop-down.
Confirm that the Start and expiry date/time pertain to the upcoming 24 hours.
Choose Generate URL and SAS token.

Open a new browser tab and copy the Blob SAS URL.
Make sure you have access to the file. An image file that you have uploaded will show up in the browser. There will be downloads of other file kinds.

Configure storage access tiers and content replication.

1. To save on costs, after 30 days, move blobs from the hot tier to the cool tier.

Here you can learn more about how to manage the Azure Blob storage lifecycle.

Return to the storage account.
In the Overview section, notice the Default access tier is set to Hot.

In the Data management section, select the Lifecycle management blade.
Select Add rule.
Set the Rule name to movetocool.
Set the Rule scope to Apply rule to all blobs in the storage account.
Select Next.
Ensure Last modified is selected.
Set More than (days ago) to 30.
In the Then drop-down select Move to cool storage.
As you have time, review other lifecycle options in the drop-down. Add the rule.

2. It's necessary to backup the files for the public website to an alternate storage account.
>>>>> Check out more resources to Study up on object replication.

Make sure to establish a new container named backup in your storage account. Make use of the default settings. If you require more specific instructions, go back to Lab 02a.

Access your publicwebsite storage account by navigating. The previous exercise generated this storage account.
Choose the Blade for object replication under the Data management section.
Click on Generate Replication Rules.
A private storage account should be selected as the destination storage account.
Assign the destination container to backup and the source container to public.
Make the replication rule.
Upload a file to the public container if you have the time. Go back to the account for private storage and update the backup container.

Creating a Highly Available Storage Account In Azure for a Public Website.

Dumka Esaenwi — Thu, 19 Sep 2024 14:59:26 +0000

INTRODUCTION

A dependable and well-navigated public website is essential for any organization in today's digital environment. Azure Storage provides reliable solutions to guarantee that the content on your website is accessible even during local outages. This post will walk you through setting up a highly accessible storage account for your public website with features like versioning, geo-redundancy, anonymous access, and soft delete.

In my previous article, I discussed storage accounts and resource groups, which are key in today's cloud world. You can find time to read them as well.

Let's quickly delve into the steps you can take to Create a Highly Available Storage Account In Azure for a Public Website.

## Step 1 - Configuring Your Storage Account

Go to the Azure interface and search for "Storage accounts" to get started.
Press "+ Create" to initiate the process of creation. Either choose an existing resource group or create a new one.

Give your storage account the name "publicwebsite"; if necessary, include a unique identification.
Select "Review" and then "Create" after leaving the other settings just the way they are.
After the deployment is finished, navigate to the resource.

Step 2 - Ensure High Availability
To provide read access from a secondary region and safeguard against regional outages:

Locate the "Redundancy" blade under "Data management" in your storage account.
Choose "Read-access Geo-redundant storage (RA-GRS)". Make note of the location data, both primary and secondary.

Step 3 - Setting Up Public Access
For the content on your website to be available to the public:

Turn on "Allow blob anonymous access" in the "Settings" blade of the "Configuration" blade. Remember to save your modifications.

Creating a public container for blob storage with anonymous read access.

Go to "Data storage" and then "Containers" blade.
Tap "+ Container" and give it the "public" name.

Click "Change access level" after selecting the container that has been created.
Change the "Public access level" to the "Blob (anonymous read access for blobs only)".

Try uploading files and testing access.
Put a test file into the container marked as "public".

From the Overview tab, select the uploaded file and copy its URL.
To confirm public access, paste the URL into a new tab in your browser.

Soft Delete Implementation

To prevent unintentional deletes:

Navigate to the Overview blade for the storage account. Locate the "Blob soft delete" configuration in the "Blob service" menu.
Set the retention period to 21 days and enable soft delete for blobs.
Keep your edits saved

You should get comfortable utilizing soft delete to recover files if something gets erased.

Go to the container where the file you submitted is located.
After choosing the file you uploaded, choose Delete.
To confirm deleting the file, select OK.

Slider Show deleted blobs should be toggled on the container Overview page. The search box is located to the right of this toggle.
To undelete a deleted file, select it and utilize the ellipses on the far right.

Verify that the file has been restored by refreshing the container.

Blob Versioning Configuration

To keep several iterations of the papers on your website up to date:
Locate the "Versioning" setting under "Blob service" in the Overview blade of the storage account.

Turn on blob versioning.
Select if you want to save every version or remove it after a predetermined amount of time.
Save the modifications you made.

You've successfully set up a highly accessible storage account for your public website by following these steps. This configuration protects your content from unintentional deletions and unauthorized alterations, permits public access, and guarantees that it is available during regional outages. To make sure you can recover fast in an emergency, don't forget to test your versioning and restore procedures regularly.

Learn How To Create Resouce Groups And Cloud Storage Accounts on Microsoft Azure.

Dumka Esaenwi — Wed, 18 Sep 2024 21:37:10 +0000

Introduction

In this article, I will guide you step-by-step on how to create resource groups and cloud storage accounts.

Microsoft Azure offers a wide array of services to help organizations manage their IT infrastructure. Among these, Storage Accounts and Resource Groups are fundamental components. Grasping these elements is crucial for effectively organizing and managing your Azure resources.

Resource Groups
In Azure, a resource group is a container for linked resources used in an Azure solution. Virtual computers, databases, and storage accounts are a few examples of these resources. Managing and organizing resources that have a shared lifecycle is a resource group's main goal.

Storage Accounts
Azure Storage Accounts give your data its namespace. It is a key component of Azure data storage and works with blobs, files, queues, tables, and other forms of data storage. Here are some essential details regarding storage accounts.

Steps to creating a resource group and a storage account.

Step 1
Log in to your Azure account, search for "Resource groups" then click on it.

Step 2
Click the "+ Create" button.

Step 3
Give your resource group a name. How about "storagedumka"
Pick a region. This is crucial - it's like choosing where to build your house. Stick with this region throughout your project.

Step 4
Hit "Review and create" to make sure everything's in order.
Finally, click "Create" and watch your resource group come to life!

>>>>>> You can learn more by reading other materials on resource groups.

Steps to creating your Storage Account

Step 1
In the Azure portal, search for "Storage accounts". It's like looking for a closet to store your stuff.

Step 2

-Click "+ Create" to start building your storage space.
-Select the resource group you just created. This is similar to choosing which room to put your closet in.

Step 3
-Name your storage account. Note that it needs to be unique in all of Azure, it's more like picking a username that no one else has!

Set the Performance to Standard. Think of it as choosing a regular closet instead of a fancy walk-in.

*Step 4 *

Hit the review + create Tab, and afterward hit "Create". Your storage account is on its way!

Step 5

Go to resource, after the storage account has been redeployed.

>>>>>>Check out for more resources on storage accounts here!

Configuration of simple settings in the storage account.

Step 1

Navigate to the Redundancy settings in the Data Management section, We're going for a cost-effective solution. "Locally-redundant storage (LRS)". It's like keeping just one copy of your house key instead of giving spares to all your neighbors.

>>>>>Learn more about storage account redundancy.

*Step 2 *

In the Configuration settings, Ensure "Secure transfer required" is Enabled. It's like insisting on a secret handshake before anyone can access your stuff.
Set the Minimal TLS version to 1.2. Think of it as upgrading the locks on your doors to the latest model.
For now, let's disable storage account key access. It's like temporarily changing the locks while you're away on vacation.
_

Step 3
In the Networking settings, set Public network access to "Enabled from all networks". _It's like putting your storage on a hill where everyone can see it.

These steps will help you build an Azure resource group and storage account, which will serve as the basis for your cloud-based projects.

Understanding Core Concepts in Cloud Computing

Dumka Esaenwi — Fri, 13 Sep 2024 13:22:16 +0000

Cloud Computing
Cloud computing has completely changed the way businesses run with its ability to provide on-demand internet access to computing resources and services, To appreciate the possibilities of cloud computing fully, it is necessary to comprehend a few basic ideas. We'll dissect important ideas in this post, such as virtualization, scalability, high availability, fault tolerance, agility, and the distinction between elasticity and scalability.

1. Virtualization

virtualization is one of the key technologies behind cloud computing. It entails building virtual representations of real hardware resources including networks, servers, and storage units. This is made possible via a software layer known as a hypervisor, which enables the operation of several virtual machines (VMs) on a single physical server. Each virtual machine (VM) can use different operating systems and apps, which run autonomously. Virtualization enhances hardware usage, lowers expenses, and offers resource management flexibility.

2. Scalability: Growing with Your Needs

Scalability is the capacity of a system to accommodate growing workloads by increasing resources. This implies that using cloud computing can quickly scale up or down your processing power in response to changing requirements.
There are two Categories of scalability which includes;

Vertical scaling: Increasing an existing server's capacity (CPU, RAM)
Horizontal scaling: Adding extra servers to your network.

Both are strengths of cloud systems, which enable companies to easily adjust to shifting needs without having to make substantial upfront hardware investments.

3. Agility: Responding Rapidly to Change

Cloud computing gives enterprises a level of agility never seen before. Organizations may now more easily than ever allocate resources, create and implement apps, and react to changes in the market.
This flexibility is a result of self-service features, a large range of easily accessible tools and services, and the on-demand nature of cloud services. Compared to conventional IT infrastructure, businesses may experiment, create, and launch products far more quickly.

4. High Availability: Keeping Your Services Running

One essential component of cloud computing is high availability, which guarantees that systems remain up and running with little to no downtime. Cloud providers use failover and redundancy techniques to accomplish this.
Cloud services can continue operating even in the event of a component failure because they use load-balancing techniques and distribute data and applications across numerous data centers. For cloud-based apps, this leads to better user experience and dependability.

5. Fault Tolerance: Withstanding Failures

Fault tolerance, which is closely linked to high availability, is a system's capacity to keep working even in the case of a component failure. This is accomplished in cloud computing via intelligent system design and redundancy.
Cloud providers employ multiple tactics, including automatic failover, backup systems, and data replication, to guarantee service availability in the event of hardware or software malfunctions.

6. Global Reach: Accessing Resources Anywhere
The worldwide reach of cloud computing is one of its most potent features. With the global data centers of major cloud providers, organizations can store and deliver data closer to their users, no matter where they are in the world.
Customers throughout the world may enjoy better user experiences, lower latency, and faster content delivery thanks to our global infrastructure. Additionally, it makes it easier to comply with national regulations on data residency.

Elasticity vs. Scalability: Understanding the Difference
Although they are sometimes used synonymously, elasticity and scalability are two different ideas in cloud computing:
Scalability is the capacity to add resources to the system either horizontally (scaling out) or vertically (scaling up) in order to accommodate increasing demands.
The capacity to automatically scale resources up or down in response to demand is known as elasticity. It involves real-time resource matching to workload performance.
Elasticity is more automated and dynamic, which makes it possible to use resources more effectively and optimize costs. Although it is a prerequisite for elasticity, scalability does not always mean that resources will be automatically adjusted.

In summary
Gaining a solid basis for efficiently utilizing cloud computing requires an understanding of several essential concepts: virtualization; scalability; agility; high availability; fault tolerance; global reach; and the distinction between elasticity and scalability. Businesses may fully utilize the cloud and improve their operational effectiveness, responsiveness, and global presence by grasping these concepts. These ideas will guide and improve your cloud computing approach, regardless of your level of experience with technology.