Forem: Blessing

Steps On Developing And Designing A New App For A Company.

Blessing — Fri, 04 Oct 2024 09:08:22 +0000

The company is designing and developing a new app. Developers need to ensure the storage is only accessed using keys and managed identities. The developers would like to use role-based access control. To help with testing, protected immutable storage is needed.

In this article, we are going to

Create the storage account and managed identity.
Secure access to the storage account with a key vault and key.
Configure the storage account to use the customer managed key in the key vault
Configure an time-based retention policy and an encryption scope.

Create the storage account and managed identity

Step 1

Provide a storage account for the web app
In the portal, search for and select Storage accounts.
Select + Create.

For Resource group select Create new. Give your resource group a name and select OK to save your changes.
Provide a Storage account name. Ensure the name is unique and meets the naming requirements.

Move to the Encryption tab.
Check the box for Enable infrastructure encryption.
Notice the warning, This option cannot be changed after this storage account is created.
Select Review + Create.
Wait for the resource to deploy.

Provide a managed identity for the web app to use.

step 2

Search for and select Managed identities.

Select Create.
Select your resource group.
Give your managed identity a name.
Select Review and create, and then Create.

Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs.

step 3

Search for and select your storage account.
Select the Access Control (IAM) blade.
Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Storage Blob Data Reader role.

On the Members page, select Managed identity.
Select Select members, in the Managed identity drop-down select User-assigned managed identity.
Select the managed identity you created in the previous step.
Click Select and then Review + assign the role.

Select Review + assign a second time to add the role assignment.
Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.

Secure access to the storage account with a key vault and key.

To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions.

Step 5

In the portal, search for and select Resource groups.
Select your resource group, and then the Access Control (IAM) blade.
Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Key Vault Administrator role.
On the Members page, select User, group, or service principal.
Select Select members.
Search for and select your user account. Your user account is shown in the top right of the portal.
Click Select and then Review + assign.
Select Review + assign a second time to add the role assignment.
You are now ready to continue with the lab.

Create a key vault to store the access keys.

Step 6

In the portal, search for and select Key vaults.
Select Create.
Select your resource group.
Provide the name for the key vault. The name must be unique.

Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.
Select Review + create.
Wait for the validation checks to complete and then select Create

After the deployment, select Go to resource.

On the Overview blade ensure both Soft-delete and Purge protection are enabled.

Create a customer-managed key in the key vault.

step 7

In your key vault, in the Objects section, select the Keys blade.
Select Generate/Import and Name the key.

Take the defaults for the rest of the parameters, and Create the key.

Configure the storage account to use the customer managed key in the key vault.

step 8

Before you can complete the next steps, you must assign the Key Vault Crypto Service Encryption User role to the managed identity.

In the portal, search for and select Resource groups.
Select your resource group, and then the Access Control (IAM) blade.
Select Add role assignment (center of the page).
On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.
On the Members page, select Managed identity.
Select Select members, in the Managed identity drop-down select User-assigned managed identity.
Select your managed identity.

Click Select and then Review + assign.
Select Review + assign a second time to add the role assignment.

Configure the storage account to use the customer managed key in your key vault.

step 9

Return to the storage account.
In the Security + networking section, select the Encryption blade.
Select Customer-managed keys.

Select a key vault and key. Select your key vault and key.
Select to confirm your choices.

Ensure the Identity type is User-assigned.
Select an identity.
Select your managed identity then select Add.
Save your changes.

If you receive an error that your identity does not have the correct permissions, wait a minute and try again.

Configure an time-based retention policy and an encryption scope.

step 10

Navigate to your storage account.
In the Data storage section, select the Containers blade.
Create a container called hold. Take the defaults. Be sure to Create the container.

Upload a file to the container.

In the Settings section, select the Access policy blade.
In the Immutable blob storage section, select + Add policy.

For the Policy type, select time-based retention.
Set the Retention period to 5 days.
Be sure to Save your changes.

Try to delete the file in the container.
Verify you are notified failed to delete blobs due to policy.

The developers require an encryption scope that enables infrastructure encryption.

step 11

Navigate back to your storage account.
In the Security + networking blade, select Encryption.
In the Encryption scopes tab, select Add.

Give your encryption scope a name.
The Encryption type is Microsoft-managed key.
Set Infrastructure encryption to Enable.

Create the encryption scope.
Return to your storage account and create a new container.
Notice on the New container page, there is the Name and Public access level.
Notice in the Advanced section you can select the Encryption scope you created and apply it to all blobs in the container.

That's all for this article, I hope this was helpful.

Creating Virtual Machine In Azure.

Blessing — Sun, 29 Sep 2024 19:49:04 +0000

What is a virtual machine? In computing, a virtual machine is the virtualization or emulation of a computer system. Virtual machines are based on computer architectures and provide the functionality of a physical computer. Their implementations may involve specialized hardware, software, or a combination of the two.

Azure Stack Overview
Azure Stack is a portfolio of products that extends Azure services and capabilities to your environment of choice from the datacenter to edge locations and remote offices.

It provides a consistent hybrid cloud experience, allowing you to build, deploy, and run applications across your IT ecosystem.

How to Use VMs in Azure Stack

Create a VM: Use the Azure Stack Portal to create a VM. You'll need to specify details like the VM size, operating system, and network configuration.
Configure Networking: Set up the VM with necessary configurations such as networking, storage, and security options.
Install and Configure Operating System: Choose an appropriate operating system,(e.g. Windows Server, Ubuntu) and install it on the VM.
Configure the operating system settings, such as network interfaces, time zone, and updates.
Install and Configure Applications:
Install and configure the applications or services you need to run on
the VM. Consider using Azure Marketplace to find pre-built images with
common applications already installed.
Manage and Monitor:
Use the Azure Stack Portal or Azure CLI/PowerShell to monitor the VM's
performance, health, and resource usage.
Implement monitoring tools and alerts to proactively address any issues.
Scale and Update:
If necessary, scale the VM by resizing it or creating additional VMs.
Apply updates and patches to the operating system and applications to maintain security and performance.

Benefits of Virtual Machines (VMs)

Flexibility and Scalability: The vm can allocates a lot of resources, {cpu, memory, storage} based on demand, they also allow you scale up and down to accommodate changing work loads, which can avoid overprovisioning or underprovsioning.
cost-Efficiency: Multiple vms can run on a single server, which can help to reduce hardware cost, they also consume less power than a physical server,vms also has reduced Maintenance cost.
Improved Resource Utilization: VMs enable precise allocation of resources to individual applications, preventing resource contention. VMs can help avoid disk fragmentation, improving performance and reducing storage requirements.
Security and Isolation: VMs can be isolated from each other, enhancing security and preventing unauthorized access.
Snapshotting: VMs can be snapshotted at specific points in time, allowing for easy rollback in case of security breaches or configuration errors.
Enhanced Disaster Recovery:
Rapid Recovery: VMs can be easily backed up and restored, facilitating
rapid recovery from failures or disasters.
High Availability: VM clustering and fault tolerance features can ensure continuous availability, even in the event of hardware failures.

Step-by-Step Guide to Creating a Virtual Machine in Azure.

Step 1

Create a free trial account : login to your azure account and search for virtual machine. You can find it by clicking on the hamburger icon 🍔 and scrolling through the options or by clicking on the “Create a resource” button and typing “virtual machine”.

step 2

Click the Create button: To start the virtual machine creation process.
Choose “Create a virtual machine hosted by Azure”. Enter Project Details, Select the appropriate subscription, create a resource group by clicking the “Create resource group” button giving it a name.

step 3

Enter Virtual Machine Details Provide information about your virtual machine, such as the name, operating system (choose either Ubuntu Server 20.04 or Windows Server Datacenter -x64 G2) size, and other configuration settings, Leave other options as default.

step 4

Create an Administrator Account: Use the same password on your system” for the authentication type. For example; “Azure user” for the username and “password123*” for the password.

step 5

Select Inbound Port Rules
Select SSH if you chose a Linux VM and RDP if it’s a Windows VM. This allows IP addresses to connect to the VM.

step 6

Disable Boot Diagnostics
Click “Next” until you reach the “Boot diagnostics” in the Monitoring tab, and click on “Disable”.

step 7

Review and Create
Click on the “Review + Create” button. If the validation passes, the deployment will proceed. If not, note any recommendations, fix them, and try again. Deployment might take 3-5 minutes.

Check the Status
If the VM is running, the task has succeeded.

step 8

Access the Virtual Machine
Once the virtual machine is deployed, click on the “Connect” button in the virtual machine blade in the Azure portal. Download RDP File
Click “Native RDP”, select, and wait for the configured sign to be displayed on the right-hand side. Download the RDP file.

step 9

Connect to the VM
Open the RDP file from your local computer and click on “Connect”.

Enter the admin details created during the VM setup.

step 11

Wait for Configuration
Wait for the remote PC to be configured.

Start Using the VM
Once the connection is successful, start using your virtual machine!

We have successfully connected to our virtual machine. I can now access my computer from anywhere in the world without having it physically.

i hope you found this helpful!

Provide Shared File Storage For The Company Offices

Blessing — Fri, 27 Sep 2024 01:17:13 +0000

The company is geographically dispersed with offices in different locations. These offices need a way to share files and disseminate information. For example, the Finance department needs to confirm cost information for auditing and compliance. This file shares should be easy to access and load without delay. Some content should only be accessed from selected corporate virtual networks.

Create and configure a storage account for Azure Files.

Create a storage account for the finance department’s shared files

Step 1

In the portal, search for and select Storage accounts.
Select + Create.
For Resource group select Create new. Give your resource group a name and select OK to save your changes.
Provide a Storage account name. Ensure the name meets the naming requirements.
Set the Performance to Premium.
Set the Premium account type to File shares.
Set the Redundancy to Zone-redundant storage.
Select Review and then Create the storage account.
Wait for the resource to deploy.
Select Go to resource.

Create and configure a file share with directory.

Create a file share for the corporate office. Learn more about Azure File tiers.

step

In the storage account, in the Data storage section, select the File shares blade.

Select + File share and provide a Name.
Review the other options, but take the defaults.
Select Create

Add a directory to the file share for the finance department. For future testing, upload a file.

step 2

Select your file share and select + Add directory.
Name the new directory finance.
Select Browse and then select the finance directory.
Notice you can Add directory to further organize your file share.
Upload a file of your choice.

Configure and test snapshots.

Similar to blob storage, you need to protect against accidental deletion of files. You decide to use snapshots.

Step 1

Select your file share.
In the Operations section, select the Snapshots blade.
Select + Add snapshot. The comment is optional. Select OK.

Select your snapshot and verify your file directory and uploaded file are included.

Practice using snapshots to restore a file.

Step 1

Return to your file share.
Browse to your file directory.
Locate your uploaded file and in the Properties pane select Delete. Select Yes to confirm the deletion.

Select the Snapshots blade and then select your snapshot.

Navigate to the file you want to restore,
Select the file and the select Restore.

Provide a Restored file name.

Verify your file directory has the restored file.

Configure restricting storage access to selected virtual networks.

This tasks in this section require a virtual network with subnet. In a production environment these resources would already be created.

step 1

Search for and select Virtual networks.

Select Create. Select your resource group. and give the virtual network a name.
Take the defaults for other parameters, select Review + create, and then Create.
Wait for the resource to deploy.

Select Go to resource.
In the Settings section, select the Subnets blade.
Select the default subnet.
in the Service endpoints section choose Microsoft.Storage in the Services drop-down.
Do not make any other changes.
Be sure to Save your changes.

The storage account should only be accessed from the virtual network you just created.

step 1

Return to your files storage account.
In the Security + networking section, select the Networking blade
select your virtual network and subnet, select Add.
Be sure to Save your changes.
Select the Storage browser and navigate to your file share.
Verify the message not authorized to perform this operation. You are not connecting from the virtual network.

That's all for this article.

How To Provide Private Storage For Internal Company Documents.

Blessing — Thu, 26 Sep 2024 09:41:38 +0000

The company needs storage for their offices and departments. This content is private to the company and shouldn't be shared without consent. This storage requires high availability if there's a regional outage. The company wants to use this storage to back up the public website storage.

Create a storage account and configure high availability.

Create a storage account for the internal private company documents.

Step 1

In the portal, search for and select Storage accounts.
Select + Create.
Select the Resource group created in the previous lab.
Set the Storage account name to private. Add an identifier to the name to ensure the name is unique.
Select Review, and then Create the storage account.

Wait for the storage account to deploy, and then select Go to resource.

This storage requires high availability if there’s a regional outage. Read access in the secondary region is not required. Configure the appropriate level of redundancy.

Step 2

In the storage account, in the Data management section, select the Redundancy blade.
Ensure Geo-redundant storage (GRS) is selected.

Review the primary and secondary location information.
Save your changes.

Create a storage container, upload a file, and restrict access to the file.

Create a private storage container for the corporate data.

Step 1

In the storage account, in the Data storage section, select the Containers blade.
Select + Container.
Ensure the Name of the container is private.
Ensure the Public access level is Private (no anonymous access).
As you have time, review the Advanced settings, but take the defaults.
Select Create.

For testing, upload a file to the private container. the type of file doesn’t matter. A small image or text file is a good choice. Test to ensure the file isn’t publicly accessible.

step 2

Select the container.
Select Upload.
Browse to files and select a file.
Upload the file.

Select the uploaded file.
On the Overview tab, copy the URL.

Paste the URL into a new browser tab.
Verify the file doesn’t display and you receive an error.

An external partner requires read and write access to the file for at least the next 24 hours.

Configure and test a shared access signature (SAS).

Step 1

Select your uploaded blob file and move to the Generate SAS tab.

In the Permissions drop-down, ensure the partner has only Read permissions.

Verify the Start and expiry date/time is for the next 24 hours.
Select Generate SAS token and URL.

Copy the Blob SAS URL to a new browser tab.

Verify you can access the file. If you have uploaded an image file it will display in the browser.

Other file types will be downloaded.

Configure storage access tiers and content replication.

To save on costs, after 30 days, move blobs from the hot tier to the cool tier.

Step 1

Return to the storage account.
In the Overview section, notice the Default access tier is set to Hot.

In the Data management section, select the Lifecycle management blade.
Select Add rule.

Set the Rule name to movetocool.
Set the Rule scope to Apply rule to all blobs in the storage account.
Select Next.

Ensure Last modified is selected.

Set More than (days ago) to 30.
In the Then drop-down select Move to cool storage.
As you have time, review other lifecycle options in the drop-down.
Add the rule.

The public website files need to be backed up to another storage account.

Step 1

In your storage account, create a new container called backup. Use the default values. Refer back to Lab 02a if you need detailed instructions.

Navigate to your public website storage account. This storage account was created in the previous exercise.

In the Data management section, select the Object replication blade.
Select Create replication rules.

Set the Destination storage account to the private storage account.

Set the Source container to public and the Destination container to backup.
Create the replication rule.

These are the steps in Providing a Private Storage For Internal Company Documents!!

Create A Storage Account To support The Public Website

Blessing — Sat, 21 Sep 2024 21:19:58 +0000

The company website supplies product images, videos, marketing literature, and customer success stories. Customers are located worldwide and demand is rapidly expanding. The content is mission-critical and requires low latency load times.

Create a storage account with high availability.

Step 1

Create a storage account to support the public website.

In the portal, search for and select.

Select + Create.
For resource group select new. Give your resource group a name and select OK.

Set the Storage account name to public website.

Make sure the storage account name is unique by adding an identifier.

Take the defaults for other settings.

Select Review and then Create.

Wait for the storage account to deploy, and then select, your storage deployment should look like this.

This storage requires high availability if there’s a regional outage. Additionally, enable read access to the secondary region.

Step 2

In the storage account, in the Data management section, select the Redundancy blade.

Ensure Read-access Geo-redundant storage is selected.
Review the primary and secondary location information.

Information on the public website should be accessible without requiring customers to login.

Step 3

In the storage account, in the Settings section, select the Configuration blade.

Ensure the Allow blob anonymous access setting is Enabled.
Be sure to Save your changes.

Create a blob storage container with anonymous read access

Step 1

In your storage account, in the Data storage section, select the Containers blade.

Select + Container

Ensure the Name of the container is public.

Select Create.

Customers should be able to view the images without being authenticated. Configure anonymous read access for the public container blobs.

Step 2

Select your public container.

On the Overview blade, select Change access level.

Ensure the Public access level is Blob (anonymous read access for blobs only).

Select OK.

Practice uploading files and testing access.

Step 1

For testing, upload a file to the public container. The type of file doesn’t matter.

A small image or text file is a good choice.

Ensure you are viewing your container.

Select Upload.

Close the upload window, Refresh the page and ensure your file was uploaded.

Determine the URL for your uploaded file. Open a browser and test the URL.

Step 2

Select your uploaded file.

On the Overview tab, copy the URL.

Paste the URL into a new browser tab.

If you have uploaded an image file it will display in the browser. Other file types should be downloaded.

Configure soft delete

It’s important that the website documents can be restored if they’re deleted. Configure blob soft delete for 21 days.

Step 3

Go to the Overview blade of the storage account.

On the Properties page, locate the Blob service section.
Select the Blob soft delete setting.
Ensure the Enable soft delete for blobs is checked.

Change the Keep deleted blobs for (in days setting is 21.
Notice you can also Enable soft delete for containers.
Don’t forget to Save your changes.

If something gets deleted, you need to practice using soft delete to restore the files.

Step 4

Navigate to your container where you uploaded a file.

Select the file you uploaded and then select Delete.

Select OK to confirm deleting the file.

On the container Overview page, toggle the slider Show deleted blobs. This toggle is to the right of the search box.

Select your deleted file, and use the ellipses on the far right, to Undelete the file.

Refresh the container and confirm the file has been restored.

Configure blob versioning

step 5

Go to the Overview blade of the storage account.
In the Properties section, locate the Blob service section.
Select the Versioning setting.

Ensure the Enable versioning for blobs checkbox is checked.

Notice your options to keep all versions or delete versions after.

Don’t forget to Save your changes.

As you have time experiment with restoring previous blob versions.
Upload another version of your container file. This overwrites your existing file.
Your previous file version is listed on Show deleted blobs page.

That's all on how to Provide Storage For a Public Website!

Provide Storage For The IT Department Testing And Training.

Blessing — Sat, 21 Sep 2024 10:41:08 +0000

In today’s rapidly evolving technological landscape, efficient and reliable storage solutions are paramount for any IT department. Whether it’s for testing new applications, training staff, or managing day-to-day operations, understanding the intricacies of storage systems is crucial. This document aims to provide a comprehensive overview of storage technologies, on their application in testing and training environments.

Steps to provide storage for the IT department:

For Creating A Resource Group And A Storage Account in Azure.

What is a Resource Group?

A resource group in Azure is a logical container that holds related resources for an Azure solution. It can include all the resources for the solution or only those you want to manage as a group.

What is a Storage Account?

This is the core building block for managing cloud storage in azure.it is also like a container to store various types of data, from files to large binary objects.

lets get into it.

Step 1

In the Azure portal, search for and select

Select + Create

Give your resource group a name For example Nneoma, then Select a region, Use this region throughout the project.

Select Review and create to validate the resource group

Select Create to deploy the resource group.

Step 2

Create and deploy a storage account to support testing and training.

In the Azure portal, search for and select
Select + Create.

On the Basics tab, select your Resource group.

Provide a Storage account name. The storage account name must be unique in Azure.

Set the Performance to Standard.
Select Review, and then Create.

Wait for the storage account to deploy and then Go to resource.
A deployed account should look like this.

Configure simple settings in the storage account.

step 1

The data in this storage account doesn’t require high availability or durability. A lowest cost storage solution is desired.

In your storage account, in the Data management section, select the Redundancy blade.

Select Locally-redundant storage (LRS) in the Redundancy drop-down.
Be sure to Save your changes.

Refresh the page and notice the content only exists in the primary
location.

step 2

The storage account should only accept requests from secure connection.

In the Settings section, select the Configuration blade.
Ensure Secure transfer required is Enabled.

step 3

Developers would like the storage account to use at least TLS version 1.2.

In the Settings section, select the Configuration blade.
Ensure the Minimal TLS version is set to Version 1.2.

step 4

Until the storage is needed again, disable requests to the storage account.

In the Settings section, select the Configuration blade.
Ensure Allow storage account key access is Disabled.
Be sure to Save your changes.

step 5

Ensure the storage account allows public access from all networks.

In the Security + networking section, select the Networking blade.
Ensure Public network access is set to Enabled from all networks.
Be sure to Save your changes.

That's all that is needed to successfully create a storage account and a resource group, for an IT department for testing and training.

How To Create A Resource Group In Microsoft Azure.

Blessing — Thu, 19 Sep 2024 22:01:24 +0000

What Is A Resource Group

A resource group is a container that houses similar items in azure.
In this article, I am going to show you how to create a resource group.

Step 1: Search and select resource group in azure portal.

Step 2 : Click on the on the + create button

Step 3: On the basics tab, locate the resource group section and give it a name.

Step 4: Click on review and create to validate the process, then click the create button to begin deployment.

Step 5: Go to the newly created resource group.

conclusion : In this article, we learnt about the various steps required to create a resource group.

what is virtualization in cloud

Blessing — Wed, 18 Sep 2024 23:25:32 +0000

What is virtualization:

virtualizations enables cloud providers to serve users with their existing physical computer hardware. They purchase only the resources they need, when they need it.

What is scalability:

This is the capacity of a cloud computing environment to effectively handle growing or diminishing work-loads.

What is agility:

Agility refers to the ability to quickly develop, test and launch applications in a cloud based environment.

what is High Availability:

This refers to as the ability of a system to remain accessible and operational for a long period of time, it ensures that cloud services can handle different loads level and recover quickly from any failure.

What is fault Tolerant:

This is the ability of a system to keep running even if a software or hardware malfunctions occurs and it enters down state. it has to maintain it's helpfulness ton the user in all circumstances.

What is global Reach:

This is when a system can be accessed worldwide, benefiting businesses with global customer base.

What is the difference between scalability and Elasticity:

Elasticity:

This refers to the ability of a system to automatically expand or compress the intracultural resources on a sudden up and down in the requirement, so the workload can be managed efficiently.it is usually used by small business to meet up sudden up and down work load, for a small period of time. e.g an online shopping company will mostly have more traffic of sales during festive period, which will increase the workload for a period of time.

Scalability:

This is used to handle the growing workload where good performance is also needed, to work efficiently with software applications. for example, a company whose data size was small but started increasing, in this case you might have to request your cloud service vendor to scale up your database capacity to handle work load.it is usually used by big companies.