IT governance is the process through which an organization can ensure an effective and efficient use of IT resources, in order to achieve their goals. Azure Policy is a service available in the Microsoft public cloud that can be used to create, assign and manage policies to control the resources in Azure. Azure Policy, natively integrated into the platform, are a key element for the governance of the cloud environment. In this article, the principles of operation and features of the solution are reported.
In Azure environments you can find different subscriptions on which develop and operate several groups of operators. The common requirement is to standardize, and in some cases impose, how to configure the resources in the cloud. All this is done to obtain specific environments that meet compliance regulations, monitor security, resource costs and standardize the design of different architectures. These goals can be achieved with a traditional approach, that includes a block of operators (Dev/Ops) in the direct access to cloud resources (through the portal, API or cli). This traditional approach is, however, inflexible, because it involves a loss of agility in controlling the deployment of resources. Instead, using the mechanism that comes natively from Azure platform is possible to drive the governance to achieve the desired control, without impacting speed, the basic element in the operations of the modern IT.
Figure 1 – Traditional approach vs cloud-native governance
In Azure Policy you can do the following reported:
- Enable built-in policy or configure them to meet your needs.
- Perform real-time evaluation of the criteria set out in the policy and force execution.
- Assess the compliance of the policy periodically or on request.
- Enable audit policy on the virtual machine guest environment (Vm In-Guest Policy).
- Apply policies on Management Groups in order to gain control over the entire organization.
- Apply multiple criteria and aggregate the various states of the policies.
- Configure scope over which the exclusions are applied.
- Enable real-time remediation steps, also for existing resources.
All this translates into the ability to apply and enforce policy compliance on a large scale and its remediation actions.
The working mechanism of the Azure Policy is simple and integrated into the platform. When a request is made for an Azure resource configuration using ARM, this is intercepted by the layer containing the engine that performs the evaluation of policy. This engine makes an assessment based on active Azure policies and establishes the legitimacy of the request.
Figure 2 – Working principle of Azure Policy in creating resources
The same mechanism is then repeated periodically or upon request, to assess the compliance of existing resources.
Figure 3 – Working principle of Azure Policy in resource control
Azure already contains many built-in policies ready to be applied. Furthermore, in this GitHub repository you can find different definitions of Azure Policies, that can be used directly or modified to suit your needs. The definition of the Azure Policy is made in JSON and follows a well defined structure, described in this Microsoft's document. You also have the possibility of creating Initiatives, they are a collection of multiple policies.
Figure 4 – Example of defining a Azure Policy
When you have the desired policy definition, it is possible to assign it to a subscription and possibly in a more limited way to a specific Resource Group. You also have the option of excluding certain resources from the application of the policy.
Figure 5 – Process of assigning an Azure Policy
Following the assignment, you can evaluate the State of compliance in detail and if it is necessary apply remediation actions.
Figure 6 – State of compliance
Figure 7 -Example of remediation action
Conclusions
Through the use of Azure Policy you can totally control your own Azure environment, in a simple and efficient way. Statistics provided by Microsoft cite that considering the 100 top Azure Customers, 92 these use Azure Policy to control their environment. This is because, when you increase the complexity and amount of services on Azure is essential to adopt instruments, as Azure Policy, to have effective governance policies.
