Azure Policy Export

Hi!

Azure Policy definitions, initiatives, and assignments can each be exported as JSON with Azure CLI.

Here an example to export an Azure Policy. In the first we will list all the Azure Policies which contains the display name « virtual machine ». In the second step we will export the Azure Policy in JSON.

maxime@Azure:~$ az policy definition list --query "[?contains(displayName, 'virtual machine')]" -o table
Name                                  PolicyType    Mode     DisplayName                                                                                                                       Description
------------------------------------  ------------  -------  ----------------
0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56  BuiltIn       All      Audit virtual machines without disaster recovery configured                                                                       Audit virtual machines which do not have disaster recovery configured. To learn more about disaster recovery, visit https://aka.ms/asr-doc.
04c4380f-3fae-46e8-96c9-30193528f602  BuiltIn       Indexed  [Preview]: Network traffic data collection agent should be installed on Linux virtual machines                                    Security Center uses the Microsoft Dependency agent to collect network traffic data from your Azure virtual machines to enable advanced network protection features such as traffic visualization on the network map, network hardening recommendations and specific network threats.


maxime@Azure:~$ az policy definition show -n 0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56 -o jsonc
{
  "description": "Audit virtual machines which do not have disaster recovery configured. To learn more about disaster recovery, visit https://aka.ms/asr-doc.",
  "displayName": "Audit virtual machines without disaster recovery configured",
  "id": "/providers/Microsoft.Authorization/policyDefinitions/0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56",
  "metadata": {
    "category": "Compute",
    "version": "1.0.0"
  },
  "mode": "All",
  "name": "0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56",
  "parameters": {},
  "policyRule": {
    "if": {
      "field": "type",
      "in": [
        "Microsoft.Compute/virtualMachines",
        "Microsoft.ClassicCompute/virtualMachines"
      ]
    },
    "then": {
      "details": {
        "existenceCondition": {
          "field": "name",
          "like": "ASR-Protect-*"
        },
        "type": "Microsoft.Resources/links"
      },
      "effect": "auditIfNotExists"
    }
  },
  "policyType": "BuiltIn",
  "systemData": null,
  "type": "Microsoft.Authorization/policyDefinitions"
}

Maxime.

AKS | Pricing Tiers

Hi!

Azure Kubernetes Service (AKS) is now offering two pricing tiers for cluster management: the Free tier and the Standard tier.

Free tierStandard tier
When to use• You want to experiment with AKS at no extra cost
• You’re new to AKS and Kubernetes		• You’re running production or mission-critical workloads and need high availability and reliability
• You need a financially backed SLA
Supported cluster types• Development clusters or small scale testing environments
• Clusters with fewer than 10 nodes		• Enterprise-grade or production workloads
• Clusters with up to 5,000 nodes
Pricing• Free cluster management
• Pay-as-you-go for resources you consume		• Pay-as-you-go for resources you consume
Feature comparison• Recommended for clusters with fewer than 10 nodes, but can support up to 1,000 nodes
• Includes all current AKS features		• Uptime SLA is enabled by default
• Greater cluster reliability and resources
• Can support up to 5,000 nodes in a cluster
• Includes all current AKS features
# Create a new AKS cluster in the Free tier 
az aks create --resource-group myResourceGroup --name myAKSCluster --no-uptime-sla 

# Create a new AKS cluster in the Standard tier 
az aks create --resource-group myResourceGroup --name myAKSCluster --uptime-sla

# Update an existing cluster to the Free tier
az aks update --resource-group myResourceGroup --name myAKSCluster --no-uptime-sla

# Update an existing cluster to the Standard tier
az aks update --resource-group myResourceGroup --name myAKSCluster --uptime-sla

Documentation: https://learn.microsoft.com/en-us/azure/aks/free-standard-pricing-tiers

Maxime.

Happy New Year 2023!

Hi!

I wish you and your family a happy and prosperous New Year 2023! I hope this is going to be an exceptional year for all of us. I will continue to write articles, blog-post about the Azure Security stack (Azure Policy, Defender for Cloud, AKS/Kubernetes). I think to add more articles related to multi-cloud (GCP). Lot of organizations will move forward with a multi-cloud strategy in 2023.

I absolutely love giving talks, sharing thoughts and having a good conversation with a group of like-minded people. If you’re interested let me know! Please find my upcoming speaking engagements for 2023.

All the best for the coming year, and I hope to see you in person as soon as possible! .

Maxime.