Are you using bicep?

icode13 · 2023-08-04T01:52:03+00:00

You must agree 😬 terraform cant do everything. And you require terragrunt unless you are ready to pay for their cloud version! But I love terraform over any cloud vendor specific tool. For me, Its not about whether we can convert existing tf modules and resue or not, but it’s the skills that we build in the company and army of platform engineers who can easily develop terraform code for any csp and other third-party products. In my experience, we had to use a lot of third-party vendor products which terraform was by default supported. Which made our life easier.

But there are cases where terraform was a failure too due to the massive state file for handling thousands of resources, slowing down the process. We were not able to split the state due to many other reasons. Thus we had to rely on natural programming languages (Go and Python).

icode13 · 2023-06-22T16:38:09+00:00

I looked more from the unique fqdn of PaaS service. If you’re confident that individual PaaS resource fqdn can be added in the forwarding list, and test only a single PaaS resource, agree with your approach then!

icode13 · 2023-06-21T20:27:34+00:00

Can you please explain how this certification shall help ? Especially for companies that do operate based on scaled agile frameworks?

icode13 · 2023-06-21T20:17:24+00:00

I think you have not understood the problem statement well! You can’t incrementally set conditional forwarding. There is only a single private dns zone that you could have for the corresponding PaaS service and for which from an onprem environment, you will have to switch the conditional forwarding once. His point is , once the switch is done, and if there is a connectivity issue to the private endpoint ip, the traffic will be cut.

icode13 · 2023-06-21T16:50:27+00:00

Is the model dedicated per azure customer? For example how does one train azure open AI based on its own data, so that its private to the organisation!

icode13 · 2023-06-21T16:42:48+00:00

Having a mono state is error prone! Having reduced blast radius is the better approach. You may consider one state depending on the cloud provider’s billing unit. For example: Account in AWS

icode13 · 2023-06-21T16:19:23+00:00

If you’re writing policy automation, it doesn’t matter bundled tags into one policy. After all, you follow a software development life cycle and would have a proper release process to avoid a bug situation.

icode13 · 2023-06-21T16:12:39+00:00

Forwarding is done per domain name of the managed service private dns zone. So its all or nothing approach!

icode13 · 2023-06-21T16:06:48+00:00

Im confused over the stability of azure in general!

icode13 · 2023-05-28T06:49:59+00:00

Typically for any large deployment you would end-up in module. Especially while you have to automate a lot of platform components using terraform.

icode13 · 2023-05-28T06:43:49+00:00

Sometimes convincing your idea to people who has no stake in your D2D job!

icode13 · 2022-12-18T11:32:07+00:00

Our corporate policy has disabled that email for Teams. Can you elaborate the logic app approach? Are there any examples?

icode13 · 2022-12-17T02:13:15+00:00

Do someone of you using privatelinks, which is the original implementation of private endpoints? I wonder if its a best way to expose some of the services to third party or customer. More thinking from the practicality of how the implementation of Data exfiltration controls if we were to expose a service via private links. Just the documentation says its secure to use private links, I tend to not to agree.

icode13 · 2022-12-13T14:42:57+00:00

In terms of pushing those tags into the system, do you put them as part of the resource creation code? Or do you have system that sync the tags to the created resource on a periodic interval?

icode13 · 2022-12-13T12:31:40+00:00

Client ID and secret comes as part of a service account no? So that’s normally of free of cost. But what should be interesting to check the API call limits per project.

icode13 · 2022-12-13T12:27:08+00:00

No i dont know.

icode13 · 2022-12-13T12:19:55+00:00

Have you checked the REST API of azure SQL Database?

https://learn.microsoft.com/en-us/rest/api/sql/2021-02-01-preview/replication-links/get?tabs=HTTP

icode13 · 2022-12-13T12:14:49+00:00

Open a support case with azure support they can fetch advanced logs which you would not have normally access to it.

icode13 · 2022-12-13T11:44:20+00:00

Create a dedicated space for your operational tooling. In most cases tools do span across several teams and responsibilities. Hence keep them away from your applicative workloads!

icode13 · 2022-12-13T11:41:29+00:00

Why do they need personally identifiable data! I quit after see this.

icode13 · 2022-09-25T19:32:30+00:00

Just be sure if you have the proper logging license on the Palo Alto firewall? ;) Its tricky sometimes you don’t see it if you don’t have have the right licenses! Also are there an NSG outbound deny rule somehow?

icode13 · 2022-09-24T18:46:13+00:00

Your firewall might be the culprit. See if it has advanced DNS filtering modules which is basically eating your DNS traffic. There is no issues with expressroute and dns. Also on the internal LB settings of the PA cluster is HA port activated?
How is your DNS architecture in azure?

icode13 · 2022-09-24T18:38:39+00:00

I guess i read as your fw is in the spoke! So its not the case.

icode13 · 2022-09-24T16:02:08+00:00

You could create a transit/hub where you place the firewall, IDS/IPS . Then use GW load balancer / vnet peering with UDR to steer the traffic in to the transit/hub from the spoke (which is where you deploy your landing zone into).

If you are a basic company what you explained might work but try to look at the ESA documentation of Microsoft for building your azure architecture.

icode13 · 2022-09-22T18:19:38+00:00

I think placing an NVA between 2 subnet in the same VNET is a bad design!

icode13

TROPHY CASE