>> Did you know that
the top 300 Azure customers all use Azure Policy?
They use it to ensure their subscriptions and
resources stay compliant with corporate and external standards.
Guillermo Gomez is here to show us
the latest updates to Azure Policy today on Azure Friday.
[MUSIC]
>> Hey everyone, Donovan Brown here
with another episode of Azure Friday.
I'm here with Guillermo and he's going to show us
the latest updates to Azure Policy.
So why Azure Policy?
>> Well, customers that are moving to the Cloud have had
the challenge that things are
different now when they where on-prem.
On-prem, they had the model where
they had the gatekeeper,
normally the central IT team and that team is
responsible for getting the user's resources that they want,
so a user will go and say,
"Hey, Mr. Central IT give me this."
They can control all the governance and that's it.
But now, when they moved to the Cloud,
things are slightly different.
Customers now or users
are actually having access to the Cloud directly,
and that makes a challenge for the team that is in
charge of making sure that they get
the right things and the right governance is in place.
So how do you do that? They do it
normally through external documentation,
that could be like tens or hundreds of
pages of documents that they go to developer
and say, "Hey, Mr. Developer, go ahead
and build an environment based on this."
That's difficult for the developer.
So if you can have all those controls in the Cloud,
things are going to move fast
while making sure that you have the right controls.
In here, we've already talked in
previous episodes about blueprints.
Today, we're going to focus on the latest on policy.
>> Got it.
>> So this is going to combine
the self-service power of the Cloud,
but yet not sacrifice any of
this security and compliance that we
want on those resources.
>> There you go.
>> Got it.
>> We want to make sure that our customer
are still having that spirit
and that agility while making sure
that the right guardrails are in place.
>> Perfectly.
>> So the very first thing that I want to
show you and as you said,
out of our top 300 customers are using Policy,
and we've learned a lot from that.
So we are adding a lot of
things based on what our customers really want.
So the first thing I'm going to show you
that we have the concept of initiative,
an initiative is a set of policies that
accompanies a single goal.
In this case, this one is for tagging,
and we just want to make sure
that all resources are tagged properly.
One of the used cases is a cost management.
So let's see what these loads.
>> So this is making sure that almost every resource,
I mean, maybe it is every resource inside of
Azure has the ability for you to tag it with
different metadata that you're
wanting to apply and a lot of people use
that data to know which cost center
needs to be charged for that particular resource.
What you're doing here is now saying,
"Has everything been tagged and tagged appropriately."
>> Correct. Because you can
have multiple tax and multiple resource.
Best practices say that you should have all your resources
tagged for different purposes and the
one that I want to show you is cost management.
In this case, we have
a policy that enforces the cost management
tag into a resource.
What customers want is to make sure that they
understand what are the changes made by policy,
because we have different types of policy,
we have audit which just basically
logs all the events but don't restricts anything.
But then, we have enforcing
that makes sure that that happens like that,
that it's setting those guardrails, and then,
we have remediation which means that if
something is not correct,
let's make sure that policy gets it correct.
>> Got it.
>> So one thing that our customers want to see
is why is this thing non-compliant.
In this case, we click on a view non-compliance reasons.
In here, we can see that the reason for
non-compliance is current value must exist,
the field code, these the costCode that is the part
of a tag that needs to exist and nothing exist.
So customers can see why
a resource is not complained against which policy,
which is [inaudible].
>> This also gives you some remediation steps.
If you do what this is telling us to do,
then you're going to be able to pass this.
>> There you go. Because even though
we have remediation capabilities,
when customers move to the Cloud normally
they don't do governance from the beginning.
That's something that just happens.
You go to a Cloud, you're excited, and you keep going.
But governance is something that you need to get back,
so this is one thing that helps you through that.
>> Okay.
>> So that's one thing, and then the other thing that I
wanted to show you is change history.
What are these changes that have been made by Policy?
>> So these are changes that were made
to the resource for us
or changes to the policies that we're
trying to enforce upon a resources?
>> Change their resource by policy.
>> Okay.
>> As I said, if you have a remediation policy
probably [inaudible].
>> Got you. That one will actually take actions
on your behalf.
>> So in this case, I just went in to
the resource called aa-contoso.
Now, while it's loading, it will
give you a little more information.
But what I'm interested on in
the change history is our preview feature that we
released around February time frame are in here.
You can select the time frame.
So you have like the last hour,
one day, seven days, 14 days.
In this case, conveniently,
I have one change made yesterday for this demo,
and it gives you a simple JSON what are the changes.
You see in red, what are the areas that have been deleted.
In green, what out of there is I have been added.
In this case, that a classification area
has been removed and we have a costCode.
>> Got you.
>> Now, this is helping you as I said,
"Know what has been changed by policy."
It gives you more visibility into that as
a Cloud custodian. All right, great.
Now, at the beginning of this week,
we announced policy for AKS.
Policy allows you to create policies
for every service that is exposed to harm.
But if you want to go deeper than that,
that's a different story.
So we've released the capability to go
deeper than that for Key Vault and for AKS.
In this case, I'm going to show you how it works for AKS.
One of the things that you can do for
Key Vault is make sure that the right certificates and
keys are in place before you could enter with policy, now you can,
and I'm just going to show you how
this policy that is actually making sure
that is [inaudible] that there are
new self-signed certificates.
So this is just showing you how you can go
deeper into Key Vault,
you can do the same thing in AKS.
In AKS, you can go inside the cluster and check box,
check namespaces, or an interest.
>> Okay.
>> So that's a brand new feature that we have released.
If you see here, we just check
the audit new self-service certificates.
We have three resources that are non-compliant
in that Key Vault,
and you can go ahead,
and just get more details around out here,
you can see everything that is going on,
inside what is compliant versus what is not compliant.
>> Okay.
>> So this is just showing how we are
continuously evolving to get policy to
go deeper and deeper into Azure.
The next thing that I want to show you is in Guest Policy.
So as I said, this is another area
where you can go deeper into a single resource.
In this case, you could do things for VMs like,
"Hey, I have a VM,
and I am a US company,
and I want to make sure that all the VMs
have created in the US and not in another region."
>> Okay.
>> That's what you could do. But what happens if you want
to see what happens inside that VM,
that's what we're doing here within Guest Policy.
We have a bunch of built-in policies here,
I pull it these are initiatives,
so at a set of policies that are accomplishing specific goal.
>> Okay.
>> So there are a lot things like I want to
make sure that certificates are not expired,
that's one of the most common things that happen.
You can go ahead and create a policy that tracks that,
sends you an alert if you say,
"Hey, in 30 days,
a certificate hasn't been updated or not."
In this case, I'm just going to show you how to
create one to make sure that passwords are secure.
>> Okay.
>> That's something that you would do inside a VM.
An interestingly straightforward, I'm
going to use the default settings here.
So I'm going to assign
this initiative, I'm going to choose a scope.
So the scope, you could do right now
management groups or you could do a subscription.
In this case, I'm going to choose
our demo subscription and
I'm going to leave everything as a default.
In this case, for example,
in the one that I told you about certificates,
it will give you the option to see
how many days in advance you want to be alert at 30 days,
60 days, whatever you need.
So the whole goal of this is to make sure
that the right policies are in place,
so you don't get an error,
so you get alerted and there's no errors in the future,
because you are proactive on fixing that.
Now, I want to show you how that looks,
so if I go here and I type password,
I totally have one here,
so let's go to the certificate one that I have created.
What I'm doing now is I'm going through
the catalog of policies and initiatives,
and then I assign them to
the resources that I want that to be applied.
>> Yeah.
>> Then, this scope is there.
The subscription, or the management group,
every resource under that scope is what
we'll get [inaudible] in this case.
>> Okay.
>> So in here, I see that for
the one course certificates that I mentioned,
I create a one for passwords,
but the one that I have deployed is for certificates,
I know that there is something that is not compliant,
I can click on it and I can get more information about that.
I go into the resource,
I can see the resource itself,
I'm just drilling down inside the resource.
When you go here, it will tell you what is the issue here.
In this case, they're monitoring
agent certificate is about to expire in less than 30 days.
Now, I know. Now, I can change it,
I'm avoiding a possible problem.
>> Okay.
>> Lastly, one of the questions that we are
getting by customers is, "Okay.
To create policies in a specific services,
I need to know the aliases for that service.
How do I know that?"
So we have an auto-generate of feature of aliases.
In this case, I have you preloaded but I'm going
to show you how to get the aliases for SQL.
This is just the line of code that I'm putting into the CLI to be
able to show that and you can
get all those aliases, there are a lot.
So if customers need to get
access to those aliases, they can get it.
All of that is in our policy documentation.
>> So again, tell me why do I need these aliases again?
>> So yeah. In order to create a policy,
you need to have like certain aliases for each service,
because each service has a bunch of features,
and you can create a bunch of different policies for that service.
So the alias is what is needed in order to
create a policy for that specific feature on that service.
>> Okay. So this is like a unique identifier that
allows me to assign it to that particular policy. Okay.
>> Correct.
>> Then, the way that you list that as
just using the Azure CLI.
>> Yeah.
>> Got it.
>> Correct.
>> Okay.
>> That's the latest on Azure policy.
>> This is awesome.
Thank you so much for showing us all this stuff.
I meet a lot of our customers when I'm in
the field and this is something that's really top of mind.
So it's great to see that we're continuing to invest
and make it easier for them to do the right thing.
Because the Cloud is such a powerful platform,
and you don't want to slow them down with
a lot of policy that's manual.
This is making it all out [inaudible].
>> For sure. In fact, this is something that for
one audience that is not a typical
audience which is developers.
It enables developers because it's integrated
with Azure DevOps.
So let's say that a developer is deploying
some code and at the time of deployment,
policy kicks in and may tell you,
"Hey, there is something wrong."
That's something that enables developers to, "Hey,
I'm not going to go through an approval process,
I can use this."
When he kicks him, then
let's say that he's compliant
then he can go straight to production.
If not, they will get their workflow back.
>> Nice.
>> So the developer can make the change,
then whenever he passes a compliant's process,
it will go through.
>> Great.
>> So that's something.
>> Yes. So you're shifting left that ability to get quick alerts.
That you don't have to deploy into
Azure to find out you're in violation,
you can actually find out in your pipelines.
>> There you go.
>> That's awesome.
>> Yeah.
>> We're learning all about the new improvements
to Azure Policy here on Azure Friday.
[MUSIC]