(bright music)
Coming up, we are going to have a look
on how you can centrally manage
and delegate access and security policies
for your hybrid and multicloud resources.
I'm here with Ryan Willis from the Azure Management Team,
and we are going to talk about how you can leverage
the Azure control plane,
and how you can take advantage
of identities in your environment.
Thanks, Thomas. Yes.
So I think when we look at, on-premise assets,
and the cloud and multicloud world and others.
So many different things that you need to manage,
and it can often be very hard
to keep track of where they all are
and have a central place to actually make changes
and report on the current state of all those machines
and Kubernetes clusters.
And that's where Azure Arc really comes in.
We are pulling all of your resources,
no matter where they're running,
into the Azure Resource Manager
where all of the Azure resources,
can be presented alongside your hybrid resources
for that consistent and unified management experience.
One of the things which we see a lot
when people are moving
to these hybrid and multicloud architectures
for their application and their environment,
is when it comes to identities.
When I talk to cloud architects, they often say,
"Okay, hey, this is one of our challenging part,
I wanna have some sort of role-based access
and control over my environment."
Definitely, yeah.
We designed Azure Arc just like any other Azure resource,
so that when you onboard and project a representation
of these on-premises resources into Azure,
you retain full control over what the Azure users can do
on those hybrid and multicloud machines.
So just like any other Azure resource,
you'll be able to use role-based access control,
and your organization strategy
with management groups, subscriptions, and resource groups.
To make sure that the right people can see
and even make changes
to these resources running outside of Azure.
But anyone else does not get to know
that they are connected to your Azure subscription.
What you're saying is really,
I can use the exact same role-based access control?
And for example, if I have a team of like,
let's say, SharePoint admins or developers,
which just necessarily need to manage
their SharePoint servers, or their resources
which belong to the SharePoint environment,
you can actually like group them
and just provide them access for that.
And they don't have access to anything else?
Exactly. Yeah.
In some cases, you might find that all of the management
or monitoring that those admins need to do,
could be done through Azure.
You can actually sometimes even take away their access
on the actual server, so that the only way,
they can see this machine is through Azure,
which can be fully audited using the activity log
and all of the other mechanisms we have in place
to make sure that they only see
and manage their own resources.
I never thought of taking away the access
on the actual resource,
and then providing access just on the Azure layer.
So that is really powerful.
Now, one thing I talk also
when I talk to like IT departments, especially
to the IT pros is certificate management, right.
And in on-premises environments,
we often basically like used,
for example active directory in combination
with group policies to then deploy all the certificates
to the servers running in our environment.
Now with hybridcloud obviously, and multicloud environments,
sometimes the servers are not even domain joined.
So I know that there is something from Azure Arc
which can help us with that.
Right.
Yeah, definitely.
And so let me set the stage a little bit and talk
about kind of how arc manages identity behind the scenes.
So with arc, you have an Azure representation
of a resource that's running somewhere outside of Azure.
Each arc resource gets a managed identity associated
with it.
And so that's an Azure active directory principle
which the password is regularly rotated
for you by the Azure services on the backend.
So our agent, when you went running on an arc server,
for example, uses that identity when it needs to go
and talk back to Azure, to authenticate with our service
and provide updates as to what's happening on that machine.
We also let other apps on the machine,
use the same identity to talk to other Azure resources.
So if you're building a hybrid app, where you need to go
and access something like a certificate
that could be stored in key vault,
you can use the managed identity of the arc server,
which again it's a native Azure active directory identity,
completely disjoint from any other identity systems,
you have in that particular server environment.
And you can use that to grant access
to other Azure resources, just like you would
if you had an Azure VM trying to access a key vault
or a storage account
So what you're saying basically is
that I could, for example like in active directory on prem,
we would probably have computer and user object
and with Azure active directory
and now the possibility to use Azure arc
to get that managed identity,
we basically have these objects
and we can use the Azure control plane
to assign permissions using these objects?
Yes, absolutely.
And so you mentioned earlier,
certificates as a really great example of a situation
where we often saw a lot of enterprises,
using active directory to push out certificates
onto each of their servers.
But how do you really handle that efficiently,
in a scenario where you've got tons of servers,
running potentially across multiple locations?
Let's actually head into a demo.
I think that will really show how we can pull
this managed identity together with Azure key vault
and certificate management all in one
and show how arc just by connecting
that server into Azure, really simplifies
the whole certificate management experience.
Alright.
So we are here in the Azure portal
and we're looking at my resource group
where we've got a web server, and a key vault.
And so I have a certificate in my key vault
that I wanted to deploy to that web server.
So let's see how easy it is to do that with Azure Arc.
So we'll first head over to the key vault
and take a look at the certificates
that I have uploaded there.
You'll see, I've got a certificate for devtest environments
and a certificate for production environments.
Now this web server is a production server.
So I need to go to the access policy section
and go and grant that arc enabled server permission
to read that certificate and download it to that server.
So if I go here and select
the get and list permissions for secrets,
which includes the private key of the certificate
and then search for the name of that arc enabled server,
you'll find a managed identity with the same name
that you can grant access
to this certificate in the key vault.
And so if you end up searching
and you find more than one result,
you can also use the resource graph
or our PowerShell module to go
and find the exact application ID associated
with the arc server.
So once we go ahead and save the configuration,
we know now that the managed identity for that server,
will be able to download certificates from this key vault.
So the next step is, we need to go
and actually tell arc using an Azure key vault extension
to go and synchronize the certificate down to that server.
And so this extension is pretty simple,
its job is to go and regularly check
for updates to that certificate and key vault
and download them and install them
when there are any changes.
So you'll see here in the configuration, I just told it,
here is the URI for that key vault certificate,
here is how frequently I want to check
for updates every hour in this case.
And then I went ahead and asked to go
and deploy this extension to my arc server.
When we look back in the Azure portal,
we will see the arc server here.
It has the key vault certificate extension,
in the creating state and within about five minutes
that extension will be on that server
and it will have started to synchronize down all
the certificates that you've told it to pull from key vault.
Now, at this point it's using that managed identity.
Does it grant a check
if it has access to those certificates?
So if you got this far and you forgot
to go assign permissions, it's easy.
You just go and do the part we did first
and make sure that manage identity has access.
And then you'll be able to go
and it'll automatically check again,
at the interval you specified.
So now if we go and look at that server,
now we're looking at the certificate store
for this frontend web server and windows admin center.
You'll see that I only have a certificate
for an existing certificate
that's not the web server certificate.
If I go ahead and give this five minute wait,
we'll fast forward here and show you the final result.
There we are.
Now we see that the www.tailwindtraders.com certificate,
has been synchronized to the server,
in a secure fashion using the key vault extension,
Azure Arc and Azure active directory managed identities.
Okay, that is pretty cool.
And I think that really shows the power
because it brings so many different things together.
First of all, you have obviously the Azure control plane,
you take advantage of the assigned managed identity
to the arc enabled server.
You access the key vault,
which gives you that secure storage
for your secrets and certificates.
And then you deploy actually a management extension
to the arc enabled resource to actually go out
and pull that certificate.
So that is pretty cool.
Now, since this managed identity allows me
to basically authenticate
against basically the Azure resources.
If I were a developer can also access other resources
where I use Azure active directory to authenticate?
Yeah, that's a great question.
So any application on that server
that's been arc enabled could leverage that identity
to reach out to other Azure resources.
We've fully documented this on our documentation
but let me actually show you another quick demo here
of how that works.
So I've head over into visual studio code here
from our documentation, I took out the code
that a developer could use to go and get an access token.
So an important concept of managed identity is,
you don't actually need that regularly rotating certificate
that backs the identity as an application.
You can just request from an API
that is exposed by Azure Arc on that machine,
a token to go access a specific Azure resource.
So in this case, I'm accessing Azure resource manager
and the process is pretty simple.
First, you make your request to the API
and say, hey I would like to get a token,
using our managed identity
to talk to Azure resource manager.
Now on Azure Arc, there's an extra check here.
We make sure that you are running,
as an elevated application,
or if you're part of
the connected machine extension application security group
on that machine before you can actually get that token.
So an ordinary user is not gonna be able to go
and grab this identity.
And how that is implemented, is in the response,
you'll get a challenge
and it's gonna give you a path to a file
that we've randomly generated
with some random content.
And you have to prove that you can open that file
and send that request back to us with the contents
and then you'll be able to actually get a token.
So if I just copy and paste this
over into an elevated PowerShell window here,
you'll see the first part created a file,
at the path shown on the screen.
And since I'm an administrator,
I have access to read that file.
So if I go and copy the second half of the script
which goes and takes the content of that file,
sends it back to the authentication API.
Now I got an access token
that my application could use to go reach out
to other Azure resources.
Now, this of course is kind of a rudimentary example,
to show you the flow.
This is also deeply integrated
with like the Azure.identity.net SDK.
So you don't have to worry about this.
You can just use the SDK
and have leveraged managed identity all on its own,
without having to code any of this yourself.
This really empowers basically developers
to build these hybrid and multi cloud architectures
wherever their application is running.
If they're combined running in Azure,
on premises at the edge
or even in other cloud environments.
So this is completely awesome.
Now, obviously
what often comes up in this discussion then is,
how does that work with security and compliance?
We talked a little bit about,
like how you actually can see these things in the audit logs
and stuff like that.
Can I expect, like get all
that power we have from like Azure resources,
also extended to Azure Arc enabled resources?
Absolutely, everything
that happens within Azure Arc server,
through the control plane
or whith it's managed identity will be auditable,
just like any other Azure resource.
So if you go to the activity log,
you can go and check when changes were made to the server,
perhaps someone went and deployed
that extension for key vault,
that'll be listed with the time of the event.
You can go trace that down.
And of course the benefit of Azure active directory,
is you have the backing of everything in Azure,
relying on AAD and that common identity platform
that you can use to track where,
managed identities have been used over time.
And of course it's a managed identity,
so we're taking care of the password rotation for you.
You don't have to worry
about baking any password to the code.
Your developers just have to ask to use
the token from our API.
And from there we take care of all the rest for you.
So it's honestly a easy way to improve the security
of applications that are talking to other Azure resources.
That's also simplifying it in many ways.
This again, this is great
and we will make so many compliance
and security engineers so happy.
So obviously this was very interesting
and I'm sure there's a lot more to learn.
So Ryan, where should people go
if they wanna learn more about Azure Arc?
Yeah, we got a lot of great resources out there
for just getting started.
Take a look at the Azure Arc jumpstart
which has a lot of ready to use scenarios
for a ton of common environments,
to get you onboarded to Azure Arc.
And then when you're interested in
the role-based access control and identity aspects,
definitely check out our documentation
which has a full listing
of all the information you need to know
about the managed identity,
as well as the tech community blog for Azure Arc,
where we've documented how to use
that Azure key vault extension
that's currently in public preview.
Thank you very much, Ryan, for that overview.
And again for you who are watching
if you wanna learn more
about hybrid and multi cloud architectures,
check out our cloud adoption framework,
as well as the Azure Architecture center.
(bright upbeat music)