Azure

Powershell - Backing up Azure Subscriptions to GitHub - Part 1

 

There can be a number of reasons for wanting to backup Azure (or Office 365) to GitHub.  As an increasing number of SaaS services (like Microsoft Sentinel) are designed for being configured and deploying Azure services through the console, traditional CI/CD code promotion doesn't work.

For some years I've been backing up my Azure subscription to Github using automated workflows.  It ensures that I can compare changes in my subscription over time and by using MarkDown I can look through backups to reference previous versions of KQL queries.

Tags

PowerShell Function - Microsoft Cloud Tokens

At times it's necessary to be able to get tokens for different Microsoft cloud platforms without having access to Developer kits or .dll modules.  This function shows how different tokens can be gained using passwords, interactive OICD login, passwords etc.

It's one of my best examples of how agile code development needs refactoring after years of ongoing updates.  It will produce a hashtable that I can use in REST calls to the various Microsoft portals like Azure or Office 365.

Tags

Azure’s YAML provisioning templates

Azure’s ARM templates have been a rite of passage for all Azure engineers.  No one who has been working with the cloud at any depth will be without late-night stories of frustration.  The Azure Resource Manager is a service that accepts specially constructed JSON templates and uses those templates to provision each object represented within.

Enabling Azure Point-to-site-VPN

Using Azure's Point-to-site vpn avoids having to expose ssh or winrm ports to the internet to get onto the systems.

Before a Point-to-site VPN can be established, a Virtual Network Gateway must be created.  This will be associated with the Virtual Network that will be accessible.

Access to the network will be controlled by certificates.

Create an Azure App Registration for Disk Encryption

Enabling Azure Disk Encryption requires the creation of a dedicated account to be able to access a Key Vault for the backup of disk encryption keys.  This occurs through enabling an Application Registration in the desired tenant and providing the associated Service Principal Key Wrap and Secret Set rights to the Key Vault in question.

Create an Azure Application & SPN with Certificate Authentication

This PowerShell code snippet creates an Azure AD application registration with an associated SPN and self-signed certificate for Azure authentication.

I've used this for generating certificates that Virtual Machines can use for authenticating to Azure as an alternative to Managed Identities.

Azure Disk Encryption Process

Architectural Overview

All virtual machine disks are accessible by WebAPI off their underlying Storage volume (either through Storage Account Access or through Snapshot usage with Managed Disks).  In the case of Storage Accounts, a single factor of access exists for retrieval of disk Images from the internet (knowledge of URI and Storage Account key).  Different controls may be implemented to reduce the threat of data loss.  Core to these controls is the requirement for all data to be encrypted at REST.