Please enable JavaScript.
Coggle requires JavaScript to display documents.
Describe core Azure architectural components - Coggle Diagram
Describe core Azure architectural components
Overview
Resources: Resources are
instances of services
that you create, like virtual machines, storage, or SQL databases.
Resource groups: Resources are combined into resource groups, which act as a
logical
container
into which Azure resources like web apps, databases, and storage accounts are
deployed and managed.
Subscriptions: A subscription groups together user accounts and the resources that have been created by those user accounts.
For each subscription, there are limits or quotas on the amount of resources that you can create and use.
Organizations can use subscriptions to manage costs and the resources that are created by users, teams, or projects.
Management groups:
These groups help you manage access, policy, and compliance for multiple subscriptions.
All subscriptions in a management group automatically inherit the conditions applied to the management group.
Azure subscriptiosns
Using Azure requires an Azure subscription. A subscription provides you with
authenticated and authorized access to Azure products and services
. It also allows you to provision resources. An Azure
subscription is a logical unit of Azure services that links to an Azure account
, which is an identity in Azure Active Directory (Azure AD) or in a directory that Azure AD trusts.
An
account
can have
one subscription or multiple subscriptions
that have different billing models and to which you apply different access-management policies. You can use Azure subscriptions to define boundaries around Azure products, services, and resources. There are two types of subscription boundaries that you can use:
Billing boundary
: This subscription type determines how an Azure account is billed for using Azure. You can create multiple subscriptions for different types of billing requirements. Azure generates separate billing reports and invoices for each subscription so that you can organize and manage costs.
Access control boundary:
Azure applies access-management policies at the subscription level, and you can create separate subscriptions to reflect different organizational structures. An example is that within a business, you have different departments to which you apply distinct Azure subscription policies. This billing model allows you to manage and control access to the resources that users provision with specific subscriptions
Additional Azure Subscriptions
Enviroments
: separate enviroments like develpment, testing and production
Organizational structures:
Deparments
Billing
: manage and thack costs based on your nedds
Subscription limits
: Subscriptions are bound to some hard limitations. For example, the maximum number of Azure ExpressRoute circuits per subscription is 10. Those limits should be considered as you create subscriptions on your account. If there's a need to go over those limits in particular scenarios, you might need additional subscriptions.
Customize billing to meet your needs
Depending on your needs, you can set up multiple invoices within the same billing account. To do this, create additional billing profiles. Each billing profile has its own monthly invoice and payment method.
Azure management groups
manage access, policies, and compliance for those subscriptions**
. Azure management groups
provide a level of scope above subscriptions**
. You organize subscriptions into containers called management groups and apply your governance conditions to the management groups
For example, you can apply policies to a management group that limits the regions available for VM creation. This policy would be applied to all management groups, subscriptions, and resources under that management group by only allowing VMs to be created in that region.
samples
You can create a hierarchy that applies a policy. For example, you could limit VM locations to the US West Region in a group called Production. This policy will inherit onto all the Enterprise Agreement subscriptions that are descendants of that management group and will apply to all VMs under those subscriptions. This security policy can't be altered by the resource or subscription owner, which allows for improved governance.
Another scenario where you would use management groups is to provide user access to multiple subscriptions. By moving multiple subscriptions under that management group, you can create one role-based access control (RBAC) assignment on the management group, which will inherit that access to all the subscriptions. One assignment on the management group can enable users to have access to everything they need instead of scripting RBAC over different subscriptions.
Hierarchy
Important facts about management groups
10,000 management groups can be supported in a single directory.
A management group tree can support up to six levels of depth. This limit doesn't include the root level or the subscription level.
Each management group and subscription can support only one parent.
Each management group can have many children.
All subscriptions and management groups are within a single hierarchy in each directory.
Azure resources and
Azure Resource Manager
Resource
: A manageable item that's available through Azure. Virtual machines (VMs), storage accounts, web apps, databases, and virtual networks are examples of resources.
Resource group
: A container that holds related resources for an Azure solution. The resource group includes resources that you want to manage as a group. You decide which resources belong in a resource group based on what makes the most sense for your organization.
. A resource group is a logical container for resources deployed on Azure. These resources are anything you create in an Azure subscription like VMs, Azure Application Gateway instances, and Azure Cosmos DB instances.
All resources must be in a resource group, and a resource can only be a member of a single resource group.
Many resources can be moved between resource groups with some services having specific limitations or requirements to move. Resource groups can't be nested. Before any resource can be provisioned, you need a resource group for it to be placed in.
Life cycle
If you delete a resource group, all resources contained within it are also deleted. Organizing resources by life cycle can be useful in nonproduction environments, where you might try an experiment and then dispose of it. Resource groups make it easy to remove a set of resources all at once.
Azure resource manager
Benefits of using resource manager
Manage your infrastructure through declarative templates rather than scripts.
A Resource Manager template is a JSON file that defines what you want to deploy to Azure.
Deploy, manage, and monitor all the resources for your solution as a group,
rather than handling these resources individually.
Redeploy your solution throughout the development life cycle and have
confidence your resources are deployed in a consistent state.
Define the dependencies between resources so they're deployed in the correct order.
Apply access control to all services because RBAC is natively integrated into the management platform.
Apply tags to resources to logically organize all the resources in your subscription.
Clarify your organization's billing by viewing costs for a group of resources that share the same tag.
Azure regions and availability zones
Azure Regions
Resources are created in regions, which are different geographical locations around the globe that contain Azure datacenters.
Azure is made up of datacenters located around the globe. When you use a service or create a resource such as a SQL database or virtual machine (VM), you're using physical equipment in one or more of these locations. These specific datacenters aren't exposed to users directly. Instead, Azure organizes them into
regions
.
A region is a geographical area on the planet
that contains at least one but potentially multiple datacenters that are nearby and networked together with a low-latency network.
Azure intelligently assigns and controls the resources within each region to ensure workloads are appropriately balanced.
Special Azure regions
Azure has specialized regions that you might want to use when you build out your applications
for compliance or legal purposes.
A few examples include:
US DoD Central, US Gov Virginia, US Gov Iowa and more:
These regions are physical and logical network-isolated instances of Azure for U.S. government agencies and partners. These datacenters are operated by screened U.S. personnel and include additional compliance certifications
.
China East, China North, and more:
These regions are available through a unique partnership between Microsoft and 21Vianet, whereby Microsoft doesn't directly maintain the datacenters.
Azure availability zones
You want to ensure your services and data are
redundant
so you can protect your information in case of failure. When you host your infrastructure,
setting up your own redundancy requires that you create duplicate hardware environments
. Azure can help make your app highly available through availability zones.
Availability zones are physically separate datacenters within an Azure region. Each availability zone is made up of one or more datacenters equipped with independent power, cooling, and networking. An availability zone is set up to be an isolation boundary. If one zone goes down, the other continues working. Availability zones are connected through high-speed, private fiber-optic networks.
Use availability zones in your apps
Zonal services: You pin the resource to a specific zone (for example, VMs, managed disks, IP addresses).
Zone-redundant services: The platform replicates automatically across zones (for example, zone-redundant storage, SQL Database).
Not every region has support for availability zones.
Availability zones are created by using one or more datacenters. There's a minimum of three zones within a single region.
Region pair
Each Azure region is always paired with another region within the same geography (such as US, Europe, or Asia) at least 300 miles away. This approach allows for the replication of resources (such as VM storage) across a geography that helps reduce the likelihood of interruptions because of events such as natural disasters, civil unrest, power outages, or physical network outages that affect both regions at once.