Azure

What is Azure Security Center?

Azure Security Center is an infrastructure security hygiene tool. It has a lot of recommendations around security hygiene.

Features and Benefits

Azure Security Center Standard has threat protection built-in for the resources that it monitors.

What is Azure Defender?

Azure Defender is an infrastructure security thread alert solution.

What is Azure Kubernetes Service (AKS)?

Azure Kubernetes Service is a fully managed container orchestration service based on the open-source Kubernetes system, available on the Microsoft Azure public cloud.

What is Azure Kubernetes Service (AKS)? (techtarget.com)

Log Analytics is part of the larger Azure Monitor platform.

"Production-Grade Container Orchestration"

Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications.

• A software system that allows you to deploy and manage containerized applications on top of it easily
• Exposes the underlying infrastructure as a single computational resource
• Consistent deployment experience regardless of the size of the cluster

• Enables developers to deploy their applications themselves and as often as they want
• Enables the ops team by automatically monitoring and rescheduling those apps in the event of a hardware failure
• The focus from supervising individual apps to mostly supervising and managing Kubernetes and the rest of the infrastructure
• Abstracts away the hardware infrastructure and exposes your whole data center as a single gigantic computational resource

• Kubernetes encourage Desired State deployment
• You assert you want one or more resources to be in a certain state and with specific versions
• Controllers are where the brains exist for tracking those resources and attempting to run your software as you described

• kubectl or kube ctl
• is a command-line interface for running commands against Kubernetes cluster
• kubectl <operation> <object> <resource name> <optional flags>
• kubectl get nodes
• kubectl help

• The smallest unit that Kubernetes manages
• A Pod is made up of one or more containers and information associated with those containers
• Querying a pod returns a data structure that contains information about containers and it's metadata
• Characteristics of a Pod
• All the containers for a Pod will be run on the same node
• Any container running within a Pod will share the Node's network with any other container in the same Pod
• Containers within a Pod can share files through volumes, attached to the containers
• A Pod has an explicit life cycle, and will always remain on the Node in which it was started

• Pods are collected into namespaces, which are used to group Pods
• Namespaces can e used to provide quotas and limits around resource usage and have an impact on DNS names that Kubernetes creates internal to the cluster
• If no namespace is specified when interacting with Kubernetes through kubectl, the command assumes you are working with the default namespace, named default

• A node is a machine that is added to the Kubernetes Cluster
• The master node is the brain of Kubernetes while the worker nodes do the actual work of pulling container images and running pods

Master node

Holds the control plane that controls and manages the whole Kubernetes system.

Components:

• Controller manager: performs cluster-level functions, such as replicating components, keeping track of worker nodes, handling node failures, etc.
• API Server: users and other control plane components communicate with
• etcd, is a reliable distributed data store to store the cluster configuration persistently
• Scheduler, which schedules the application, basically assigning a worker node to each deployable component of the application

Worker nodes

Run the actual applications.

Components:

• Container runtime, which can be Docker or rkt (Rocket)
• Kubelet, talks to the AI server and manages containers on its node
• Kubernetes service proxy, load balances network traffic between the application components.

• All the containers in a Pod share the Node's network
• All nodes in a Kubernetes cluster are expected to be connected to each other and share a private cluster-wide network
• Kubernetes runs containers within a Pod within this isolated network

• A ReplicaSet is associate with a Pod and indicates how many instances of that Pod should be running within the cluster
• A ReplicaSet also implies a controller that watches the ongoing state and knows how many of your Pod to keep running
• A ReplicaSet is commonly wrapped in turn by a deployment

• Kubernetes resource used to provide an abstraction through to your Pods agnostic of the specific instance that are running
• Can contain a Policy
• Emulates a software load balancer within Kubernetes

• The recommended way to run code on Kubernetes
• The deployment controller wraps around and extends the ReplicaSet controller
• Includes metadata settings to know how many Pods to keep running

• Simplifies deployment, management, and operations of Kubernetes
• Kubernetes Objects
• Azure Kubernetes Services or AKS
• It makes it quick and easy to deploy and manage containerized applications without container orchestration expertise.
• Eliminates the burden of ongoing operations and maintenance by provisioning, upgrading, and scaling resources on demand
• Master node(s) managed by Microsoft
• Access to enterprise-grade features of Micorosft Azure
• Reduces the complexity and operational overhead of managing a Kubernetes cluster by offloading much of that responsibility to Azure
• Handles critical tasks like health monitoring and maintenance for you

• Automated Kubernetes version upgrade and patching
• Easy cluster scaling
• Self-healing hosted control plane (masters)
• Cost savings

List subscriptions

az account list

Change subscription

Set context to the desired subscription

az account set -s "{subscription}"

Show current subscription

az account show

Set default resource group for all Azure CLI commands

az configure --defaults group={resource-group-name}

Get AKS credentials

az aks get-credentials --name {aks-cluster-name}

Download and install kubectl

az aks install-cli

Get the deployments

kubectl get deployments

Delete deployments

kubectl delete deployment {deployment_name}

Samples

Sample to expose an endpoint

kubectl expose deployment {app_name} --type=LoadBalancer --port=80 --target-port=80

Azure Sentinel can only be enabled for a single Log Analytics Workspace. Therefore it is recommended to centralize all security logs to a dedicated central workspace. Use Azure Lighthouse if you have multiple workspaces.

To create Azure Sentinel, an active subscription and a Log Analytics workspace need to be available.

The permissions required

• Contributor on Subscription level
• Contributor or Reader on Resource Group or Resource level

Resource

• Step-by-Step Guide to Deploy Azure Sentinel

Get the resource ID for the existing AKS cluster

Get the resource ID:

SP_ID=$(az aks show --resource-group aksrg --name pdtaks\
    --query servicePrincipalProfile.clientId -o tsv)
az ad sp credential list --id $SP_ID --query "[].endDate" -o tsv

From: AKS ErrImagePull and ImagePullBackOff on AKS after a year

What is Azure Resource Graph?

Azure Resource Graph is a service in Azure that is designed to extend Azure Resource Management by providing efficient and performant resource exploration with the ability to query at scale across a given set of subscriptions so that you can effectively govern your environment.

These queries provide the following features:

• Ability to query resources with complex filtering, grouping, and sorting by resource properties.
• Ability to iteratively explore resources based on governance requirements.
• Ability to assess the impact of applying policies in a vast cloud environment.
• Ability to detail changes made to resource properties (preview).

What is Azure Resource Graph?

By default, the kubectl command for Kubernetes uses parameters from the current context to communicate with the cluster.

Display the current context:

$ kubectl config current-context

List all contexts in a kubeconfig file:

$ kubectl config get-contexts

Switch context:

$ kubectl config use-context <context_name>

A Pod is a group of one or more containers with shared storage, network, and lifecycle and is the basic deployable unit in Kubernetes.

How to get detailed information about Pods using kubectl command.

List Pods in the default Namespace for the current context:

$ kubectl get pods
$ kubectl get pods -o wide

List all Pods from the all Namespace:

$ kubectl get pods --all-namespaces

Get Pods from a particular Namespace:

$ kubectl get pods --namespace <namespace-name>

Get detailed information about a Pod

$ kubectl describe pods <pod-name>

In general, I see two approaches

• Start with App Services for all applications, and only if the complexity and orchestration needs exceed the limits, then go for AKS. This would be my approach as I don’t see either/or, but I would leverage their individual strengths.
• Or if they already plan to introduce a sophisticated AKS infrastructure, then use leverage this (I have the feeling that some at Swiss Re try to go into this direction)

What do/would I consider

• General: have simple applications with just a few Web Apps I would go with App Services, but for a more complex microservice architecture, I would consider AKS.
• Is there a strategic decision already taken
• Is there a Multi-Cloud strategy and need to leverage knowledge (infrastructure) across clouds, then it could make sense to go with AKS as this is more provider agnostic
• If there is no Kubernetes knowledge available, App Services would be simpler to start with
• If you have an Application with just a front-end (maybe SPA) and API backend, then App Services would be preferable
• If it is a containerized application with a lot of containers that need orchestration, then AKS could help
• What Customers need to understand is that there are much more management activities they need to take care of when using AKS compared to App Service. AKS is closer to an IaaS platform from that point of view. So as long as their needs can be met with App Service, I think it’s a much less painful choice compared to AKS.

Azure Purview is a unified data governance service that helps you manage and govern your on-premises, multi-cloud, and software-as-a-service (SaaS) data. Easily create a holistic, up-to-date map of your data landscape with automated data discovery, sensitive data classification, and end-to-end data lineage. Empower data consumers to find valuable, trustworthy data.

Azure Purview

Establish the foundation for effective data usage and governance with Purview Data Map.

• Automate and manage metadata from hybrid sources.
• Classify data using built-in and custom classifiers and Microsoft Information Protection sensitivity labels.
• Label sensitive data consistently across SQL Server, Azure, Microsoft 365, and Power BI.
• Easily integrate all your data systems using Apache Atlas APIs.

Azure Sentinel is a next-generation Security Information and Event Management (SIEM) and Security Operation Automation Response (SOAR) solution provided by Microsoft.

• Data Collection
• Threat Detection
• Threat Investigation
• Rapid Response

• Automatically scaling to meet the data collection and storage requirements
• Integrate directly with Microsoft Intelligent Security Graph
• Include advanced anomaly detections using Microsoft machine learning
• Leveraging automation capability for investigating and responding to alerts
• Provide intuitive dashboard and querying capabilities

Types

• Native or service to service integrates directly with resources across the Microsoft product range. This is the preferred method for ingestion
• API
• Agent-Based
• Direct

Azure Sentinel

A cloud-based SIEM and SOAR solution that depends on various security solutions to provide threat detection, investigation, hunting, and automated response capabilities.

Azure Security Center

A Cloud Security Posture Management and Cloud Workload Platform Protection solution.

Complements Azure Sentinel

Types of Analytic Rules

• Scheduled rules run on a set schedule to detect suspicious events
• Microsoft Security rules are used to create Azure Sentinel incidents from alerts generated from other Microsoft Security solutions
• Machine learning behavioral analytics rules can only be created from templates provided and use proprietary Microsoft machine learning algorithms
• Fusion is a Microsoft machine learning technology to combine information from various sources to generate alerts

K9s provides a terminal UI to interact with your Kubernetes clusters. This project aims to make it easier to navigate, observe, and manage your applications in the wild. K9s continually watches Kubernetes for changes and offers subsequent commands to interact with your observed resources.

K9s - Manage Your Kubernetes Clusters In Style (k9scli.io)

Manging and Investigating Incidents

An incident

• is created based on alerts
• can be based on first-party analytics from Microsoft Security Solutions
• can also be created via a bookmark
• can include one or multiple alerts
• contains evidence that can be used for further investigation

Azure Logic Apps is a cloud service that helps you schedule, automate, and orchestrate tasks, business processes, and workflows.

Azure Monitor Private Link Scope (AMPLS) connects private endpoints (and the VNets contained in) to one or more Azure Monitor resources - Log Analytics workspaces and Application Insights components.

Azure Arc simplifies governance and management by delivering a consistent multi-cloud and on-premises management platform. Azure Arc enables you to:

• Manage your entire environment, with a single pane of glass, by projecting your existing non-Azure, on-premises, or other cloud resources into Azure Resource Manager.
• Manage virtual machines, Kubernetes clusters, and databases as if they are running in Azure.
• Use familiar Azure services and management capabilities, regardless of where they live.
• Continue using traditional ITOps, while introducing DevOps practices to support new cloud-native patterns in your environment.
• Configure Custom Locations as an abstraction layer on top of Azure Arc enabled Kubernetes cluster, cluster connect, and cluster extensions.

Today, Azure Arc allows you to manage the following resource types hosted outside of Azure:

• Servers - both physical and virtual machines running Windows or Linux.
• Kubernetes clusters - supporting multiple Kubernetes distributions.
• Azure data services - Azure SQL Managed Instance and PostgreSQL Hyperscale services.
• SQL Server - enroll instances from any location.

For further information visit Azure Arc overview.

Azure Key Vault is a cloud service for securely storing and accessing secrets. A secret is anything you want to tightly control access to, such as API keys, passwords, certificates, or cryptographic keys. Key Vault service supports two types of containers: vaults and managed hardware security module(HSM) pools. Vaults support storing software and HSM-backed keys, secrets, and certificates. Managed HSM pools only support HSM-backed keys. See Azure Key Vault REST API overview for complete details.

Application Insights can monitor Azure cloud service apps for availability, performance, failures, and usage by combining data from Application Insights SDKs with Azure Diagnostics data from your cloud services. With the feedback you get about the performance and effectiveness of your app in the wild, you can make informed choices about the direction of the design in each development lifecycle.

Application Insights, a feature of Azure Monitor, is an extensible Application Performance Management (APM) service for developers and DevOps professionals. Use it to monitor your live applications. It will automatically detect performance anomalies and includes powerful analytics tools to help you diagnose issues and understand what users actually do with your app. It's designed to help you continuously improve performance and usability. It works for apps on various platforms, including .NET, Node.js, Java, and Python hosted on-premises, hybrid, or any public cloud. It integrates with your DevOps process and has connection points to a variety of development tools. It can monitor and analyze telemetry from mobile apps by integrating with Visual Studio App Center.

Log Analytics is a tool in the Azure portal used to edit and run log queries with data in Azure Monitor Logs. You may write a simple query that returns a set of records and then use features of Log Analytics to sort, filter, and analyze them. Or you may write a more advanced query to perform statistical analysis and visualize the results in a chart to identify a particular trend. Whether you work with the results of your queries interactively or use them with other Azure Monitor features such as log query alerts or workbooks, Log Analytics is the tool that you're going to use to write and test them.

For further details, visit Overview of Log Analytics in Azure Monitor.

For many organizations, the Azure landing zone conceptual architecture below represents the destination in their cloud adoption journey. It's a mature, scaled-out target architecture intended to help organizations operate successful cloud environments that drive their business while maintaining best practices for security and governance.

Source: What is an Azure landing zone? - Cloud Adoption Framework | Microsoft Docs

A landing zone is an environment for hosting your workloads, pre-provisioned through code.

What is App Service

Azure App Service is an HTTP-based service for hosting web applications, REST APIs, and mobile back ends. You can develop in your favorite language, be it .NET, .NET Core, Java, Ruby, Node.js, PHP, or Python. Applications run and scale with ease on both Windows and Linux-based environments.

App Service not only adds the power of Microsoft Azure to your application, such as security, load balancing, autoscaling, and automated management. You can also take advantage of its DevOps capabilities, such as continuous deployment from Azure DevOps, GitHub, Docker Hub, and other sources, package management, staging environments, custom domain, and TLS/SSL certificates.

With App Service, you pay for the Azure compute resources you use. The compute resources you use are determined by the App Service plan that you run your apps on. For more information, see Azure App Service plans overview.

For further information visit App Service overview

Logic apps are not well suited for large files.

• Depending on the connector, they support either 100MB or 1GB (with chunking).
• The file adapter limit is 30 MB and doesn’t support compression.

Further details can be found at Limits and configuration reference for Azure Logic Apps.

Limitation in low latency scenarios

Further Azure Data Factory Limits.

Octant is an open-source developer-centric web interface for Kubernetes that lets you inspect a Kubernetes cluster and its applications.

Website: Octant

Durable Functions scales as needed and provides a cost-effective means of implementing complex workflows in the cloud. Some benefits of using Durable Functions include:

• They enable you to write event-driven code. A durable function can wait asynchronously for one or more external events and then perform a series of tasks in response to these events.
• You can chain functions together. You can implement common patterns such as fan-out/fan-in, which uses one function to invoke others in parallel, and then accumulate the results.
• You can orchestrate and coordinate functions and specify the order in which functions should execute.
• The state is managed for you. You don't have to write your own code to save state information for a long-running function.

You can use three durable function types: Client, Orchestrator, and Activity.

• Client functions are the entry point for creating an instance of a Durable Functions orchestration. They can run in response to an event from many sources, such as a new HTTP request arriving, a message being posted to a message queue, an event arriving in an event stream. You can write them in any of the supported languages.
• Orchestrator functions describe how actions are executed and the order in which they are run. You write the orchestration logic in code (C# or JavaScript).
• Activity functions are the basic units of work in a durable function orchestration. An activity function contains the actual work performed by the tasks being orchestrated.

A trigger is an object that defines how an Azure Function is invoked. For example, if you want a function to execute every 10 minutes, you can trigger a timer.

Every function must have exactly one trigger associated with it. If you want to execute a logic that runs under multiple conditions, you need to create multiple functions that share the same core function code.

Azure Functions support a wide range of trigger types. Some of the most common types:

• Timer: Execute a function at a set interval.
• HTTP: Execute a function when an HTTP request is received.
• Blob: Execute a function when a file is uploaded or updated in Azure Blob storage.
• Queue: Execute a function when a message is added to an Azure Storage queue.
• Azure Cosmos DB: Execute a function when a document changes in a collection.
• Event Hub: Execute a function when an event hub receives a new event.

A binding is a connection to data within your function. Bindings are optional and can be input bindings, output bindings, or both. An input binding is the data that your function receives. An output binding is the data that your function sends.

Unlike a trigger, a function can have multiple input bindings and output bindings.

Azure API Management (APIM) helps organizations unlock the potential of their data and services by publishing APIs to external partners and internal developers.

APIM is made up of the following components:

• API Gateway
• Azure Portal
• Developer Portal

The API gateway is the endpoint that:

• Accepts API calls and routes them to the backend.
• Verifies API keys, JWT tokens, certificates, and other credentials.
• Enforces usage quotas and rate limits.
• Transforms your API on the fly without code modifications.
• Caches backend responses where set up.
• Logs call metadata for analytics purposes.

The Azure portal is the administrative interface where you set up your API program. You can also use it to:

• Define or import API schema.
• Package APIs into products.
• Set up policies such as quotas or transformations on the APIs.
• Get insights from analytics.
• Manage users.

The Developer portal serves as the main web presence for developers. From here they can:

• Read API documentation.
• Try out an API via the interactive console.
• Create an account and subscribe to get API keys.
• Access analytics on their own usage.

Azure Kubernetes Service allows you to deploy a production-ready Kubernetes cluster in Azure quickly.

Azure Database for PostgreSQL is a fully managed relational database service based on the community edition of the open-source PostgreSQL database engine.

Your default choice for new Azure Cosmos DB accounts should be Core (SQL). However, it would help if you also considered the following situations:

If your data is better represented in a graph, the Gremlin (graph) API might be a good choice.

If you already have an existing application or database using one of the other APIs, then the current API might be a better choice for your specific scenario. Using the current API might make it easier to:

• Migrate your application or database to Azure Cosmos DB
• Reuse your existing code with minimal changes
• Leverage the existing knowledge and experience of your development team.

You should only use the Azure Table API if you migrate from Azure Table Storage, as Core (SQL) offers far more features and flexibility.

Some of the concepts in Azure Cosmos DB:

• Database account is a container for one or more Azure Cosmos DB databases.
• Database is a container for one or more collections
• Collections are like tables in relational databases without a schema. A collection contains documents.
• Documents are an unstructured set of key/value pairs, read and written in JSON format. They are the logical unit and which is roughly equivalent to a relational row. Documents of similar types are organized into collections.
• Partitioning is the distribution and grouping of your data across the underlying resources.
• Index is a catalog of document properties and their values. 
• Request Units (RUs) measures the throughput at which rate data is processed. RU is the amount of CPU, disk I/O, and memory required to read 1 KB of data in 1 second.

Additional insights can be found at How To Design And Query Data In Cosmos DB (c-sharpcorner.com)

Create an Azure Cosmos DB account running the following command

az cosmosdb create --resource-group {RESOURCE_GROUP} --name {COSMOS_NAME}

Run the following command to store the Cosmos DB endpoint in an environment variable.

export ENDPOINT=$(az cosmosdb list --resource-group {RESOURCE_GROUP} --output tsv --query [0].documentEndpoint)

Run the following command to store the access key in an environment variable:

export KEY=$(az cosmosdb keys list --resource-group {RESOURCE_GROUP} --name {COSMOS_NAME} --output tsv --query primaryMasterKey)

Run the following command to create a database called in your Azure Cosmos DB account. 

az cosmosdb sql database create --resource-group {RESOURCE_GROUP} --account-name {COSMOS_NAME} --name {DATABASE_NAME}

Create a collection running the following command.

We use the id as the partition key and configure 100 request units per second (RU/s).

az cosmosdb sql container create --resource-group {RESOURCE_GROUP} --account-name {COSMOS_NAME} --database-name {DATABASE_NAME} --name {COLLECTION_NAME} --partition-key-path /id --throughput 100

In this overview video I cover the basics of containers, Kubernetes, the Azure Kubernetes Service (AKS) and how all the pieces fit together!

Bicep provides the following advantages over other options:

• Support for all resource types and API versions: Bicep immediately supports all preview and GA versions for Azure services. As soon as a resource provider introduces new resources types and API versions, you can use them in your Bicep file. You don't have to wait for tools to be updated before using the new services.
• Simple syntax: When compared to the equivalent JSON template, Bicep files are more concise and easier to read. Bicep requires no previous knowledge of programming languages. Bicep syntax is declarative and specifies which resources and resource properties you want to deploy.
• Authoring experience: When you use VS Code to create your Bicep files, you get a first-class authoring experience. The editor provides rich type-safety, IntelliSense, and syntax validation.
• Modularity: You can break your Bicep code into manageable parts by using modules. The module deploys a set of related resources. Modules enable you to reuse code and simplify development. Add the module to a Bicep file anytime you need to deploy those resources.
• Integration with Azure services: Bicep is integrated with Azure services such as Azure Policy, template specs, and Blueprints.
• No state or state files to manage: All state is stored in Azure. Users can collaborate and have confidence their updates are handled as expected. Use the what-if operation to preview changes before deploying your template.
• No cost and open source: Bicep is completely free. You don't have to pay for premium capabilities. It's also supported by Microsoft support.

• Set up Bicep development and deployment environments - Azure Resource Manager | Microsoft Docs
• GitHub - Azure/vscode-remote-try-bicep
• Discover Bicep on Microsoft Learn - Azure Resource Manager | Microsoft Docs
• Create Bicep files - Visual Studio Code - Azure Resource Manager | Microsoft Docs
• Bicep & ARM template reference to learn about the resources that are available in your Bicep file
• Bicep GitHub repo

Private Azure Kubernetes Service Cluster

In a private cluster, the control plane or API server has internal IP addresses that are defined in the RFC1918 - Address Allocation for Private Internet document. Using a private cluster lets you ensure network traffic between your API server and your node pools remains on the private network only.

Create a private Azure Kubernetes Service cluster - Azure Kubernetes Service | Microsoft Docs

Provide the requirements of your AKS deployment to generate the assets to create a fully operational environment, incorporating best-practices guidance.

Sign in interactively

The Azure CLI's default authentication method for logins uses a web browser and access token to sign in.

az login

If the CLI can open your default browser, it will do so and load an Azure sign-in page. Otherwise, open a browser page at https://aka.ms/devicelogin and enter the authorization code displayed in your terminal. Sign in with your account credentials in the browser.

If no web browser is available or the web browser fails to open, use device code flow with az login --use-device-code.

Sign in with a different tenant

You can select a tenant to sign in under with the --tenant argument. The value of this argument can either be an .onmicrosoft.com domain or the Azure object ID for the tenant. Both interactive and command-line sign in methods work with --tenant.

az login --tenant {tenant}

Additional details can be found at Sign in with Azure CLI — Login and Authentication | Microsoft Docs

Log into Azure using a Service Principal

az login --service-principal --username {SPN_CLIENT_ID} --password {SPN_CLIENT_SECRET} --tenant {SPN_TENANT_ID}

PuTTY is a free implementation of SSH and Telnet for Windows and Unix platforms, along with an xterm terminal emulator. It is written and maintained primarily by Simon Tatham.

Download PuTTY: latest release (0.76) (greenend.org.uk)

The Azure Redis Cache offers the following pricing tiers with different features, performance, and budgets:

Basic

The Basic cache is a single node cache that is ideal for development/test and non-critical workloads. There’s no SLA (Service Level Agreement is Microsoft’s commitment for uptime and connectivity). The basic tier has different options to choose from C0 to C6. The lowest option is C0, and this is in a shared infrastructure. Everything above C0 provides dedicated service, i.e., this does not share infrastructure with other customers.

• Minimal feature set
• A single node
• No SLA
• Development and test

Standard

This tier offers an SLA and provides a replicated cache. The data is automatically replicated between the two nodes — ideal for production-level applications.

• 2 Replicated nodes (primary-secondary pair)
• 99.9% availability
• 53 GB of memory
• 20000 clients

Premium

The Premium tier has all the standard features and, also, it provides better performance, bigger workloads, enhanced security, and disaster recovery. Backups and Snapshots and can be created and restored in case of failures. It also offers Redis Persistence, which persists data stored inside the cache. It also provides a Redis Cluster, which automatically shares data across multiple Redis nodes. Hence this allows creating workloads of bigger memory sizes and get better performance. It also offers support for Azure Virtual Networks, which gives the ability to isolate the cache by using subnets, access control policies, and other features.

• Redis cluster
• Low latency
• 99.95% availability
• 40000 clients

Enterprise

• The full Redis feature set
• 99.99% availability

Enterprise Flash

• Fast non-volatile storage

• Watch out for data loss. Never rely on a key being present. It may have expired or been evicted.
• Set expiry times to manage the content lifetime.
• Add jitter to spread database load that is varying the expiry time to spread the load on origin.
• Avoid caching large objects and consider breaking them down into smaller separate objects.
• Host Redis in the same region as the application
• As a security best practice, do not enable non-SSL port connection as all data that will pass through that connection would not be encrypted.

Redis CLI

The Redis Command Line interface is a very popular command-line tool that is used to connect to Redis Cache and do several management operations.

Redis-benchmark utility

The Redis-benchmark utility is a special tool available through the Redis CLI that simulates some load on a Redis Cache instance. It runs a set of tests against the instance, simulating a number of connected clients, and gives a way to ensure that the cache is provisioned at the correct scale.

Redis-benchmark -q -n 10000

It is recommended to create a virtual machine that contains the Redis CLI and execute it from there.

stunnel

stunnel is a simple utility that will take non-SSL connections and tunnel them through SSL so that a tool like Redis CLI, which does not natively support SSL, can still connect through an SSL endpoint.

Data Encryption

Encryption in Transit

Encryption in Transit is the security of the messages sent between the application and the cache itself. The transport-level security is provided by TLS, and out-of-the-box Redis uses TLS 1.2 but also supports TLS 1.1 for compatibility purposes. HTTP connections are disabled by default as this is not recommended.

Encryption at Rest

In-memory data is not encrypted, so Redis encryption is not implemented and is not supported on Azure.

With premiums tiers, the data can be persistent and backed up to an Azure Storage account. For this data at rest, encryption is enabled and by default uses Microsoft-managed keys.

Azure Redis Cache is a high-throughput, low-latency, secure managed service based on the open-source in-memory Redis Cache.

It is commonly deployed in front of databases or storage as a way to speed up data access for applications or servers.

Protocol: TCP

Port: 6379 or 6380 (SSL)

Server name: {unique name}.redis.cache.windows.net

Azure Redis Cache offers the following Network Security Options:

• Public Endpoint is an internet-facing endpoint with a firewall
• Resource Inside the VNET with the Premium Redis Cache option

At this point, Redis Cache is not offering service or private endpoints.

Proper firewall configuration is critical, especially for basic or standard Azure Redis caches because they have public endpoints and are reachable through the internet.

Authentication

Shared keys are used to connect to Redis Cache. Shared, and there is no identity authentication.

Shared keys are like the root password of the cache. There are always two active keys.

Shared Keys need to be stored securely as they provide full access to the cache, like using Azure Key Vault.

Azure Redis Cache supports storing data in various formats. It supports data structures like Strings, Lists, Sets, and Hashes.

• Strings: Redis strings are binary safe and allow them to store any type of data with serialization. The maximum allowed string length is 512MB. It provides some useful commands like Incr, Desr, Append, GetRange, SetRange, and other useful commands.
• Lists: Lists are lists of Strings, sorted by insertion order. It allows adding elements at the beginning or end of the list. It supports constant time insertion and deletion of elements near the beginning or end of the list, even with many millions of inserted items.
• Sets: These are also lists of Strings. The unique feature of sets is that they don’t allow duplicate values. There are two types of sets: Ordered and Unordered Sets.
• Hashes: Hashes are objects containing multiple fields. The object allows storing as many fields as required.

General Tipps for Application Insights Portal View

• Some views and blades are cached, and you will not see any updates. You need to refresh the page to see the updated calculation.

The following code snippet shows how to configure AddApplication Insights Telemetry.

public void ConfigureServices(IServiceCollection services)
{
    // ...
    services.AddSingleton<ITelemetryInitializer, CustomAppInsightsInitializer>(); // server side to track the requests and dependencies
    ApplicationInsightsServiceOptions options = new ApplicationInsightsServiceOptions()
    {
        EnableAuthenticationTrackingJavaScript = true, // enable client side to track pageviews
        ConnectionString = "InstrumentationKey={key};IngestionEndpoint=https://westeurope-1.in.applicationinsights.azure.com/"
    };
    services.AddApplicationInsightsTelemetry();

    services.AddRazorPages(options =>
        // ...
}

Telemetry Initializers set context properties that are sent along with every item of telemetry.

You can write your own initializers to set context properties.

The standard initializers are all set either by the Web or WindowsServer NuGet packages and can be found at ApplicationInsights.config reference - Azure - Azure Monitor | Microsoft Docs.

Examples of standard initializers are:

• AccountIdTelemetryInitializer sets the AccountId property.
• AuthenticatedUserIdTelemetryInitializer sets the AuthenticatedUserId property as set by the JavaScript SDK.

The setAuthenticatedUserContext API has optional parameters. When setting storeInCookie to true, the ai_authuser cookie is set, so every request is sent with the authenticatedUserId.

But when using appInsights.setAuthenticatedUserContext(userName, null, true) the back-end side in ASP.NET Core doesn't set the Auth Id context property with the default initializers (in this case the AuthenticatedUserIdTelemetryInitializer).

Some additional discussion can be found at Add option EnableAuthenticationTracking to add AuthenticatedUserId to telemetries · Issue #1431 · microsoft/ApplicationInsights-dotnet · GitHub