Subscription Vending

Subscription Vending in Azure: A Detailed Summary

Key Concepts:

• Subscription: Billing boundary, permission boundary, quota and limit container in Azure.
• Shared Subscriptions: Centralized management of a small number of subscriptions shared across multiple applications.
• Dedicated Subscriptions: Each application or workload has its own subscription.
• Azure Landing Zones: Best practice framework for organizing Azure environments.
• Platform Elements: Foundational components of Azure Landing Zones managed by the infrastructure/ops team.
• Application Components: Where application workloads are deployed, including subscriptions and related resources.
• Subscription Vending: Automated process for creating and configuring Azure subscriptions based on application requirements.
• Azure Verified Modules: Microsoft-maintained modules containing resources to make a service useful.
• Parameter File: Contains unique configuration details for creating or modifying a subscription.
• Infrastructure as Code (IaC): Managing and provisioning infrastructure through code (e.g., Terraform, Bicep).
• Role-Based Access Control (RBAC): Managing access permissions to Azure resources.
• Privileged Identity Management (PIM): Just-in-time elevation of privileges for specific tasks.
• Azure Virtual Network Manager (AVNM): Centralized management of virtual networks.

1. Subscription Fundamentals and Organizational Approaches

• Subscription as a Boundary: An Azure subscription acts as a billing boundary, a permission boundary, and a container for quotas and limits. Virtual networks cannot span subscriptions.
• Shared Subscriptions (Small Number):
  • Pros: Strong central control over resources.
  • Cons:
    • Shared quotas and limits can hinder scaling.
    • Granular RBAC becomes challenging.
    • App teams lose flexibility in resource provider usage and configuration.
    • Tracking compliance for individual workloads is difficult.
    • Service health alerts may not be specific to individual applications.
• Dedicated Subscriptions (Large Number):
  • Pros:
    • Each app has its own limits and quotas, enabling better scaling.
    • Granular RBAC.
    • Greater flexibility for app teams.
    • Easier compliance tracking.
    • Service health alerts are specific to the workload.
  • Cons:
    • Potential lack of central governance.
    • Inconsistent connectivity approaches across different app teams.
    • Challenges in connecting to central resources or on-premises environments.

2. Azure Landing Zones and Application Components

• Azure Landing Zones: A best-practice approach for organizing Azure environments.
• Platform Elements: Managed by the infrastructure/ops team, providing foundational services.
• Application Components: Where application workloads reside, including subscriptions, connectivity, DevOps components, and core services.
• Application Landing Zone Requirements: Subscriptions, connectivity, DevOps integration, and core services.

3. Subscription Vending: The Solution

• Purpose: To streamline subscription creation and configuration, addressing the challenges of dedicated subscriptions while maintaining central governance.
• Data Collection:
  • A data collection mechanism (e.g., Power Platform form, ticketing system) gathers parameters from app teams.
  • These parameters define the desired configuration for the subscription.
• Parameter File:
  • The collected data is used to create a parameter file.
  • This file drives the creation or modification of the subscription.
• Azure Verified Module:
  • The parameter file is used with an Azure Verified Module (Bicep or Terraform).
  • Azure Verified Modules are maintained by Microsoft and contain the necessary resources for a service.
• Subscription Creation/Modification:
  • A trigger (based on form submission or other event) initiates the process.
  • The Azure Verified Module uses the parameter file to create a new subscription or modify an existing one.
• Configuration Capabilities:
  • Setting tags.
  • Moving the subscription to a specific management group.
  • Enabling resource providers.
  • Setting up RBAC (including PIM).
  • Deploying virtual networking (potentially integrating with IPAM).
  • Setting up peering to a hub network.
  • Configuring DDoS protection plans.
  • Deploying NAT gateway for egress.
  • Deploying Azure Bastion for secure access.

4. Subscription Vending Workflow and Implementation

• Data Collection Interface: The system is non-prescriptive about how parameters are collected, allowing flexibility in using existing ticketing systems or custom forms.
• Parameter File Examples: The video shows examples of parameters that can be collected, such as subscription display name, alias, workload type, tags, management group IDs, virtual network settings, and RBAC configurations.
• Deployment: The Azure CLI or PowerShell can be used to deploy the subscription using the parameter file and the main file (which calls the Azure Verified Module).
• Integration with DevOps:
  • A Git repository can be used to store parameter files.
  • Each subscription vending request can create a new branch in the repository.
  • Committing the parameter file to the branch can trigger a CI/CD pipeline (e.g., GitHub Actions) to create or update the subscription.
  • This provides version control and auditability.
• Declarative Infrastructure as Code: Because Terraform and Bicep are declarative, changes to the parameter file can be used to update the subscription to the desired state.

5. Benefits and Conclusion

• Democratization of Subscriptions: Enables each workload to have its own subscription, promoting flexibility and scalability.
• Centralized Control and Governance: Subscription vending allows for stamped configurations, consistent connectivity, and centralized management.
• App Team Productivity: App teams can focus on their application requirements, while the subscription vending process handles the infrastructure setup.
• Best of Both Worlds: Combines app team flexibility with central visibility and control, ensuring compliance with organizational requirements.

Notable Quotes:

• "Subscriptions are obviously one of the core building blocks in Azure."
• "The whole point of this video was to just talk through the direction we're going today is really democratizing the subscriptions."

Technical Terms:

• Subscription Alias: A friendly name for a subscription.
• Management Group: A container for managing access, policy, and compliance across multiple Azure subscriptions.
• Resource Provider: A service that offers Azure resources.
• Hub and Spoke Network: A network topology where spoke virtual networks connect to a central hub virtual network.
• NAT Gateway: A managed service that provides outbound internet connectivity for virtual network resources.
• Azure Bastion: A managed service that provides secure RDP/SSH access to virtual machines without exposing them to the public internet.

Synthesis/Conclusion:

Subscription vending is a powerful approach to managing Azure subscriptions in a modern, cloud-native environment. By automating the creation and configuration of subscriptions based on application requirements, organizations can empower app teams while maintaining central governance and control. The use of Azure Verified Modules, Infrastructure as Code, and integration with DevOps practices makes subscription vending a scalable and efficient solution for managing Azure resources.