Skip to content

Commit

Permalink
Merge pull request #479 from MicrosoftDocs/repo_sync_working_branch
Browse files Browse the repository at this point in the history
Confirm merge from repo_sync_working_branch to master to sync with https://github.com/microsoftdocs/architecture-center (branch master)
  • Loading branch information
Taojunshen authored Aug 27, 2019
2 parents a6432c8 + 4f619b2 commit 631868d
Show file tree
Hide file tree
Showing 11 changed files with 19 additions and 12 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ This article is intended to help you quantify business risk tolerance as it rela

Cost Management generally focuses on metrics related to costs. As part of your risk analysis, you'll want to gather data related to your current and planned spending on cloud-based workloads to determine how much risk you face, and how important investment in cost governance is to your cloud adoption strategy.

The following are examples of useful metrics that you should gather to help evaluate risk tolerance within the Security Baseline discipline:
The following are examples of useful metrics that you should gather to help evaluate risk tolerance within the Cost Management discipline:

- **Annual spending:** The total annual cost for services provided by a cloud provider.
- **Monthly spending:** The total monthly cost for services provided by a cloud provider.
Expand All @@ -41,7 +41,7 @@ Once you have identified [business risks](./business-risks.md), you will work wi
- **Overprovisioned trigger:** A company who believes their deployed solutions are overprovisioned. Cost Management is a priority investment until they can demonstrate proper alignment of provisioning and asset utilization.
- **Monthly spending trigger:** A company that spends over $x,000 per month is considered a sizable cost. If spending exceeds that amount in a given month, they will need to invest in Cost Management.
- **Annual spending trigger:** A company with an IT R&D budget that allows for spending $X,000 per year on cloud experimentation. They may run production workloads in the cloud, but they will still be considered experimental solutions if the budget doesn't exceed that amount. Once it goes over, they will need to treat the budget like a production investment and manage spending closely.
- **Operating expense-adverse (uncommon):** As a company, they are adverse to operating expenses and will need Cost Management controls in place before deploying a dev/test workload.
- **Operating expense-adverse (uncommon):** As a company, they are averse to operating expenses and will need Cost Management controls in place before deploying a dev/test workload.

## Next steps

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,7 @@ The following changes to policy will help remediate the new risks and guide impl
5. During deployment planning, any required cloud resources associated with the hosting of production workloads should be documented. This documentation will help refine budgets and prepare additional automation tools to prevent the use of more expensive options. During this process consideration should be given to different discounting tools offered by the cloud provider, such as Reserved Instances or License cost reductions.
6. All application owners are required to attend trained on practices for optimizing workloads to better control cloud costs.


## Incremental improvement of the best practices

This section of the article will improve the governance MVP design to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ The following narrative establishes a use case for [governance during large ente

Customers are demanding a better experience when interacting with this company. The current experience caused market erosion and led to the board to hire a Chief Digital Officer (CDO). The CDO is working with marketing and sales to drive a digital transformation that will power improved experiences. Additionally, several business units recently hired data scientists to farm data and improve many of the manual experiences through learning and prediction. IT is supporting these efforts where it can. However, there are "shadow IT" activities occurring that fall outside of needed governance and security controls.

The IT organization is also facing its own challenges. Finance is planning continued reductions in the IT budget over the next five years, leading to some necessary spending cuts starting this year. Conversely, GDPR and other data sovereignty requirements are forcing IT to invest in assets in additional countries to localize data. Two of the existing datacenters are overdue for hardware refreshes, causing further problems with employee and customer satisfaction. Three more datacenters require hardware refreshes during the execution the five-year plan. The CFO is pushing the CIO to consider the cloud as an alternative for those datacenters, to free up capital expenses.
The IT organization is also facing its own challenges. Finance is planning continued reductions in the IT budget over the next five years, leading to some necessary spending cuts starting this year. Conversely, GDPR and other data sovereignty requirements are forcing IT to invest in assets in additional countries to localize data. Two of the existing datacenters are overdue for hardware refreshes, causing further problems with employee and customer satisfaction. Three more datacenters require hardware refreshes during the execution of the five-year plan. The CFO is pushing the CIO to consider the cloud as an alternative for those datacenters, to free up capital expenses.

The CIO has innovative ideas that could help the company, but she and her teams are limited to fighting fires and controlling costs. At a luncheon with the CDO and one of the business unit leaders, the cloud migration conversation generated interest from the CIO's peers. The three leaders aim to support each other using the cloud to achieve their business objectives, and they have begun the exploration and planning phases of cloud adoption.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -73,8 +73,10 @@ The following changes to policy will help remediate the new risks and guide impl

## Incremental improvement of the best practices


This section of the article will improve the governance MVP design to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements.


Following the experience of this fictional example, it is assumed that the Protected Data changes have already occurred. Building on that best practice, the following will add operational monitoring requirements, readying a subscription for mission-critical applications.

**Corporate IT subscription:** Add the following to the Corporate IT subscription, which acts as a hub.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -93,8 +93,10 @@ The following changes to policy will help remediate the new risks and guide impl

## Incremental improvement of the best practices


This section of the article will change the governance MVP design to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements.


The new best practices fall into two categories: Corporate IT (hub) and Cloud Adoption (spoke).

**Establishing a corporate IT hub and spoke subscription to centralize the Security Baseline:** In this best practice, the existing governance capacity is wrapped by a [hub and spoke topology with shared services][shared-services], with a few key additions from the cloud governance team.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -76,8 +76,10 @@ The following changes to policy will help remediate the new risks and guide impl

## Incremental improvement of governance practices


This section of the article will change the governance MVP design to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements.


1. The cloud operations team will define operational monitoring tooling and automated remediation tooling. The cloud governance team will support those discovery processes. In this use case, the cloud operations team chose Azure Monitor as the primary tool for monitoring mission-critical applications.
2. Create a repository in Azure DevOps to store and version all relevant Resource Manager templates and scripted configurations.
3. Azure Vault implementation:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -85,8 +85,10 @@ The following changes to policy will help remediate the new risks and guide impl

## Incremental improvement of governance practices


The governance MVP design will change to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements.


1. The Networking and IT Security teams will define network requirements. The cloud governance team will support the conversation.
2. The Identity and IT Security teams will define identity requirements and make any necessary changes to local Active Directory implementation. The cloud governance team will review changes.
3. Create a repository in Azure DevOps to store and version all relevant Azure Resource Manager templates and scripted configurations.
Expand Down
4 changes: 2 additions & 2 deletions docs/cloud-adoption/includes/governance/business-risks.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,11 @@ The initial objective is to establish a foundation for governance agility. An ef

## Business risks

The company is at an early stage of cloud adoption, experimenting and building proofs of concept. Risks are now relatively low, but future risks are likely. There is little definition around the final state of the technical solutions to be deployed to the cloud. In addition, the cloud readiness of IT employees is low. A foundation for cloud adoption will help the team safely learn and grow.
The company is at an early stage of cloud adoption, experimenting and building proofs of concept. Risks are now relatively low, but future risks are likely to have a significant impact. There is little definition around the final state of the technical solutions to be deployed to the cloud. In addition, the cloud readiness of IT employees is low. A foundation for cloud adoption will help the team safely learn and grow.

**Future-proofing:** There is a risk of not empowering growth, but also a risk of not providing the right protections against future risks.

An agile yet robust governance approach is needed to support the board’s vision for corporate and technical growth. Failure to implement such a strategy will slow technical growth, potentially risking market share growth and future market share. The impact of such a business risk is unquestionably high. However, the role IT will play in those potential future states is unknown, making the risk associated with current IT efforts relatively high. That said, until more concrete plans are aligned, the business has a high tolerance for risk.
An agile yet robust governance approach is needed to support the board’s vision for corporate and technical growth. Failure to implement such a strategy will slow technical growth, potentially risking current and future market share growth. The impact of such a business risk is unquestionably high. However, the role IT will play in those potential future states is unknown, making the risk associated with current IT efforts relatively high. That said, until more concrete plans are aligned, the business has a high tolerance for risk.

This business risk can be broken down tactically into several technical risks:

Expand Down
4 changes: 2 additions & 2 deletions docs/data-guide/big-data/real-time-processing.md
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ The following technologies are recommended choices for real-time processing solu

### Real-time message ingestion

- **Azure Event Hubs**. Azure Event Hubs is a message queuing solution for ingesting millions of event messages per second. The captured event data can be processed by multiple consumers in parallel.
- **Azure Event Hubs**. Azure Event Hubs is a messaging solution for ingesting millions of event messages per second. The captured event data can be processed by multiple consumers in parallel. While Event Hubs natively supports AMQP (Advanced Message Queuing Protocol 1.0), it also provides a binary compatibility layer that allows applications using the Kafka protocol (Kafka 1.0 and above) to process events using Event Hubs with no application changes.
- **Azure IoT Hub**. Azure IoT Hub provides bi-directional communication between Internet-connected devices, and a scalable message queue that can handle millions of simultaneously connected devices.
- **Apache Kafka**. Kafka is an open source message queuing and stream processing application that can scale to handle millions of messages per second from multiple message producers, and route them to multiple consumers. Kafka is available in Azure as an HDInsight cluster type.

Expand Down Expand Up @@ -78,4 +78,4 @@ In a purely real-time solution, most of the processing orchestration is managed

The following reference architecture shows an end-to-end stream processing pipeline:

- [Stream processing with Azure Stream Analytics](../../reference-architectures/data/stream-processing-stream-analytics.md)
- [Stream processing with Azure Stream Analytics](../../reference-architectures/data/stream-processing-stream-analytics.md)
4 changes: 1 addition & 3 deletions docs/patterns/bulkhead.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,7 @@ ms.custom: seodec18

# Bulkhead pattern

Isolate elements of an application into pools so that if one fails, the others will continue to function.

This pattern is named *Bulkhead* because it resembles the sectioned partitions of a ship's hull. If the hull of a ship is compromised, only the damaged section fills with water, which prevents the ship from sinking.
The Bulkhead pattern is a type of application design that is tolerant of failure. In a bulkhead architecture, elements of an application are isolated into pools so that if one fails, the others will continue to function. It's named after the sectioned partitions (bulkheads) of a ship's hull. If the hull of a ship is compromised, only the damaged section fills with water, which prevents the ship from sinking.

## Context and problem

Expand Down
4 changes: 2 additions & 2 deletions includes/caf-governance-of-resources.md
Original file line number Diff line number Diff line change
Expand Up @@ -54,8 +54,8 @@ Until trust in the cloud environment is fully established it's important to tigh
2. Validate that on-premises security and traffic management mechanisms treat connected cloud networks as untrusted. Resources and services hosted in the cloud should only have access to authorized on-premises services.
3. Validate that the local edge device in the on-premises datacenter is compatible with [Azure VPN Gateway requirements](/azure/vpn-gateway/vpn-gateway-about-vpn-devices) and is configured to access the public internet.
1. In the root management group, create a second blueprint definition named `secure-hybrid-vnet`.
1. Add the Resource Manager template for the VPN Gateway as an artifact of the blueprint definition.
2. Add the Resource Manager template for the your virtual network as an artifact of the blueprint definition.
1. Add the Resource Manager template for the VPN Gateway as an artifact to the blueprint definition.
2. Add the Resource Manager template for the virtual network as an artifact to the blueprint definition.
3. Publish the blueprint definition.
1. Assign the `secure-hybrid-vnet` blueprint definition to any subscriptions requiring on-premises connectivity. This definition should be assigned in addition to the `governance-baseline` blueprint definition.

Expand Down

0 comments on commit 631868d

Please sign in to comment.