1. Introduction to Azure Automation
Automating operational tasks is critical for streamlining infrastructure management, both on premises and in the cloud. Microsoft Azure Automation comes with capabilities that help administrators automate their cloud-based, operational, repetitive tasks. It is versatile, with hybrid connection capabilities that help you automate tasks in your on-premises datacenters as well as with other cloud service providers like Amazon Web Services (AWS). Being built on top of the ever-reliable PowerShell, it is a useful tool in the arsenal of any Azure cloud administrator. Azure runbooks are easy to create, edit, and execute and can integrate well with almost all resources in the Microsoft Azure ecosystem.
Azure Automation has significantly changed since its inception as a small feature in the Azure classic portal. With the introduction of the Azure Resource Manager (ARM) model and the new Azure portal, Azure Automation also significantly ramped up, with many new features such as Azure Graphical runbooks. As more and more organizations are moving toward the cloud, automation is also much in demand to maximize the return on investment (ROI) . Microsoft Azure is a leader in the cloud market, and developing skillsets in Azure Automation is a valuable tool in the arsenal of a cloud administrator.
This chapter introduces you to the ARM deployment model in Azure and the various components of Azure Automation in the ARM model. These include but are not limited to the Azure Automation overview dashboard, PowerShell, runbooks, jobs, Runbook Gallery, hybrid workers, and Azure Automation security. We will focus on establishing a basic understanding of the key concepts of Azure Automation, which will be explained in detail in subsequent chapters.
Note
Azure has two deployment models: the classic, or Azure Service Management (ASM), model and the more recent Azure Resource Manager (ARM) model. This book focuses on the ARM deployment model.
Azure ARM Deployment Model
The ARM model is the way forward for all Azure deployments as recommended by Microsoft. Compared to the monolithic deployment model of the Azure classic portal, ARM brings in flexibility and robustness with features including resource groups, role-based access control, template deployments, tagging, and resource policy. Lets look at some of the key features of the ARM model before delving into Azure Automation, because many of these features will prominently feature in some of the Automation runbooks that we will be discussing further in this book.
RBAC
Azure role-based access control (RBAC) helps you implement fine-grained access restrictions on resources created in Azure. In the classic model, there was only one role, named Co-administration , which had full access to the entire Azure subscription. This was not suitable when administrators wanted to implement more restrictions at at the resource level. With the introduction of RBAC , there are many predefined roles that you can leverage.
In addition, you can even create your own roles. The three main roles are Reader, Contributor, and Owner. You can apply the roles at various scopesto resource groups, virtual machines (VMs), or networks, for example.. The Owner role has full permission to the applied scope and enables the member of the role to add another user in the given scope. The Contributor role also has full access, but a member of the Contributor group cannot add another user to the scope. Reader provides only read access to any applied scope. In addition, each resource type has its own set of predefined roles that an administrator can leverage to set permissions.
Template Deployment
In the ARM model, you have the option to automate the deployment of resources by using JSON templates. This is useful for deploying complex multitier environments in a single click. You can define the parameters in JSON format, define dependencies, and then create a template for complex architectures. This is useful in crash-and-burn scenarios and time-sensitive deployments.
Tags
You can tag the resources in Azure with a key/value pair so that you can do a logical marking of resources coming under a certain scope. For example, you can create a tag for all development resources in your environment, and when you select the tag from the portal, Azure will list all the resources coming under that tag. Tags are also useful for billing purposes. In the Azure consumption bill, you can filter resources based on their tags. This will help you identify the cost incurred by a resource grouped under a given tag. One possible use case is cross-charging; you can create a tag for all resources for another department, sort the charges based on the tag, and cross-charge to a respective department.
Resource Groups
Azure resource groups are a new feature in ARM that enable you to logically group related resources and manage them as a single entity. Any resource created in the ARM model should be part of a resource group, and it can be part of only one resource group at a given time. Adding resources to a resource group allows you to manage their life cycle and create a security boundary. Grouping resources in resource groups becomes relevant when you want to be able to create, update, or delete them together.
Resource Policies
Resource policies allow administrators to implement restrictions in terms of resource locations or naming conventions. A policy consists of a policy definition and policy assignment at a given scope. Resource policies are quite useful when cloud administrators want to implement certain rules and regulationsfor example, all created resources should reside in a chosen Azure location, or the resources should adhere to a given naming convention. Unlike RBAC, which decides the permission levels of a user at a given scope, policies define the properties of the resources at the applied scope, such as their naming conventions or location.
Azure Automation in the ARM Portal
The concept of cloud computing is heavily dependent on automation, wherein users can log in and spin up resources based on their requirements. More and more organizations are adopting the cloud-first policy, and hence there is an increasing demand on automating long-running complex operational tasks in the cloud. Azure Automation was introduced to fill this gap.
Automation was introduced in the classic portal initially. With the introduction of the ARM model and the strategy of promoting it for all services new and old, Automation was introduced in the ARM-based portal as well. The new ARM-based portal is simply referred to as the Azure portal . Automation runbooks are based on PowerShell and bring in the exciting possibilities of PowerShell scripting to the Azure platform in an easy-to-handle interface.
Creating Your Automation Account and Getting Started
Lets look at how to create an automation account in the ARM portal:
Go to the Azure portal. In the left panel, click More Services and then type in automation (Figure ).
Figure 1-1.
Searching with the automation keyword
A list of automation accounts is displayed. To create a new account , click Add (Figure ).