Subscription Vending

Summary

This video delves into subscription vending within Azure, explaining how subscriptions are essential building blocks for deploying resources and workloads. The presenter discusses two common approaches to managing subscriptions: a centralized model with a small number of shared subscriptions and a decentralized model with many individual subscriptions per app or workload. The concept of subscription vending is introduced, where data collection and parameter files drive the automated creation of subscriptions, ensuring flexibility, control, and scalability. The solution enables app teams to manage their workloads while maintaining central governance, compliance, and connectivity for a more efficient Azure environment.

Takeaways

• 😀 Subscriptions are core to Azure, as everything deploys within them, acting as both a billing and permission boundary.
• 😀 A subscription has its own set of quotas and limits, which can impact scalability and resource allocation.
• 😀 Centralized management of a small number of subscriptions offers strong control but can create scaling challenges due to shared quotas and limits.
• 😀 One of the cons of sharing a small number of subscriptions is difficulty in maintaining granular role-based access control (RBAC).
• 😀 App teams may lose flexibility in a shared subscription model, especially when it comes to using specific resource providers and configurations.
• 😀 Compliance tracking becomes complicated when multiple workloads with different requirements are combined in a single subscription.
• 😀 Using multiple subscriptions for different apps or workloads offers better scaling, granular RBAC, and flexibility, but may lack centralized governance.
• 😀 A key challenge when using many subscriptions is ensuring consistent connectivity across them, as each app team may implement their own methods.
• 😀 Azure landing zones have been adapted into platform and application components, providing foundational resources for infrastructure teams and dedicated spaces for app workloads.
• 😀 Subscription vending simplifies subscription creation through a parameter-driven process, enabling better flexibility for app teams while maintaining central governance.
• 😀 The use of Azure verified modules in subscription vending allows the automation of subscription configuration, including role-based access control, virtual networks, and specific resource providers.

Q & A

What is the primary purpose of a subscription in Azure?

The primary purpose of a subscription in Azure is to serve as a boundary for various elements like virtual networks, billing, permissions, quotas, and limits. It helps organize resources and manage access controls.

What are the advantages and challenges of using a small number of subscriptions shared across multiple workloads?

Advantages include strong control over the environment, but challenges arise with hitting subscription limits, difficulty in applying granular role-based access control (RBAC), and the complexity of tracking compliance requirements for different workloads.

How does using many subscriptions per app or workload help in scaling and managing resources?

Using many subscriptions allows each app or workload to have its own limits, quotas, and RBAC, providing better scalability, flexibility, and easier tracking of compliance and service health alerts. However, it may lack central governance and introduce connectivity challenges.

What are Azure landing zones, and how do they assist in organizing Azure environments?

Azure landing zones are best practices for organizing resources in Azure. They divide the environment into platform elements, managed by the infrastructure team, and application components, which are managed by the app teams, ensuring better structure and governance.

What is the concept of 'subscription vending,' and how does it work?

Subscription vending involves collecting parameters from app teams (e.g., workload type, tags, network components) through a data collection interface, and using those parameters to automatically create or configure Azure subscriptions via verified Azure modules (e.g., Terraform, Bicep).

How can organizations customize the parameters used in subscription vending?

Organizations can customize the parameters by defining a form or interface that collects specific values from app teams, such as subscription display names, tags, workload types, and role-based access control settings. This customization is crucial for creating tailored environments for each workload.

What are some examples of actions that subscription vending can automate?

Subscription vending can automate tasks such as setting tags, assigning roles, applying policies, configuring virtual networks, setting up peering, enabling resource providers, and managing security policies.

How does subscription vending integrate with governance and security controls in Azure?

Subscription vending ensures that governance and security controls, such as role-based access control (RBAC), policy enforcement, and security configurations, are automatically applied based on the parameters set during the vending process. This ensures compliance with organizational requirements.

What is the role of DevOps in subscription vending?

DevOps plays a significant role by allowing version control through Git repositories. When new subscription vending requests are made, DevOps pipelines can be triggered (e.g., using GitHub Actions) to deploy the parameters and configure the subscriptions accordingly.

How does subscription vending address challenges in central governance and app team flexibility?

Subscription vending balances central governance with app team flexibility by applying necessary governance configurations, while still allowing app teams to manage specific aspects of their subscription, such as quotas, networking, and compliance.