Azure CAF right implementation

Question

Azure CAF right implementation

Julien POLYCARPE 1

Hello!

I have been reading the Cloud Adoption Framework for few weeks now and I have come accross a problem : I need to implement an enterprise scale architecture and I have seen two different ones : one in the CAF, and one in the Microsoft GitHub repository; I would like to know which one is "right". In one implementation, the key vault is in the Management subscription, and in the other one, in the Identity subscription. Apart from that, they seem to be the same. You can see both in the attachements.

Thank you very much,
Julien Polycarpe

Saurabh Sharma 23,846 Reputation points Microsoft Employee Moderator

2021-05-04T00:56:41.963+00:00

Hi @Julien POLYCARPE ,

Thanks for using Microsoft Q&A !!
Can you please share the GitHub samples you are referring to. In my opinion you can keep it in any of the subscriptions. Do you know what's the purpose of having managed subscription and identity subscription in both the scenarios and what all resources are advised to keep in those two subscriptions ? also, What exactly you want to store in your Azure Key Vault and for which all resources ?

Thanks
Saurabh
Saurabh Sharma 23,846 Reputation points Microsoft Employee Moderator

2021-05-07T23:01:26.467+00:00

Hi @Julien POLYCARPE ,
We haven't heard back from you. Just wanted to check if you have any other questions.

Thanks
Saurabh
Julien POLYCARPE 1 Reputation point

2021-05-21T07:15:29.97+00:00

Hello Saurabh,

Sorry for the late answer, I have been pretty busy. In the management subscription we plan to deploy everything linked to monitoring (dashboards, log analytics...).

Here are the samples I used as a reference :
https://github.com/Azure/Enterprise-Scale/blob/main/docs/reference/adventureworks/README.md
https://learn.microsoft.com/fr-fr/azure/cloud-adoption-framework/ready/enterprise-scale/architecture

I only have one question : if I deploy a new app in one landing zone, and that this app needs to use some secrets, do these secrets need to be centralized in a ressource group with all of my key vaults (one per app) in the identity subscription, or is it better to create one key vault in each landing zone please?

Thank you very much,
Julien

Your answer

Saurabh Sharma 23,846 Reputation points Microsoft Employee Moderator

2021-05-04T00:56:41.963+00:00

Hi @Julien POLYCARPE ,

Thanks for using Microsoft Q&A !!
Can you please share the GitHub samples you are referring to. In my opinion you can keep it in any of the subscriptions. Do you know what's the purpose of having managed subscription and identity subscription in both the scenarios and what all resources are advised to keep in those two subscriptions ? also, What exactly you want to store in your Azure Key Vault and for which all resources ?

Thanks
Saurabh
Saurabh Sharma 23,846 Reputation points Microsoft Employee Moderator

2021-05-07T23:01:26.467+00:00

Hi @Julien POLYCARPE ,
We haven't heard back from you. Just wanted to check if you have any other questions.

Thanks
Saurabh
Julien POLYCARPE 1 Reputation point

2021-05-21T07:15:29.97+00:00

Hello Saurabh,

Sorry for the late answer, I have been pretty busy. In the management subscription we plan to deploy everything linked to monitoring (dashboards, log analytics...).

Here are the samples I used as a reference :
https://github.com/Azure/Enterprise-Scale/blob/main/docs/reference/adventureworks/README.md
https://learn.microsoft.com/fr-fr/azure/cloud-adoption-framework/ready/enterprise-scale/architecture

I only have one question : if I deploy a new app in one landing zone, and that this app needs to use some secrets, do these secrets need to be centralized in a ressource group with all of my key vaults (one per app) in the identity subscription, or is it better to create one key vault in each landing zone please?

Thank you very much,
Julien

Share via

Azure CAF right implementation

Your answer