|
| 1 | +--- |
| 2 | +title: Reliability in Azure Health Data Services de-identification service |
| 3 | +description: Find out about reliability in the Azure Health Data Services de-identification service. |
| 4 | +author: jovinson-ms |
| 5 | +ms.author: jovinson |
| 6 | +ms.topic: reliability-article |
| 7 | +ms.custom: subject-reliability, references_regions |
| 8 | +ms.service: azure-health-data-services |
| 9 | +ms.subservice: deidentification-service |
| 10 | +ms.date: 09/27/2024 |
| 11 | +#Customer intent: As an IT admin, I want to understand reliability support for the de-identification service so that I can respond to and/or avoid failures in order to minimize downtime and data loss. |
| 12 | +--- |
| 13 | + |
| 14 | +# Reliability in the Azure Health Data Services de-identification service (preview) |
| 15 | + |
| 16 | +This article describes reliability support in the de-identification service (preview). For a more detailed overview of reliability principles in Azure, see [Azure reliability](/azure/architecture/framework/resiliency/overview). |
| 17 | + |
| 18 | +## Cross-region disaster recovery |
| 19 | + |
| 20 | +[!INCLUDE [introduction to disaster recovery](includes/reliability-disaster-recovery-description-include.md)] |
| 21 | + |
| 22 | +Each de-identification service (preview) is deployed to a single Azure region. In the event of a region-wide degredation or outage: |
| 23 | +- ARM control plane functionality is limited to read-only during the outage. Your service metadata (such as resource properties) is always backed up outside of the region by Microsoft. Once the outage is over, you can read and write to the control plane. |
| 24 | +- All data plane requests fail during the outage, such as de-identification or job API requests. No customer data is lost, but there is the potential for job progress metadata to be lost. Once the outage is over, you can read and write to the data plane. |
| 25 | + |
| 26 | +### Disaster recovery tutorial |
| 27 | +If an entire Azure region is not available, you can still assure high availability of your workloads. You can deploy two or more de-identification services in an active-active configuration, with Azure Front door used to route traffic to both regions. |
| 28 | + |
| 29 | +With this example architecture: |
| 30 | + |
| 31 | +- Identical de-identification services are deployed in two separate regions. |
| 32 | +- Azure Front Door is used to route traffic to both regions. |
| 33 | +- During a disaster, one region becomes offline, and Azure Front Door routes traffic exclusively to the other region. The recovery time objective during such a geo-failover is limited to the time Azure Front Door takes to detect that one service is unhealthy. |
| 34 | + |
| 35 | +#### RTO and RPO |
| 36 | + |
| 37 | +If you adopt the active-active configuration, you should expect a recovery time objective (RTO) of **5 minutes**. In any configuration, you should expect a recovery point objective (RPO) of **0 minutes** (no customer data will be lost). |
| 38 | + |
| 39 | +### Validate disaster recovery plan |
| 40 | +#### Prerequisites |
| 41 | + |
| 42 | +[!INCLUDE [quickstarts-free-trial-note](~/reusable-content/ce-skilling/azure/includes/quickstarts-free-trial-note.md)] |
| 43 | + |
| 44 | +To complete this tutorial: |
| 45 | + |
| 46 | +[!INCLUDE [Azure-CLI-prepare-your-environment-no-header.md](~/reusable-content/Azure-CLI/Azure-CLI-prepare-your-environment-no-header.md)] |
| 47 | + |
| 48 | +#### Create a resource group |
| 49 | + |
| 50 | +You need two instances of a de-identification service (preview) in different Azure regions for this tutorial. The tutorial uses the [region pair](../availability-zones/cross-region-replication-azure.md#azure-paired-regions) East US/West US as your two regions, but feel free to choose your own regions. |
| 51 | + |
| 52 | +To make management and clean-up simpler, you use a single resource group for all resources in this tutorial. Consider using separate resource groups for each region/resource to further isolate your resources in a disaster recovery situation. |
| 53 | + |
| 54 | +Run the following command to create your resource group. |
| 55 | + |
| 56 | +```azurecli-interactive |
| 57 | +az group create --name my-deid --location eastus |
| 58 | +``` |
| 59 | + |
| 60 | +#### Create de-identification services (preview) |
| 61 | + |
| 62 | +Follow the steps at [Quickstart: Deploy the de-identification service (preview)](/azure/healthcare-apis/deidentification/quickstart) to create two separate services, one in East US and one in West US. |
| 63 | + |
| 64 | +Note the service URL of each de-identification service so you can define the backend addresses when you deploy the Azure Front Door in the next step. |
| 65 | + |
| 66 | +#### Create an Azure Front Door |
| 67 | + |
| 68 | +A multi-region deployment can use an active-active or active-passive configuration. An active-active configuration distributes requests across multiple active regions. An active-passive configuration keeps running instances in the secondary region, but doesn't send traffic there unless the primary region fails. |
| 69 | +Azure Front Door has a built-in feature that allows you to enable these configurations. For more information on designing apps for high availability and fault tolerance, see [Architect Azure applications for resiliency and availability](/azure/architecture/reliability/architect). |
| 70 | + |
| 71 | +#### Create an Azure Front Door profile |
| 72 | + |
| 73 | +You now create an [Azure Front Door Premium](../frontdoor/front-door-overview.md) to route traffic to your services. |
| 74 | + |
| 75 | +Run [`az afd profile create`](/cli/azure/afd/profile#az-afd-profile-create) to create an Azure Front Door profile. |
| 76 | + |
| 77 | +> [!NOTE] |
| 78 | +> If you want to deploy Azure Front Door Standard instead of Premium, substitute the value of the `--sku` parameter with Standard_AzureFrontDoor. You can't deploy managed rules with WAF Policy if you choose the Standard tier. For a detailed comparison of the pricing tiers, see [Azure Front Door tier comparison](../frontdoor/standard-premium/tier-comparison.md). |
| 79 | +
|
| 80 | +```azurecli-interactive |
| 81 | +az afd profile create --profile-name myfrontdoorprofile --resource-group my-deid --sku Premium_AzureFrontDoor |
| 82 | +``` |
| 83 | + |
| 84 | +|Parameter |Value |Description | |
| 85 | +|---------|---------|---------| |
| 86 | +|`profile-name` |`myfrontdoorprofile` |Name for the Azure Front Door profile, which is unique within the resource group. | |
| 87 | +|`resource-group` |`my-deid` |The resource group that contains the resources from this tutorial. | |
| 88 | +|`sku` |`Premium_AzureFrontDoor` |The pricing tier of the Azure Front Door profile. | |
| 89 | + |
| 90 | + |
| 91 | +### Add an endpoint |
| 92 | + |
| 93 | +Run [`az afd endpoint create`](/cli/azure/afd/endpoint#az-afd-endpoint-create) to create an endpoint in your profile. You can create multiple endpoints in your profile after finishing the create experience. |
| 94 | + |
| 95 | +```azurecli-interactive |
| 96 | +az afd endpoint create --resource-group my-deid --endpoint-name myendpoint --profile-name myfrontdoorprofile --enabled-state Enabled |
| 97 | +``` |
| 98 | + |
| 99 | +|Parameter |Value |Description | |
| 100 | +|---------|---------|---------| |
| 101 | +|`endpoint-name` |`myendpoint` |Name of the endpoint under the profile, which is unique globally. | |
| 102 | +|`enabled-state` |`Enabled` |Whether to enable this endpoint. | |
| 103 | + |
| 104 | +#### Create an origin group |
| 105 | + |
| 106 | +Run [`az afd origin-group create`](/cli/azure/afd/origin-group#az-afd-origin-group-create) to create an origin group that contains your two de-identification services. |
| 107 | + |
| 108 | +```azurecli-interactive |
| 109 | +az afd origin-group create --resource-group my-deid --origin-group-name myorigingroup --profile-name myfrontdoorprofile --probe-request-type GET --probe-protocol Https --probe-interval-in-seconds 60 --probe-path /health --sample-size 1 --successful-samples-required 1 --additional-latency-in-milliseconds 50 --enable-health-probe |
| 110 | +``` |
| 111 | + |
| 112 | +|Parameter |Value |Description | |
| 113 | +|---------|---------|---------| |
| 114 | +|`origin-group-name` |`myorigingroup` |Name of the origin group. | |
| 115 | +|`probe-request-type` |`GET` |The type of health probe request that is made. | |
| 116 | +|`probe-protocol` |`Https` |Protocol to use for health probe. | |
| 117 | +|`probe-interval-in-seconds` |`60` |The number of seconds between health probes. | |
| 118 | +|`probe-path` |`/health` |The path relative to the origin that is used to determine the health of the origin. | |
| 119 | +|`sample-size` |`1` |The number of samples to consider for load balancing decisions. | |
| 120 | +|`successful-samples-required` |`1` |The number of samples within the sample period that must succeed. | |
| 121 | +|`additional-latency-in-milliseconds` |`50` |The extra latency in milliseconds for probes to fall into the lowest latency bucket. | |
| 122 | +|`enable-health-probe` | | Switch to control the status of the health probe. | |
| 123 | + |
| 124 | +### Add origins to the group |
| 125 | + |
| 126 | +Run [`az afd origin create`](/cli/azure/afd/origin#az-afd-origin-create) to add an origin to your origin group. For the `--host-name` and `--origin-host-header` parameters, replace the placeholder value `<service-url-east-us>` with your East US service URL, leaving out the scheme (`https://`). You should have a value like `abcdefghijk.api.eastus.deid.azure.com`. |
| 127 | + |
| 128 | +```azurecli-interactive |
| 129 | +az afd origin create --resource-group my-deid --host-name <service-url-east-us> --profile-name myfrontdoorprofile --origin-group-name myorigingroup --origin-name primarydeid --origin-host-header <service-url-east-us> --priority 1 --weight 1000 --enabled-state Enabled --https-port 443 |
| 130 | +``` |
| 131 | + |
| 132 | +|Parameter |Value |Description | |
| 133 | +|---------|---------|---------| |
| 134 | +|`host-name` |`<service-url-east-us>` |The hostname of the primary de-identification service. | |
| 135 | +|`origin-name` |`deid1` |Name of the origin. | |
| 136 | +|`origin-host-header` |`<service-url-east-us>` |The host header to send for requests to this origin. | |
| 137 | +|`priority` |`1` |Set this parameter to 1 to direct all traffic to the primary de-identification service. | |
| 138 | +|`weight` |`1000` |Weight of the origin in given origin group for load balancing. Must be between 1 and 1000. | |
| 139 | +|`enabled-state` |`Enabled` |Whether to enable this origin. | |
| 140 | +|`https-port` |`443` |The port used for HTTPS requests to the origin. | |
| 141 | + |
| 142 | +Repeat this step to add your second origin. For the `--host-name` and `--origin-host-header` parameters, replace the placeholder value `<service-url-west-us>` with your West US service URL, leaving out the scheme (`https://`). |
| 143 | + |
| 144 | +```azurecli-interactive |
| 145 | +az afd origin create --resource-group my-deid --host-name <service-url-west-us> --profile-name myfrontdoorprofile --origin-group-name myorigingroup --origin-name deid2 --origin-host-header <service-url-west-us> --priority 1 --weight 1000 --enabled-state Enabled --https-port 443 |
| 146 | +``` |
| 147 | + |
| 148 | +Pay attention to the `--priority` parameters in both commands. Because both origins are set to priority `1`, Azure Front Door treats both origins as active and direct traffic to both regions. If the priority for one origin is set to `2`, Azure Front Door will treat that origin as secondary and will direct all traffic to the other origin unless it goes down. |
| 149 | + |
| 150 | +#### Add a route |
| 151 | + |
| 152 | +Run [`az afd route create`](/cli/azure/afd/route#az-afd-route-create) to map your endpoint to the origin group. This route forwards requests from the endpoint to your origin group. |
| 153 | + |
| 154 | +```azurecli-interactive |
| 155 | +az afd route create --resource-group my-deid --profile-name myfrontdoorprofile --endpoint-name myendpoint --forwarding-protocol MatchRequest --route-name route --origin-group myorigingroup --supported-protocols Https --link-to-default-domain Enabled |
| 156 | +``` |
| 157 | + |
| 158 | +|Parameter |Value |Description | |
| 159 | +|---------|---------|---------| |
| 160 | +|`endpoint-name` |`myendpoint` |Name of the endpoint. | |
| 161 | +|`forwarding-protocol` |MatchRequest |Protocol this rule uses when forwarding traffic to backends. | |
| 162 | +|`route-name` |`route` |Name of the route. | |
| 163 | +|`supported-protocols` |`Https` |List of supported protocols for this route. | |
| 164 | +|`link-to-default-domain` |`Enabled` |Whether this route is linked to the default endpoint domain. | |
| 165 | + |
| 166 | +Allow about 15 minutes for this step to complete as it takes some time for this change to propagate globally. After this period, your Azure Front Door is fully functional. |
| 167 | + |
| 168 | +## Test the Front Door |
| 169 | + |
| 170 | +When you create the Azure Front Door Standard/Premium profile, it takes a few minutes for the configuration to be deployed globally. Once completed, you can access the frontend host you created. |
| 171 | + |
| 172 | +Run [`az afd endpoint show`](/cli/azure/afd/endpoint#az-afd-endpoint-show) to get the hostname of the Front Door endpoint. It should look like `abddefg.azurefd.net` |
| 173 | + |
| 174 | +```azurecli-interactive |
| 175 | +az afd endpoint show --resource-group my-deid --profile-name myfrontdoorprofile --endpoint-name myendpoint --query "hostName" |
| 176 | +``` |
| 177 | + |
| 178 | +In a browser, go to the endpoint hostname that the previous command returned: `<endpoint>.azurefd.net/health`. Your request should automatically get routed to the primary de-identification service in East US. |
| 179 | + |
| 180 | +To test instant global failover: |
| 181 | + |
| 182 | +1. Open a browser and go to the endpoint hostname: `<endpoint>.azurefd.net/health`. |
| 183 | +1. Follow the steps at [Configure private access](/azure/healthcare-apis/deidentification/configure-private-endpoints#configure-private-access) to disable public network access for the de-identification service in East US. |
| 184 | +1. Refresh your browser. You should see the same information page because traffic is now directed to the de-identification service in West US. |
| 185 | + |
| 186 | + > [!TIP] |
| 187 | + > You might need to refresh the page a few times for the failover to complete. |
| 188 | +
|
| 189 | +1. Now disable public network access for the de-identification service in West US. |
| 190 | +1. Refresh your browser. This time, you should see an error message. |
| 191 | +1. Re-enable public network access for one of the de-identification services. Refresh your browser and you should see the health status again. |
| 192 | + |
| 193 | +You've now validated that you can access your services through Azure Front Door and that failover functions as intended. Enable public network access on the other service if you're done with failover testing. |
| 194 | + |
| 195 | +#### Clean up resources |
| 196 | + |
| 197 | +In the preceding steps, you created Azure resources in a resource group. If you don't expect to need these resources in the future, delete the resource group by running the following command: |
| 198 | + |
| 199 | +```azurecli-interactive |
| 200 | +az group delete --name my-deid |
| 201 | +``` |
| 202 | + |
| 203 | +This command might take a few minutes to complete. |
| 204 | + |
| 205 | +#### Initiate recovery |
| 206 | +In the case of disaster, you can check the health status of your de-identification service (preview) by sending requests to `<service-url>/health`. |
| 207 | + |
| 208 | +## Related content |
| 209 | + |
| 210 | +- [Reliability in Azure](/azure/reliability/overview) |
0 commit comments