You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/governance/policy/how-to/policy-safe-deployment-practices.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,15 +11,15 @@ ms.author: timwarner
11
11
As your environment expands, so does the demand for a controlled continuous deployment (CD)
12
12
pipeline with progressive exposure control. Accordingly, Microsoft recommends DevOps teams follow
13
13
the safe deployment practices (SDP) framework. The
14
-
safe deployment of Azure Policy definitions and assignments assists in limiting the impact of
14
+
safe deployment of Azure Policy definitions and assignments helps limiting the impact of
15
15
unintended behaviors of policy resources.
16
16
17
17
The high-level approach of implementing SDP with Azure Policy is to roll out policy assignments
18
18
by rings to detect policy changes that affect the environment in early stages before it
19
19
affects the critical cloud infrastructure.
20
20
21
21
Deployment rings can be organized in diverse ways. In this how-to tutorial, rings are divided by
22
-
different Azure regions with _Ring 0_ representing critical, low traffic locations
22
+
different Azure regions with _Ring 0_ representing non-critical, low traffic locations
23
23
and _Ring 5_ denoting the most critical, highest traffic locations.
24
24
25
25
## Steps for safe deployment of Azure Policy assignments with deny or append effects
@@ -35,7 +35,7 @@ Policy assignments that use the `deny` or `append` policy effects.
35
35
We recommend storing Azure Policy definitions at the management group scope for maximum flexibility.
36
36
37
37
2. Once you've created your policy definition, assign the policy at the highest-level scope inclusive
38
-
of all deployment rings. Leverage_resource selectors_ to narrow the applicability to the least
38
+
of all deployment rings. Apply_resource selectors_ to narrow the applicability to the least
39
39
critical ring by using the `"kind": "resource location"` property. Configure the `audit` effect type
40
40
by using _assignment overrides_. Sample selector with eastUS location and effect as audit
41
41
@@ -61,13 +61,13 @@ encompass the following logic:
61
61
62
62
- Gather compliance results
63
63
- If compliance results are as expected, the pipeline should continue
64
-
- If compliance results are not as expected, the pipeline should fail and you should start debugging
64
+
- If compliance results aren't as expected, the pipeline should fail and you should start debugging
65
65
66
66
For example, you can configure the compliance check by using other tools within
67
67
your particular continuous integration/continuous deployment (CI/CD) pipeline.
68
68
69
69
At each rollout stage, the application health checks should confirm the stability of the service
70
-
and impact of the policy. If the results are not as expected due to application configuration,
70
+
and impact of the policy. If the results aren't as expected due to application configuration,
71
71
refactor the application as appropriate.
72
72
73
73
4. Repeat by expanding the resource selector property values to include the next rings’
@@ -83,7 +83,7 @@ locations and validating the expected compliance results and application health.
83
83
}]
84
84
```
85
85
86
-
5. Once you've successfully assigned the policy to all rings using `audit` mode,
86
+
5. Once you have successfully assigned the policy to all rings using `audit` mode,
87
87
the pipeline should trigger a task that changes the policy effect to `deny` and reset
88
88
the resource selectors to the location associated with _Ring 0_. Example selector with one region and effect set to deny:
89
89
@@ -101,7 +101,7 @@ the resource selectors to the location associated with _Ring 0_. Example selecto
101
101
}]
102
102
```
103
103
104
-
6.After changing the effect, automated tests should check whether enforcement is taking place as
104
+
6.Once the effect is changed, automated tests should check whether enforcement is taking place as
105
105
expected.
106
106
107
107
7. Repeat by including more rings in your resource selector configuration.
@@ -110,10 +110,10 @@ expected.
110
110
111
111
## Steps for safe deployment of Azure Policy assignments with modify or deployIfNotExists effects
112
112
113
-
Steps 1-4 for policies using the `modify` or `deployIfNotExists` effects are the same as above.
114
-
Study the following flowchart and then review modified steps 5-9:
113
+
Steps 1-4 for policies using the `modify` or `deployIfNotExists` effects are the same as steps previously explained.
114
+
Review the following flowchart with modified steps 5-9:
115
115
116
-
:::image type="content" source="safe-deployment-practices-flowchart2.png" alt-text="Flowchart showing steps five through nine in the Azure Policy safe deployment practices workflow." border="true":::
116
+
:::image type="content" source="safe-deployment-practices-flowchart2.png" alt-text="Flowchart showing steps 5 through 9 in the Azure Policy safe deployment practices workflow." border="true":::
117
117
118
118
5. Once you've assigned the policy to all rings using `audit` mode, the pipeline should trigger
119
119
a task that changes the policy effect to `modify` or `deployIfNotExists` and resets
0 commit comments