Operational excellence pillar in Azure - Mini Project: Build & Apply

Implementing Operational Excellence Pillar in Azure

📖 Scenario: You are working as a cloud engineer for a company that wants to improve its cloud operations on Microsoft Azure. The company wants to follow the Operational Excellence pillar of the Azure Well-Architected Framework to ensure reliable and efficient cloud infrastructure management.Your task is to create a simple Azure Resource Manager (ARM) template that sets up a storage account with monitoring enabled. This will help the company track and improve their cloud operations.

🎯 Goal: Build an ARM template that creates an Azure Storage Account with diagnostics settings enabled to send logs to a Log Analytics workspace. This setup supports operational excellence by enabling monitoring and alerting.

📋 What You'll Learn

Create an Azure Storage Account resource with the name opexstorageacct.

Create a Log Analytics workspace resource with the name opexlogworkspace.

Configure diagnostics settings on the storage account to send logs to the Log Analytics workspace.

Use ARM template syntax and best practices for resource dependencies.

💡 Why This Matters

🌍 Real World

This project shows how to set up monitoring and logging in Azure to follow operational excellence best practices, helping teams maintain reliable and efficient cloud infrastructure.

💼 Career

Cloud engineers and architects use ARM templates to automate resource deployment and enable monitoring, which is essential for operational excellence in cloud environments.

1

Create the basic ARM template structure with Storage Account

Create an ARM template JSON with a resources array containing a Storage Account resource named opexstorageacct. Use Microsoft.Storage/storageAccounts as the resource type and 2022-09-01 as the API version. Set the sku to Standard_LRS and kind to StorageV2. The location should be eastus.

Azure

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2022-09-01",
      "name": "opexstorageacct",
      "location": "eastus",
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "StorageV2",
      "properties": {}
    }
  ]
}

# Your code here

Hint

Remember to include the resources array and define the storage account resource with the exact name opexstorageacct.

2

Add a Log Analytics workspace resource

Add a Log Analytics workspace resource to the resources array. Use Microsoft.OperationalInsights/workspaces as the resource type with API version 2021-06-01. Name the workspace opexlogworkspace and set its location to eastus. Set the sku name to PerGB2018.

Azure

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2022-09-01",
      "name": "opexstorageacct",
      "location": "eastus",
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "StorageV2",
      "properties": {}
    },
    {
      // Add Log Analytics workspace resource here
    }
  ]
}

# Your code here

Hint

Make sure the Log Analytics workspace resource is added inside the resources array alongside the storage account.

3

Add diagnostics settings to send storage logs to Log Analytics workspace

Add a diagnostics settings resource of type Microsoft.Insights/diagnosticSettings with API version 2021-05-01-preview. Name it storageDiagSettings. Set its dependsOn to the storage account resource opexstorageacct. Configure it to send StorageRead, StorageWrite, and StorageDelete logs to the Log Analytics workspace opexlogworkspace. Use the workspace resource ID reference [resourceId('Microsoft.OperationalInsights/workspaces', 'opexlogworkspace')].

Azure

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2022-09-01",
      "name": "opexstorageacct",
      "location": "eastus",
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "StorageV2",
      "properties": {}
    },
    {
      "type": "Microsoft.OperationalInsights/workspaces",
      "apiVersion": "2021-06-01",
      "name": "opexlogworkspace",
      "location": "eastus",
      "sku": {
        "name": "PerGB2018"
      },
      "properties": {}
    },
    {
      // Add diagnostics settings resource here
    }
  ]
}

# Your code here

Hint

Ensure the diagnostics settings resource depends on the storage account and references the Log Analytics workspace ID correctly.

4

Add tags for operational excellence and finalize template

Add a tags property to both the Storage Account and Log Analytics workspace resources. Use the tag key OperationalExcellence with the value Enabled. This helps identify resources related to operational excellence.

Azure

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      // Add tags property to Storage Account here
    },
    {
      // Add tags property to Log Analytics workspace here
    },
    {
      "type": "Microsoft.Insights/diagnosticSettings",
      "apiVersion": "2021-05-01-preview",
      "name": "storageDiagSettings",
      "dependsOn": [
        "Microsoft.Storage/storageAccounts/opexstorageacct"
      ],
      "properties": {
        "workspaceId": "[resourceId('Microsoft.OperationalInsights/workspaces', 'opexlogworkspace')]",
        "logs": [
          {
            "category": "StorageRead",
            "enabled": true
          },
          {
            "category": "StorageWrite",
            "enabled": true
          },
          {
            "category": "StorageDelete",
            "enabled": true
          }
        ]
      }
    }
  ]
}

# Your code here

Hint

Add the tags property inside both the Storage Account and Log Analytics workspace resource objects.

Practice

1. What is the main goal of the Operational excellence pillar in Azure cloud?

easy

A. To run cloud systems smoothly and improve them continuously

B. To reduce cloud costs by shutting down services

C. To secure cloud data with encryption only

D. To build new cloud applications from scratch

Solution

1. Step 1: Understand the definition of operational excellence

   Operational excellence focuses on running cloud systems smoothly and improving them over time.

2. Step 2: Compare options with this definition

   Only To run cloud systems smoothly and improve them continuously matches this goal. Other options focus on cost, security, or development, which are different pillars.

3. Final Answer:

   To run cloud systems smoothly and improve them continuously -> Option A

4. Quick Check:

   Operational excellence = smooth running and improvement [OK]

Hint: Operational excellence means smooth running and improvement [OK]

Common Mistakes:

• Confusing operational excellence with security or cost management
• Thinking it only means fixing problems, not improving
• Assuming it is about building new apps

2. Which Azure service is primarily used for monitoring and alerting to support operational excellence?

easy

A. Azure DevOps

B. Azure Monitor

C. Azure Blob Storage

D. Azure Functions

Solution

1. Step 1: Identify the service for monitoring and alerting

   Azure Monitor is designed to collect, analyze, and act on telemetry data from cloud resources.

2. Step 2: Eliminate other options

   Azure DevOps is for development pipelines, Blob Storage is for data storage, and Functions is for serverless compute, so they don't focus on monitoring.

3. Final Answer:

   Azure Monitor -> Option B

4. Quick Check:

   Monitoring and alerting = Azure Monitor [OK]

Hint: Monitoring and alerting in Azure? Think Azure Monitor [OK]

Common Mistakes:

• Choosing Azure DevOps for monitoring
• Confusing storage services with monitoring
• Selecting compute services instead of monitoring tools

3. Consider this Azure CLI command to create an alert rule:

az monitor metrics alert create --name HighCPUAlert --resource-group MyGroup --scopes /subscriptions/123/resourceGroups/MyGroup/providers/Microsoft.Compute/virtualMachines/MyVM --condition "avg Percentage CPU > 80" --description "Alert when CPU is high"

What will happen when the average CPU usage goes above 80%?

medium

A. The CPU usage will be throttled to 80%

B. The virtual machine will automatically shut down

C. An alert named HighCPUAlert will trigger notifying the user

D. Nothing happens because the command syntax is incorrect

Solution

1. Step 1: Understand the alert creation command

   The command creates a metric alert named HighCPUAlert that triggers when average CPU usage exceeds 80% on the specified VM.

2. Step 2: Analyze the effect of the alert

   Alerts notify users or systems but do not automatically shut down or throttle resources. The command syntax is correct.

3. Final Answer:

   An alert named HighCPUAlert will trigger notifying the user -> Option C

4. Quick Check:

   Metric alert triggers notification, not shutdown [OK]

Hint: Alerts notify; they don't auto-shutdown or throttle [OK]

Common Mistakes:

• Thinking alerts auto-shutdown resources
• Assuming alerts change resource behavior automatically
• Believing the command has syntax errors

4. You wrote this Azure Resource Manager (ARM) template snippet to enable diagnostics:

{
  "type": "Microsoft.Insights/diagnosticSettings",
  "name": "myDiagnostics",
  "properties": {
    "logs": [
      { "category": "AuditLogs", "enabled": true }
    ],
    "metrics": [
      { "category": "AllMetrics", "enabled": true }
    ]
  }
}

But diagnostics are not enabled after deployment. What is the likely error?

medium

A. The type should be Microsoft.Compute/diagnosticSettings

B. The name property must be omitted

C. The enabled fields should be false to activate diagnostics

D. Missing the scope property to specify the resource to monitor

Solution

1. Step 1: Check required properties for diagnosticSettings

   The scope property is required to specify which resource the diagnostics apply to.

2. Step 2: Validate other properties

   Name is required, enabled should be true to activate, and type is correctly set to Microsoft.Insights/diagnosticSettings.

3. Final Answer:

   Missing the scope property to specify the resource to monitor -> Option D

4. Quick Check:

   Diagnostics need scope property to work [OK]

Hint: Diagnostics require scope property to target resource [OK]

Common Mistakes:

• Forgetting to add scope property
• Setting enabled to false by mistake
• Changing the resource type incorrectly

5. You want to improve operational excellence by automating recovery when a web app becomes unhealthy. Which Azure feature combination best supports this goal?

hard

A. Azure Monitor alerts + Azure Logic Apps to restart the web app automatically

B. Azure Blob Storage + Azure Functions to store logs

C. Azure DevOps pipelines + Azure Key Vault for deployment security

D. Azure Virtual Machines + Azure Backup for manual recovery

Solution

1. Step 1: Identify automation for recovery

   Azure Monitor alerts detect unhealthy states, and Azure Logic Apps can automate actions like restarting the web app.

2. Step 2: Evaluate other options

   Blob Storage and Functions store logs but don't automate recovery; DevOps and Key Vault focus on deployment security; VMs and Backup support manual recovery, not automated.

3. Final Answer:

   Azure Monitor alerts + Azure Logic Apps to restart the web app automatically -> Option A

4. Quick Check:

   Alerts + automation = automated recovery [OK]

Hint: Combine alerts with automation for recovery [OK]

Common Mistakes:

• Choosing storage or deployment tools for recovery automation
• Confusing manual backup with automated recovery
• Ignoring the need for alert-triggered automation