Important change released for Guest Configuration audit policies

by Scott Muniz | Sep 11, 2020 | Uncategorized

This article is contributed. See the original author and article here.

Welcome to the Governance and Management blog!

Summary

An important change has been released to policies in category Guest Configuration. The policy format has been updated to address customer feedback, to simplify the experience of auditing settings inside machines. Existing policies that were assigned prior to this release will continue to display accurate results and will not be deleted in the near future. For new policy assignments, only the updated definitions are available.

In the new experience, a single initiative handles all prerequisite requirements. Once the prerequisites are completed, Audit policies may be added/removed without needing to run remediation tasks.

Switching to the new experience requires assigning the new definitions.

TL/DR Engineering perspective on the change

Here is a full post-mortem on the change and why we have made it.

Background

Guest Configuration policies operate together with the Microsoft.GuestConfiguration resource provider (RP). The role of the RP is to map scenarios to machines. In the example below, the RP stores a “guest configuration assignment” that audits for groups/accounts that should not be members of the Administrators group.

"guestConfiguration": {
            "name": "AdministratorsGroupMembersToExclude",
            "version": "1.*",
            "contentUri": "https://oaasguestconfigeus2s1.blob.core.windows.net/builtinconfig/AdministratorsGroupMembersToExclude/AdministratorsGroupMembersToExclude_1.0.0.0.zip",
            "contentHash": "4D4AC73EE559B4B4C52BF123E6BE62A6901BC3E24750A238C32759DB366E433D",
            "contentType": null,
            "assignmentType": null,
            "configurationParameter": [
                {
                    "name": "[LocalGroup]AdministratorsGroup;MembersToExclude",
                    "value": "foobar"
                }
            ],
            "configurationProtectedParameter": [],
            "configurationSetting": null
        }

The Azure resource must be created when an Azure Policy is assigned for guest configuration scenarios. The information provided by the resource makes the scenario visible in the Azure Resource Manager API, which is how Azure Policy evaluates the results returned by the agent.

For the last two years, guest configuration policies have followed a pattern where each scenario included an initiative containing two definitions. Each definition played an important role:

• A Deploy If Not Exists definition that created the guest configuration assignment, and ensured the extension is installed for the machine and the machine has a system assigned managed identity.
• An Audit If Not Exists definition that would examine the results returned by the agent in ARM to make the compliance state available in the Azure Policy experience.

Challenge

The consequence of this design was that when the definitions were assigned to a scope with existing machines, a remediation task needed to be run for the guest configuration assignments to be created. Customer feedback told us that the notion of remediating an audit policy did not sound logical and was too confusing for a “day 0” experience.

Resolution

We have now launched a new policy experience for guest configuration definitions. Effective now, only the Audit If Not Exists definition is required. Customers will not need to assign Deploy If Not Exists definitions per scenario, and will not need to assign an initiative per scenario.

You can see the definitions in the Azure Portal by filtering to Category = Guest Configuration.

To handle creation of the guest configuration assignment resource, we have implemented an automation solution in our service. When Azure Policy performs a GET request to determine machine compliance, the automation will create the resource and return a state of Pending. Once the agent has performed the audit and calculated the compliance state, the service will write Compliant or NonCompliant as the state of the scenario per machine. This PUT activity triggers Azure Policy to evaluate the resource again, which means the state of the resource in Azure Policy will always be current with the latest compliance state of the machine (within 30 minutes).

IMPORTANT

To start using the new definitions you must create a new Policy assignment.

We took our time in releasing this change because we thoroughly investigated every possibility for migrating existing assignments to the new model. In every design proposal we were able to find edge cases where parameter values could be at risk. To ensure the highest degree of reliability, the only possibility is to release new policies and mark the existing policies as deprecated.

Existing definitions appearing as ‘Deprecated’

All existing guest configuration definitions will appear with the text “[Deprecated]” added to the beginning of the display name. This does not mean they have been deleted, or that they will be deleted near term. The only change is that they are not visible in the Azure Portal for new assignments. Where they are used for existing assignments, they will continue to function as they have in the past and they will show accurate results.

There is no date and time when customers using the previous Initiative/Deploy/Audit policy combinations must change to the new policies. The new experience is simplified and easier to use. When you would like to enjoy the new experience, you can assign the new policies. Having the “old” policies and “new” policies both assigned to the same or overlapping scopes is fine as long as they use the same parameter values.

Only one set of prerequisite definitions

To simplify handling all prerequisite requirements to perform an audit inside the machine, we now have an initiative named Deploy prerequisites to enable Guest Configuration policies on virtual machines. This initiative combines 4 definitions:

• Create a system assigned managed identity for machines with no identity
• Create a system assigned managed identity for machines with an existing user assigned managed identity
• Deploy the ‘AzurePolicyforWindows’ extension to Windows machines
• Deploy the ‘AzurePolicyforLinux’ extension to Linux machines

These policies will deploy requirements to new machines automatically and make remediation tasks available for existing machines. Once machines have been remediated for prerequisites, you do not need to run additional remediation tasks as you assign more audit policies.

Thank you

I know this change is inconvenient since it requires making a manual change. We have done our best to lessen the impact of the change, with intention to bring you the best experience possible. Thank you for your patience and I look forward to hearing your feedback.

To provide feedback or engage in discussion about guest configuration, I would suggest the following options.

• Feature requests for Azure Policy: User Voice

• Discussion about the Azure Governance platform including guest configuration: Governance Community Hub

• Discussion about DSC custom resource development for guest configuration: DSC channel in PowerShell community Slack*

* You are also welcome to direct-message me here with questions or feedback about guest configuration

Thank you!

Michael Greene

Principal Program Manager

Azure management services

Recording – Making the most of Microsoft 365 on iOS: Microsoft + Imprivata

by Scott Muniz | Sep 11, 2020 | Uncategorized

This article is contributed. See the original author and article here.

  In this HLS Partner Plays webcast recording Randy Nale, Healthcare Technology Strategist at Microsoft, and Wes Wright, CTO at Imprivata, show how to boost efficiency in the demanding hospital setting using Imprivata Mobile and Microsoft 365.

Resources:

• Imprivata website 
• Microsoft 365 Documentation 
• Microsoft Teams for Healthcare 

Thanks for visiting – Michael Gannotti   LinkedIn | Twitter

Michael Gannotti

Devito Book Summer Project with Imperial College London

by Scott Muniz | Sep 11, 2020 | Uncategorized

This article is contributed. See the original author and article here.

My name is Rini Banerjee, and I am about to start my third year of Joint Mathematics and Computer Science at Imperial College London.

I’ve spent this summer doing a remote research internship on the Devito Project, under the supervision of Prof Paul Kelly and Dr Gerard Gorman. I’ve been working on the Devito Book: a set of Jupyter Notebook tutorials that teach the finite difference method for solving partial differential equations using Devito, based on the textbook “Finite Difference Computing with PDEs – A Modern Software Approach” by H. P. Langtangen and S. Linge.

What is Devito?

Devito is a domain-specific language and code generation framework that automates the finite difference method for solving partial differential equations (PDEs). It can be used as a library in Python to provide a high-level symbolic abstraction for the user, allowing them to input their problem concisely using simple mathematical operators. This makes code extremely readable and intuitive to understand. In addition, Devito turns symbolic Python code into highly optimised C++ code under the hood and, as a result, is much faster than its contemporaries. Its performance and usability give it a significant edge over many existing programs.

Symbolic Computation in Devito

Devito is primarily used to solve inverse problems. In particular, the original motivation for Devito was to create wave propagation kernels to solve PDEs in the context of seismic equations.

Marmousi Full Waveform Inversion (FWI),

Marmousi Full Waveform Inversion (FWI), done using JUDI (from this paper)

You can find out more about Devito here: https://www.devitoproject.org/

Some introductory papers about Devito are available here: http://arxiv.org/abs/1807.03032 and https://www.geosci-model-dev.net/12/1165/2019/

Devito is an open-source project, available here: https://github.com/devitocodes/devito

Making the Devito Book

I started the summer with an empty GitHub repository. The objectives for my summer project were as follows:

1. Re-engineer the existing book source (https://github.com/hplgit/fdm-book/tree/master/src) into Jupyter Book (https://jupyterbook.org) format.
2. Configure CI/CD using GitHub Actions to verify that code examples (both stand alone examples and individual Jupyter notebooks) execute correctly and to deploy the revised Jupyter Book.
3. Re-implement the existing finite difference coding examples using Devito.

The main aim of this project is to provide an interactive, easy-to-follow online textbook for teaching the finite difference method. It is hoped that by doing these tutorials, students will not only gain a deeper understanding of how the finite difference method works, but also learn how to use Devito as a powerful tool for numerical computation.

Re-engineering the book format

My first task was to take the original book, which was essentially a set of DocOnce files, and convert these files into a form that could be represented as a Jupyter Book. Jupyter Books allow Jupyter Notebooks to be represented as an online book with a table of contents and simple navigation between different notebooks. Thankfully, DocOnce came with a command-line tool for directly converting from DocOnce (.do.txt) files into Jupyter Notebook (.ipynb) files, and so after importing the original textbook into the devito_book repository, I used this tool to generate the Jupyter Notebooks.

Configuring CI/CD

Next, I used GitHub Actions to configure CI/CD for the book. This involved setting up a few workflows (.yml files) that do the following:

• Test that the code in the completed Jupyter Notebooks is compiling, using pytest and a plugin called nbval (NoteBook VALidation)
• Test that the numerical computation is being done correctly in the Jupyter Notebooks, using tests that were written for the original textbook
• Deploy the completed notebooks to GitHub Pages, onto https://www.devitoproject.org/devito_book/

Re-implementing the existing NumPy solvers using Devito

Once the initial setup for the Devito Book was complete, it was time to get to work on re-implementing the existing finite difference coding examples. These existing examples were written in Python, using the NumPy library, and my task was to change these examples to use Devito instead.

My approach to doing this conversion from NumPy to Devito code involved:

• Writing a new function with the same expected behaviour using Devito
• Plotting the Devito function’s output against the original NumPy function’s output for the same inputs
• Using the original textbook’s verification tests to check that the Devito function was performing as expected

Once I was confident that my Devito solvers were executing correctly for a particular notebook, I would deploy it to GitHub Pages.

The deployed Jupyter Book

Throughout the summer, I worked on notebooks that teach students how to computationally solve wave equations, vibration equations and diffusion equations. I mainly used the Jupyter Notebook interface for working on these notebooks. I also used Visual Studio Code extensively for working on Python files, and later loaded the relevant functions from these files into Jupyter Notebook code cells.

Using Visual Studio Code to write Devito solver functions

The devito_book repository can be viewed here: https://github.com/devitocodes/devito_book

Additional tasks

During the project, some of the team noticed that there were a lot of dependencies for these notebooks, including visualisation packages such as Bokeh and Mayavi.  For users of the book who preferred the more interactive Jupyter Notebook interface, it would require some effort to get the book running quickly if they did not have all of these dependencies already installed. For this reason, we decided to containerise the book using Docker. Running    docker-compose up devito_book starts a Jupyter notebook server inside a container and forwards the port to http://localhost:8888 .

Calling all contributors!

Now that I am approaching the end of my summer project, I will be leaving this project to the Devito team so that they can complete what I have been working on for the last 10 weeks.

If you are interested in numerical computation, programming in Python, and/or applied mathematics, and would like to contribute to our open-source textbook, feel free to reach out to us on Slack and check out the devito_book repository on GitHub.

Thank you to everyone on the Devito Project for giving me the opportunity to learn so much this summer in a really friendly and supportive work environment. It’s been great!