Notes

Meeting Notes

  • Overview

    • The team discussed a script/tool that can display current resources, recommended reallocations, and perform calculations to move resources between year 1 and year 3 (or adjust in the other direction if there are too many). It helps avoid manual per-subscription checks and shows what is currently allocated, what percentage is left on the table, and how to slide allocations to meet targets.
    • Purpose of the tool: to enable quick, delegated decision-making (e.g., “should we allocate more than 40% or 30% on year threes?”) while preserving commitments for three years.
    • Value: saves legwork and provides an auditable way to optimize spending and capacity across timelines.

  • Key concepts and practical implications

    • Year-1 vs Year-3 planning: uses a compact model to rebalance resources across the planning horizon, aiming to maximize utilization without violating three-year commitments.
    • Allocation transparency: shows what has been allocated, what remains available, and where opportunities to save exist.
    • Decision delegation: enables non-technical stakeholders to review and approve allocation levels (e.g., cap at 40% on Year 3).

  • Network design and changes under discussion

    • New IPv4 network proposal: a new IPv4 network with CIDR notation $/24$ is being considered to expand capacity. This corresponds to a subnet mask of $255.255.255.0$.
    • Scope of change: not creating a new VNet; instead, adding an additional IP range and a new subnet within the existing VNet. The change will be incorporated into the same route and NSG (Network Security Group).
    • Rationale: extend capacity while keeping existing topology intact, preserving central governance and routing policies.
    • Practical impact: minimal disruption to existing networks; simply expands address space within the current VNet and ensures new subnet has appropriate security controls via NSGs.

  • NSGs, routing, and automation-related changes

    • Script behavior: the NSG update script should identify the next available rule slot when adding new rules, and determine the best place to insert new rules.
    • Automation potential: once stabilized, the script could be integrated into an automated workflow for future updates.
    • Default policies: awareness that default NSGs tend to be locked down; decisions on where to apply new rules should consider regional differences and existing baselines.
    • Regional variability: some regions may have different behavior or constraints (e.g., certain defaults in the US vs other regions).

  • Azure China and reservation considerations

    • Weekly discussion context: Azure China global instance and cost-recovery efforts for vaults in those environments.
    • Uptime tracking: plan to capture uptime to quantify savings from automated backups and recovery vault activity.
    • Decommissioning and idle assets: track servers that have been powered off for extended periods and include those savings in the calculation.
    • Reservations note: for Azure China, subscription is not EA-based and is not eligible for reservations. Reservation benefits apply to offers like EA, CSP, CSA, etc. Therefore, standalone Chinese subscriptions cannot purchase reservations.
    • Practical implication: cost optimization in Azure China relies on operational changes (e.g., turning off idle servers, efficient vault usage) rather than traditional Reserved Instance discounts.

  • Cost visibility and tooling

    • CloudHealth usage/billing tool: CloudHealth is used for billing and usage reporting, particularly noting that vDCs (e.g., vDC6, vDC7) share core networks and are used by hundreds of applications.
    • Ownership and accountability: ensuring the Cloud Health data is aligned with responsible owners and regions (e.g., APAC, regional teams).
    • Ownership clarity: some accounts and networks may be standalone or paired differently; ensure owner names and contact points are correctly captured in trackers.

  • Credential management and security strategy

    • Current state: password-related governance and automation discussions are ongoing; focus on improving password complexity this year and migrating credential storage.
    • LastPass vs Key Vault:
    • LastPass: considered as a store for automation credentials or centralized password management, potentially moving password control away from scattered local stores.
    • Key Vault: preferred for in-Azure automation due to managed identities and seamless integration with automation, enabling programmatic access to secrets without exposing them.
    • Migration plan: aim to migrate credentials to LastPass while retaining exceptions for automation that requires programmatic access to secrets; build a new LastPass space for the TCS cloud team and align folders with organizational operating model.
    • Deeper integration considerations:
    • If automations rely on secrets, determine how to balance LastPass use with Key Vault for secure access.
    • Some items (e.g., admin credentials on servers) may require LastPass or API-based access in addition to Key Vault managed identities.
    • The migration will involve organizational changes and regional IT team involvement; a phased approach with clear ownership is needed.
    • Next steps for access and governance: consider opening tickets to security owners to confirm platform ownership and access rights; coordinate with the CloudStuff repository owners for governance.
    • Broader security goal: raise password complexity across systems and align credential storage with the evolving security model, including LastPass, Key Vault, and automation needs.

  • Automation, processes, and operational alignment

    • VM credential handling: discussion about how credentials are created/stored during VM creation; currently, credentials may be stored in a recovery vault or retrieved via API rather than stored in LastPass.
    • Potential migration path: move secrets into LastPass for automation-ready access, while maintaining Key Vault for managed identities and automation where appropriate.
    • Exception handling: automation scenarios may require exceptions to use programmatic secret access; plan to document and govern these cases.
    • Future-proofing: align automation with security policy changes; ensure that new automation requires minimal manual intervention and adheres to password/secret management standards.

  • Stakeholders, governance, and ongoing collaboration

    • Venkat: asked for highlights of what he is working on; network/shared services and cost reporting were discussed.
    • APAC weekly call: Azure China and cost-reduction efforts discussed in a standing weekly cadence; monitoring uptime and savings measurements as part of the routine.
    • James: coordinating with security and cloud teams; offering to help with deployments, firewall considerations, and security tooling.
    • Next steps on access and governance: propose tickets toSecurity or Cloud IT to determine ownership of the platform and the appropriate owners for platform access.

  • Quick takeaways and action items

    • Implement the next-available-slot logic in NSG script and validate the new /24 network addition within the existing VNet (no new VNet creation).
    • Coordinate with regional teams to finalize the policy for default NSGs and ensure proper routing for the new subnet.
    • Prepare a weekly Azure China call agenda focusing on uptime, vault costs, decommissioning, and potential savings.
    • Confirm reservation applicability in Azure China and document exact limits (EA/CSP/CSA eligibility) for subscriptions outside EA.
    • Move toward a LastPass-based credential store for automation; evaluate exceptions for programmatic access and identify which secrets must remain in Key Vault due to automation needs.
    • Create a new LastPass space for the TCS cloud team and align folder structure with the operating model and regional IT organization.
    • Open tickets to security/ownership stakeholders to establish platform governance and access control responsibilities.

  • Final reflections

    • The team is on track to balance cost, security, and operational efficiency through a combination of automation, smarter networking, and more centralized credential management.
    • Regular touchpoints (APAC weekly calls) will help track progress on Azure China savings, vault optimization, and regional deployment consistency.