da Agency

Azure Container Registry Private Link support preview for virtual networks

Azure Container Registry announces preview support for Azure Private Link, a means to limit network traffic of resources within the Azure network.

With Private Link, the registry endpoints are assigned private IP addresses, routing traffic within a customer-defined virtual network. Private network support has been one of the top customer asks, allowing customers to benefit from the Azure management of their registry while benefiting from tightly controlled network ingress and egress.
  

Private Links are available across a wide range of Azure resources with more coming soon, allowing a wide range of container workloads with the security of a private virtual network.

Private Endpoints and Public Endpoints

Private Link provides private endpoints to be available through private IPs. In the above case, the contoso.azurecr.io registry has a private IP of 10.0.0.6 which is only available to resources in contoso-aks-eastus-vnet. This allows the resources in this VNet to securely communicate. The other resources may be restricted to resources only within the VNet.

At the same time, the public endpoint for the contoso.azurecr.io registry may still be public for the development team. In a coming release, Azure Container Registry (ACR) Private Link will support disabling the public endpoint, limiting access to only private endpoints, configured under private link.

Cross tenant manual approval support

Customers looking to establish a private link between two Azure tenants, where an Azure container registry is in one tenant and while container hosts are in other tenants can use the Private Link Manual Approval workflow. This workflow enables many Azure services, including Azure Machine Learning, to securely interact with your registry. Development teams working in different subscriptions and tenants may also utilize private link manual approval to grant access.

Service Endpoints and Private Links

ACR Service Endpoint preview support was released in March 2019. Service Endpoints provide access from Azure VNets through IP tagging. All traffic to the service endpoint is limited to the Azure backbone network through routing. The public endpoint still exists; however, firewall rules limit public access. Private Link capabilities take this a step further by providing a private endpoint (IP address). As Private Links are more secure and a superset of capabilities of Service Endpoints, Private link support will replace Azure Container Registry Service Endpoint support. While both Service Endpoints and Private Link are currently in preview, we plan to release Private Link capabilities as generally available shortly. We encourage Service Endpoint customers to evaluate ACR Private Link capabilities.

Preview support and limitations

During the preview period, private link support is limited to registries that are not geo-replicated. The feature will move to general availability as we assess feedback and geo-replication support is complete.

We’ve heard clearly that customers requiring private networks also require production support. As such, all support requests will be honored through standard support channels.

Regional support and pricing

Azure Container Registry Private Link support is available across 28 regions through the premium tier.

Additional links:

Learn more about Azure Container Registry.
Azure Container Registry pricing.
Configure Azure Private Link for an Azure Container Registry.

Quelle: Azure

da Agency

Azure Government Secret accredited at DoD IL6, ICD 503 with IaaS and PaaS

Accelerate classified missions with unparalleled connectivity, high availability, and resiliency across three regions with more than 35 services

Azure Government Secret recently achieved Provisional Authorization (PA) at Department of Defense Impact Level 6 (IL6) and Intelligence Community Directive (ICD) 503 with facilities at ICD 705. We’re also announcing a third region to enable even higher availability for national security missions to stay ahead of their unique threats.

Built exclusively for the needs of US government and operated by cleared US citizens, Azure Government Secret delivers dedicated regions to maintain the security and integrity of classified Secret workloads while enabling reliable access to critical data. The first cloud natively connected to classified networks; Azure Government Secret enables customers to leverage options for private, resilient, high-bandwidth connectivity.

Protect national security production workloads with geodiversity across three regions

Azure Government Secret is designed for the unique requirements of critical national security workloads that cannot be served out of a single geographic location. To provide the geodiversity required, Azure Government Secret delivers across three dedicated regions for US Federal Civilian, Department of Defense (DoD), Intelligence Community (IC), and US government partners working within Secret enclaves. These dedicated Azure regions are located over 500 miles apart to enable applications to stay running in the face of a disaster without a break in continuity of operations.

In addition, these regions provide greater choice when working across multiple locations and delivering cloud-to-edge scenarios. With comprehensive cloud services Azure Government Secret enables faster innovation for the mission from cloud to tactical edge meeting the critical availability needs of the warfighter.

Enabling classified missions at scale with more than 35 services

Designed and built for Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS) and Marketplace solutions, Azure Government Secret provides a broad range of commercial innovation for classified workloads.­ Some of the services include: identity, analytics, security, and high performance computing to support advanced artificial intelligence (AI) and machine learning.

Operated by cleared US citizens, these new regions are part of Azure Government, delivering a familiar, consistent experience and alignment with existing resellers and programs. Eligible customers can also leverage cleared Microsoft cloud support for their workloads.

Gain speed by connecting directly or extending on-premises networks

With Azure Government Secret, customers can connect natively to classified networks or leverage options for private, resilient, high-bandwidth connectivity using ExpressRoute and ExpressRoute Direct:

Native connection: Agencies with direct connections through US government classified networks can connect natively to Azure Government Secret.
ExpressRoute: Extend on-premises networks into Azure Government Secret regions over a private connection facilitated by a connectivity provider with ExpressRoute.
ExpressRoute Direct: Get the ability to connect directly into Azure Government Secret locations using ExpressRoute Direct.

Continued investments in commercial parity across data classifications

In addition to serving mission customers at DoD IL6 and ICD 503, we continue to invest in rapidly delivering new Azure Government capabilities to support mission needs across all data classifications for any US government customer. In the last six months we’ve continued our drive toward commercial parity, adding hundreds of features and launching 40+ new services and 101 total services in FedRAMP High, with more to come across Azure commercial, Azure Government and Azure Government Secret.

These continued investments enable customers across the full spectrum of government, including departments in every state, all the federal cabinet agencies, and each military branch, modernize their IT to better achieve their missions.

To learn more about Azure Government Secret contact us or visit Azure Government for national security.
Quelle: Azure