工作总结模板12ppt课件.pptx

Paas est approach Example DataandServiceArchitecture Users DataSources Engineering Pilots Airplane Analyze Ingest Store Interact Ops Monitoring Security Identity Governance Analyst Scientist ArtificialIntelligence Copy Raw Enriched Published Dashboards Reports Apps Modeling MachineLearning Experimentation DevOps RBAC Metadata Format Summarize Analyze Example DataandServiceArchitecture Ingest Store Interact Ops Monitoring Security Identity Governance Analyst Scientist DataFactory HDInsight DataLakeAnalytics EventHubs SQLDataWarehouse DataLakeStore MachineLearning MicrosoftR Spark DocumentDB SQLDatabase CognitiveServices PowerBI AppServices SecurityCenter AzureKeyVault MFA LogicApp Batch AzureSearch Users Engineering Pilots DataSources Airplane BigDataStores InformationManagement Transformdataintointelligentaction Action People AutomatedSystems Apps Web Mobile Bots EventHubs DataCatalog DataFactory MachineLearningandAnalytics HDInsight HadoopandSpark StreamAnalytics Intelligence DataLakeAnalytics MachineLearning SQLDataWarehouse DataLakeStore DataSources Apps Sensorsanddevices Data CosmosDB Intelligence Dashboards Visualizations Cortana BotService CognitiveServices PowerBI AzureAnalysisServices Solutionbasedon more PAASservices Storage On prem Azure DataCatalog SQLDatabase DataFactory DataManagementGateway ERorInternet ERorInternet Costpermonth Geographicalconsiderations Geographicalconsiderations 07 06 2017 Appendix HDInsightonLinux SecurityOverview Contosobigdatapipeline Sales Telemetry Feedback Bigdatastores Landingzone Dataprep analytics ML Dashboards Visualizations IdentityManagement InformationManagement AzureActiveDirectory AzureDataFactory datamovement joborchestration Web Mobile Bots People Apps Automatedsystems LeveragingAzureActiveDirectory DataLakeAnalytics HDInsight DataLakeStore 4 2 AdduserstoAADTenant 1 CreateADDSinstanceinseparateVNET 3 AdduserstoADLARBACroles 4 AdduserstoADLSRBACroles ACLs JoinHDInsightclustertoADDSinstance OAuthtoken OAuthtoken Basicauth HTTPS GraphAPIs GraphAPIs Azureactivedirectorytenant Azuredirectorydomainservicesinstance 2 1 3 5 5 Kerberos LDAPS IncorporatingEnterpriseActiveDirectory DataLakeAnalytics HDInsight DataLakeStore 4 SyncuserinfofromenterpriseADtoAAD AdduserstoADdomain AdduserstoADLARBACroles AdduserstoADLSRBACroles ACLs JoinHDInsightclustertoenterpriseADoverExpressRoute OAuthtoken OAuthtoken Basicauth HTTPS GraphAPIs GraphAPIs Azureactivedirectorytenant MicrosoftActiveDirectory 2 1 3 5 Kerberos LDAPS 2 1 3 4 5 ActiveDirectoryDomainServices WhyADDS ADDSenablesHadoopservicesthatuseKerberos LDAPStocontinuetoworkwithoutchanges DNSnamerequiredduringclusterprovisioning ADDScanonlybeaddedtoaV1VNET BridgingrequiredtoARMVNEThostingHDI Note ToolstoeaseKerberizedHDIclusterprovisioningarebeingdeveloped ETA Q4CY2016 Controllinguseraccesstodata Productdemandanalysis DeliveryandOperations Controllinguseraccesstodata HDInsightsecurity ringsofdefense PerimeterlevelsecurityVirtualnetworkNetworksecurity i e firewalls Gateway AuthenticationKerberosActivedirectory AuthorizationHivepoliciesHBasepoliciesfolderlevelACLS DatasecurityEncryption rest PerimeterlevelsecurityUsingvirtualnetworkandgatewayservice PerimeterlevelsecurityVirtualnetworkNetworksecurity i e firewalls Gateway Perimeterlevelsecurity VNET HDInsightcluster Headnode WASB ADLS Datascientist Gateway Workernode s Services AuthenticationIntegrationwithAzureActiveDirectory AuthenticationKerberosActivedirectory AuthorizationApplicationanddata levelauthorization AuthorizationHivepoliciesHBasepoliciesfolderlevelACLS VNET AADtenant LDAP Authorization RangerDB AADtenant AzureVNETtoVNETpeering AuthorizationSecureEndpointsinHDInsightcluster HiveServer2 Ranger SSH WebHCat Oozie Ambari Views Accesstoallusers Accesstoonlyclusteradmin DatasecurityTransparentServerSideEncryption DatasecurityEncryption rest TransparentServerSideEncryption AzureDataLakeStorageALWAYSONtransparentencryptionAllreads writesareencrypted decryptedServicemanagedkeysaswellasCustomermanagedkeys WindowsAzureStorageBlobALWAYSONtransparentencryptionAllreads writesareencrypted decryptedServicemanagedkeys PublicPreview GeneralAvailability DataLakeStoreRole based POSIXAccesscontrol Azurerolesforaccountmanagement OwnerCanmanageaccountsandaccountsettingsCanmanageusers accessContributorCanmanageaccountsandaccountsettingsReaderCanviewaccountsettingsUseraccessadministratorCanviewaccountsettingsCanmanageusers access POSIXaclsforfilesandfolders PROTIP RoleassignmentrequiredtouseAzurePortalAutomateduploaders downloadersdonotneedRoleassignments PROTIP UseSecuritygroupswhensettingACLsandforRBACroleassignmentsAsingleusertoSGassignmentwillworkforbothACLandRBAC OnnewOwnerhasfullpermissions Read Write ExecuteOwnergrouphasRead ExecutepermissionsOthershaveRead ExecutepermissionsDefaultACLDefaultACLs 755 arepropagatedtochildobjectsDefaultACLcanbeconfiguredintheUX EncryptionAtRest AlwaysonAllnewlycreatedADLSaccountswillhaveencryptionatrestenabledbydefault FullyintegratedwithAzureKeyVaultforencryptionkeymanagementAskADLStoprovisionandmanagekeysProvisionandmanagetheirownkeysinAKV IdentityManagement AuthenticationSinglesharedusercredential AzureActiveDirectorySinglesharedadmincredential ActiveDirectoryDomainServicesAccessControl AuthorizationWASB ConfigureHDIclusterwithSASkeys