From 950213ab326c5b9ee1f08a6b0b1383fe810106e1 Mon Sep 17 00:00:00 2001 From: mohalkh5 Date: Sun, 13 Sep 2026 13:12:15 -0600 Subject: [PATCH 1/3] cloud doc review --- docs/cloud/aws/index.md | 33 ++--- docs/cloud/aws/lca0/billing/budget-actions.md | 65 +++++++--- docs/cloud/aws/lca0/billing/cost-est.md | 17 +-- docs/cloud/aws/lca0/billing/index.md | 8 +- docs/cloud/aws/lca0/billing/viewbilling.md | 2 +- docs/cloud/aws/lca0/faq/faq.md | 10 +- .../getting-started/aws-console-access.md | 4 +- .../customer-permission-boundary.md | 25 ++-- .../lca0/getting-started/customer-support.md | 4 +- docs/cloud/aws/lca0/getting-started/index.md | 3 +- docs/cloud/aws/lca0/index.md | 21 +-- .../aws/lca0/load-balancer/load-balancer.md | 82 +++++++++--- .../lca0/troubleshooting/troubleshooting.md | 116 +++++++++++++---- docs/cloud/aws/lca1/billing/budget-actions.md | 4 +- docs/cloud/aws/lca1/billing/index.md | 8 +- docs/cloud/aws/lca1/billing/viewbilling.md | 16 +-- docs/cloud/aws/lca1/customer-ssp/index.md | 15 +-- docs/cloud/aws/lca1/data-classification.md | 4 +- docs/cloud/aws/lca1/faq/index.md | 4 +- .../lca1/getting-started/aws-cli-access.md | 2 +- .../getting-started/aws-console-access.md | 2 +- .../getting-started/aws-restricted-regions.md | 3 +- .../customer-permission-boundary.md | 2 +- docs/cloud/aws/lca1/getting-started/index.md | 3 +- .../managing-customer-groups.md | 3 +- .../shared-responsibility-model.md | 2 +- docs/cloud/aws/lca1/incident-response.md | 2 +- docs/cloud/aws/lca1/index.md | 15 --- docs/cloud/aws/lca1/networking.md | 2 +- .../Microsoft-Azure-for-Academic-Research.md | 9 +- docs/cloud/azure/billing/billing.md | 108 +++++++++++++--- docs/cloud/azure/billing/cost-est.md | 82 ------------ docs/cloud/azure/billing/index.md | 19 --- .../azure/budget-actions/budget-actions.md | 121 ++++++++++-------- docs/cloud/azure/{faq => }/faq.md | 6 +- docs/cloud/azure/index.md | 24 ++-- .../gcp/Google-Cloud-research-credits.md | 27 ++-- docs/cloud/gcp/index.md | 9 +- 38 files changed, 473 insertions(+), 409 deletions(-) delete mode 100644 docs/cloud/azure/billing/cost-est.md delete mode 100644 docs/cloud/azure/billing/index.md rename docs/cloud/azure/{faq => }/faq.md (89%) diff --git a/docs/cloud/aws/index.md b/docs/cloud/aws/index.md index 83a9d185a..752d31aa3 100644 --- a/docs/cloud/aws/index.md +++ b/docs/cloud/aws/index.md @@ -1,6 +1,4 @@ -# AWS - -Amazon Web Services (AWS) Documentation +# Amazon Web Services This applies to customers who are using a **Research Computing Cloud Foundations** managed AWS account. @@ -12,36 +10,27 @@ Research Computing Cloud Foundations managed AWS accounts can be provisioned onl Each managed AWS account is associated with exactly one landing zone. A landing zone is a consistent group of account configuration, networking, and security controls that are applied to all associated accounts. -The Cloud Foundations team currently supports two landing zones, **LCA0** and **LCA1**. The landing zone associated with your AWS account dictates how you should log in and how the account is designed to work. You should reference documentation below that aligns with your landing zone. - -### How do I know what landing zone my AWS account is in? - -You received a url to log into your AWS account as part of your onboarding. +Currently we support two landing zones, **LCA0** and **LCA1**. -If you login via [https://aws-classic.colorado.edu/](https://aws-classic.colorado.edu/), you are using **LCA0**. +* LCA0: This is the original landing zone, intended for public data. +* LCA1: This is the next-generation landing zone, designed to support a wider range of data classifications. -If you login via [https://aws.colorado.edu/](https://aws.colorado.edu/), you are using **LCA1**. +Your landing zone determines how you access your AWS account and which capabilities and controls apply to the account. -### Landing Zone: LCA0 +### How do I know what landing zone my AWS account is in? -LCA0 is the original landing zone, rated only for public data. +You received an AWS login URL as part of the account onboarding process. The URL indicates which landing zone your account uses: +If you login via [https://aws-classic.colorado.edu/](https://aws-classic.colorado.edu/), you are using **LCA0**. ```{toctree} :maxdepth: 2 -:caption: LCA0 - +:hidden: lca0/index - ``` -### Landing Zone: LCA1 - -LCA1 is the next generation landing zone that will be rated to support a variety of data classifications. - +If you login via [https://aws.colorado.edu/](https://aws.colorado.edu/), you are using **LCA1**. ```{toctree} :maxdepth: 2 -:caption: LCA1 - +:hidden: lca1/index - ``` diff --git a/docs/cloud/aws/lca0/billing/budget-actions.md b/docs/cloud/aws/lca0/billing/budget-actions.md index 1c5ba4c69..2d2663b28 100644 --- a/docs/cloud/aws/lca0/billing/budget-actions.md +++ b/docs/cloud/aws/lca0/billing/budget-actions.md @@ -1,4 +1,4 @@ -# AWS - Budget Actions +# Budget Actions You can attach budget actions to an alert for either a cost budget or a usage budget. To configure a budget action on a new budget, first follow the steps for [Creating a cost budget](https://docs.aws.amazon.com/cost-management/latest/userguide/create-cost-budget.html) @@ -12,31 +12,43 @@ You can attach budget actions to an alert for either a cost budget or a usage bu 3. Click on ‘create budget’, choose Budget setup as ‘Customize(advanced)’ and Budget type as ‘Cost budget’ -![](images/1.png) +```{image} images/1.png +:alt: AWS Budget creation wizard with Customize advanced selected and Cost budget chosen as the budget type. +:align: center +``` +4. Enter a **Budget name**. Set **Set budget amount** to monthly, set **Budget renewal type** to **Recurring budget**, choose a **Start month**, set **Budgeting method** to **Fixed**, then enter your budgeted amount. -4. Choose ‘Budget name’ of choice and ‘set budget amount’ to monthly with ‘Budget renewal type’ as ‘Recurring budget’. Choose ‘Start month’ and ‘Budgeting method’ as ‘Fixed’. And finally ‘Enter your budgeted amount’. +```{image} images/2.png +:alt: AWS Budget creation wizard budget details, including name, monthly recurring amount, start month, and fixed budgeting method. +:align: center +``` +5. Under **Budget scope**, select the services to include. This example uses **All AWS Services**. Select **Next**. -![](images/2.png) +```{image} images/3.png +:alt: AWS Budget creation wizard budget scope step with All AWS Services selected. +:align: center +``` -5. Choose ‘Budget scope’ and select the services you would like in scope. For this example we will choose 'All AWS Services' and choose ‘Next’ +To configure a budget action on an existing cost or usage budget, first follow the steps for [editing a budget](https://docs.aws.amazon.com/cost-management/latest/userguide/create-cost-budget.html). Then, after you reach the **Configure alerts** step of creating or editing the budget, use the following procedure. -![](images/3.png) - -To configure a budget action on an existing cost or usage budget, first follow the steps for [Editing a budget](https://docs.aws.amazon.com/cost-management/latest/userguide/create-cost-budget.html). Then, after you reach the **Configure alerts** step of creating or editing the budget, use the following procedure. - - -## To configure a budget action +## Configure a budget action 1. To configure a budget action on a new alert, choose **Add an alert threshold**. To configure a budget action on an existing alert, skip to step 7. -![](images/4.png) - +```{image} images/4.png +:alt: AWS Budget creation wizard Configure alerts step with an Add an alert threshold button. +:align: center +``` 2. Under Set **alert threshold**, for Threshold, enter the amount that needs to be reached for you to be notified. This can be either an absolute value or a percentage(choose using drop down). For example, say you have a budget of $200. To be notified at $160 (80% of your budget), enter 160 for an absolute budget or 80 for a percentage budget. Next to the amount, choose **Absolute value** to be notified when your costs exceed the threshold amount. Or, choose **% of budgeted amount** to be notified when your costs exceed the threshold percentage. Next to the threshold, choose **Actual** to create an alert for actual spend ‘Trigger’. Or, choose **Forecasted** to create an alert for forecasted spend. - ![](images/5.png) + + ```{image} images/5.png + :alt: AWS Budget creation wizard alert threshold fields for amount, absolute or percentage, and actual or forecasted spend. + :align: center + ``` 3. (Optional) Under **Notification preferences - Optional**, for **Email recipients**, enter the email addresses that you want the alert to notify. Separate multiple email addresses with commas. A notification can have up to 10 email addresses. @@ -48,7 +60,10 @@ To configure a budget action on an existing cost or usage budget, first follow t 7. For **Attach actions - Optional**, choose **Add Action.** -![](images/6.png) +```{image} images/6.png +:alt: AWS Budget creation wizard Attach actions step with an Add Action button. +:align: center +``` 8. For **Select IAM role**, choose an IAM role to allow AWS Budgets to perform an action on your behalf. It is recommended to use ‘Budget-role’ which has a Managed policy: AWSBudgetsActions_RolePolicyForResourceAdministrationWithSSM attached to it. This managed policy is focused on specific actions that AWS Budgets takes on your behalf when completing a specific action. This policy gives permission to control AWS resources. For example, starts and stops Amazon EC2 or Amazon RDS instances by running AWS Systems Manager (SSM) scripts. @@ -61,18 +76,30 @@ This managed policy is focused on specific actions that AWS Budgets takes on you 12. For **How do you want to be alerted when this action is run, choose Use the same alert settings when you defined this threshold** or **Use different alert settings**. To use different alert settings, complete the **Notification preferences** specific to this action. -![](images/7.png) +```{image} images/7.png +:alt: AWS Budget creation wizard action configuration fields for IAM role, action type, instance targets, automatic run, and alert settings. +:align: center +``` 13. Choose **Next**. 14. Review your budget settings, and then choose **Create budget**. -![](images/8.png) +```{image} images/8.png +:alt: AWS Budget creation wizard review page summarizing budget details, alerts, and actions before Create budget. +:align: center +``` After you create an action, you can view its status from the AWS Budgets page on the **Actions** column. This column shows your configured actions count, actions waiting for your approval (**Requires approval**), and your successfully completed actions. -![](images/9.png) +```{image} images/9.png +:alt: AWS Budgets overview table with an Actions column showing configured, pending, and completed action counts. +:align: center +``` Once a budget action is taken place, you get alerts based on the chosen notification preference. Below is a snippet of an email notification. -![](images/10.png) +```{image} images/10.png +:alt: Example AWS Budgets email notification stating that a budget threshold was exceeded and an action was taken. +:align: center +``` diff --git a/docs/cloud/aws/lca0/billing/cost-est.md b/docs/cloud/aws/lca0/billing/cost-est.md index faa0eea45..269f798e8 100644 --- a/docs/cloud/aws/lca0/billing/cost-est.md +++ b/docs/cloud/aws/lca0/billing/cost-est.md @@ -1,16 +1,12 @@ -# AWS - Network Cost Guide +# Network Cost Guide -## Document Purpose - -This document gives some sample cost estimates for select network access methods and provides the URL's to find current pricing. - -## Network access methods +There are thre network acess methods available: 1) Internet Gateway - used with public IP 2) NAT Gateway - used with private IP 3) CFS Transit Gateway (VPN) - used with private IP address, VPN connects back to CU Boulder -### Internet Gateway +## Internet Gateway **Important** Always check [AWS documentation](https://aws.amazon.com/ec2/pricing/on-demand/) for current pricing. @@ -30,7 +26,7 @@ Always check [AWS documentation](https://aws.amazon.com/ec2/pricing/on-demand/) Total Network Cost = $36/month -### NAT Gateway +## NAT Gateway **Important** Always check [AWS documentation](https://aws.amazon.com/vpc/pricing/) for current pricing. @@ -50,7 +46,7 @@ Always check [AWS documentation](https://aws.amazon.com/vpc/pricing/) for curren Total Network Cost = $59.40/month -### CFS Transit Gateway VPN +## CFS Transit Gateway VPN **Important** Always check [AWS documentation](https://aws.amazon.com/transit-gateway/pricing/) for current pricing. @@ -68,5 +64,4 @@ Always check [AWS documentation](https://aws.amazon.com/transit-gateway/pricing/ 2) Upload cost = $0.02 x 500 = $10 3) Attachment cost = $0.05 x (24hr x 30day= 720hr) = $36 - Total Network Cost = $48/month - + Total Network Cost = $48/month \ No newline at end of file diff --git a/docs/cloud/aws/lca0/billing/index.md b/docs/cloud/aws/lca0/billing/index.md index 7ec8bed26..174d00851 100644 --- a/docs/cloud/aws/lca0/billing/index.md +++ b/docs/cloud/aws/lca0/billing/index.md @@ -1,4 +1,4 @@ -# AWS - Billing +# Billing ```{note} The data in AWS Cost Explorer does not directly map to the charges in the invoices you receive. See the links below to learn how to accurately calculate your charges in AWS Cost Explorer and set budget alerts. @@ -6,24 +6,18 @@ The data in AWS Cost Explorer does not directly map to the charges in the invoic ```{toctree} :maxdepth: 1 -:caption: View Billing - viewbilling ``` ```{toctree} :maxdepth: 1 -:caption: Budget Actions - budget-actions ``` ```{toctree} :maxdepth: 1 -:caption: Network Cost Guide - cost-est ``` diff --git a/docs/cloud/aws/lca0/billing/viewbilling.md b/docs/cloud/aws/lca0/billing/viewbilling.md index 1d3268b2e..83c38d0c5 100644 --- a/docs/cloud/aws/lca0/billing/viewbilling.md +++ b/docs/cloud/aws/lca0/billing/viewbilling.md @@ -1,4 +1,4 @@ -# AWS - View Billing Data +# View Billing Data ```{note} For all billing periods beginning after 6/30/2025, you should refer directly to [AWS Cost Explorer](https://aws.amazon.com/aws-cost-management/aws-cost-explorer/) and your invoices in the [CU Marketplace](https://www.cu.edu/uis/service-catalog/cu-marketplace). CloudCheckr is no longer used for billing information. diff --git a/docs/cloud/aws/lca0/faq/faq.md b/docs/cloud/aws/lca0/faq/faq.md index 20c8b2ea9..418e44327 100644 --- a/docs/cloud/aws/lca0/faq/faq.md +++ b/docs/cloud/aws/lca0/faq/faq.md @@ -1,6 +1,4 @@ -# AWS - FAQs - -Frequently Asked Questions +# Frequently Asked Questions If you are looking for help with specific errors, please visit the [Troubleshooting](../troubleshooting/troubleshooting.md) guide. @@ -24,9 +22,7 @@ The **us-west-2** AWS region has the lowest latency from Colorado's Front Range ## Can I use the root user? **Answer:** -No. -The root user is owned by the **Cloud Foundations Service** team. -You must use your CustomerAdmin role. +No, the root user is owned by the **Cloud Foundations Service** team. You must use your `CustomerAdmin` role. ## Are MTurk users supported? @@ -51,5 +47,5 @@ Click on the drop down on the top right corner of the console page to expand you **Answer:** No. Resources owned by the **Cloud Foundations Service (CFS)** team cannot be altered or removed and they can be identified by name prefix and/or resource tags. Any resources with the prefix `oitcld-` are owned by CFS, in addition to those with the below tag attached. ```{image} images/CFSTag.png -:alt: The CFS tag has the key/value pair of "oit-cld:management:central"/"true" +:alt: AWS resource tag with key oit-cld:management:central and value true. ``` diff --git a/docs/cloud/aws/lca0/getting-started/aws-console-access.md b/docs/cloud/aws/lca0/getting-started/aws-console-access.md index 0b3ce88c5..71901304c 100644 --- a/docs/cloud/aws/lca0/getting-started/aws-console-access.md +++ b/docs/cloud/aws/lca0/getting-started/aws-console-access.md @@ -27,13 +27,13 @@ You can access your AWS Account from anywhere with internet access. You do not 1. Launch the [AWS Management Console (SSO URL)](https://aws-classic.colorado.edu). 2. Provide your university login credentials (like your [CU IdentiKey](https://oit.colorado.edu/services/identity-access-management/identikey) for CU Boulder) when directed to Microsoft Entra. ```{image} images/aws-console-access/login.png - :alt: CU SSO login page + :alt: CU single sign-on login page for accessing the AWS Management Console. ``` 3. Choose a method for authentication. We recommend you select "Send Me a Push". **NOTE:** You may not see the MFA step if you've recently authenticated and have an active session. 4. Accept the MFA request on your device. 5. You will be presented with a list of account names and numbers to which you have access. Click on the name of the desired account to expand the roles allocated to you. Select the Account and Role you wish to log in to. ```{image} images/aws-console-access/select-role.png - :alt: AWS SSO account and role selection page + :alt: AWS access portal listing accounts and roles that can be selected after sign-in. ``` 6. You will be logged in to the AWS Management Console. Always be sure to verify you have the AWS Region you are working with selected after logging in. Once logged in, you have a 4 hour session. When your session expires, return to the access portal to refresh your credentials. diff --git a/docs/cloud/aws/lca0/getting-started/customer-permission-boundary.md b/docs/cloud/aws/lca0/getting-started/customer-permission-boundary.md index 9265821f3..b7792521e 100644 --- a/docs/cloud/aws/lca0/getting-started/customer-permission-boundary.md +++ b/docs/cloud/aws/lca0/getting-started/customer-permission-boundary.md @@ -1,11 +1,11 @@ # Admin Account Permission Exclusions -Customers who wish to create new AWS Users or Roles are prevented from doing so unless they use the "Customer_Admin_PermissionBoundary" Permission Boundary. +Customers who wish to create new AWS Users or Roles are prevented from doing so unless they use the `Customer_Admin_PermissionBoundary` Permission Boundary. See below for more information. In addition, there are Explicit Denials that apply to all AWS Users and Roles. This is also described below. ```{important} -Note that when using some AWS wizards to create services, the wizard will try to create a Role. +When using some AWS wizards to create services, the wizard will try to create a Role. Due to the limitations discussed below, the wizard will fail. When encountering this situation, you must manually create the Role with the proper permissions, and attach the permission boundary discussed below. Then, in the wizard, you need to pick the Role you created. @@ -18,7 +18,9 @@ This Role will generally be used to set up new IAM Roles and to deploy basic inf Please consider the principal of least privilege when managing your accounts. In order to ensure that this role is not breaking components deployed as part of the CU Boulder standard AWS Account Baseline there are certain restrictions on what this role can perform. -Outside of these restrictions, the Customer Admin role will have full administrative privileges. +Outside of these restrictions, the `Customer Admin` role will have full administrative privileges. + +## Actions Explicitly Denied All Users, including Customer Administrators, automatically have Explicit Denial of the following actions: * Changes to OIT Cloud Admin Roles, Users, Policies, and Groups @@ -32,16 +34,21 @@ All Users, including Customer Administrators, automatically have Explicit Denial ## Permission Boundary (limits permissions of new users or roles created by Customer Admin) Creation of new Users and Roles by a Customer Admin Role is only allowed if the Permission Boundary is attached at the creation of the User or Role. -Permission Boundary is a policy created by **Research Computing Cloud Team** in your account named "Customer_Admin_PermissionBoundary". +Permission Boundary is a policy created by us in your account named `Customer_Admin_PermissionBoundary`. -New Users and Roles have the same restrictions as above, plus: -* New Users/Roles are Explicitly Denied the ability to Create/Update any additional AWS Roles/Users +New users and roles created with this permissions boundary are subject to the same explicit restrictions listed above. They are also explicitly denied the ability to to Create/Update any other AWS Roles/Users ## Attaching Permission Boundary -When creating new AWS Roles or Users, you must set the Permission Boundary. +You must attach the Customer_Admin_PermissionBoundary permissions boundary when creating a new IAM user or role. + +During the Create role or Create user wizard: -On Step 2 of the 'Create role' or 'Create user' wizard, search for and add the "Customer_Admin_PermissionBoundary" Policy to the 'Set permissions boundary' section. +1. On Step 2, expand Set permissions boundary. +2. Select Use a permissions boundary to control the maximum role permissions. +3. Search for `Customer_Admin_PermissionBoundary`. +4. Select `Customer_Admin_PermissionBoundary`. +5. Select Next: Tags to continue. -![](images/customer-permission-boundary/permission-boundary.jpeg) +![AWS Create role wizard Set permissions boundary section, with Use a permissions boundary selected, Customer_Admin_PermissionBoundary chosen, and Next: Tags highlighted.](images/customer-permission-boundary/permission-boundary.jpeg) diff --git a/docs/cloud/aws/lca0/getting-started/customer-support.md b/docs/cloud/aws/lca0/getting-started/customer-support.md index 63422d267..ee20e5002 100644 --- a/docs/cloud/aws/lca0/getting-started/customer-support.md +++ b/docs/cloud/aws/lca0/getting-started/customer-support.md @@ -1,4 +1,4 @@ -# AWS Support +# AWS Support Plan All new AWS accounts are configured with Basic Support. AWS offers higher support tiers at pay-by-the-month pricing. @@ -16,5 +16,5 @@ For more information about OIT Support, visit the website: [https://oit.colorado **Support Levels and Costs** -For more information about AWS Support Plans and Pricing, please see the AWS documentation here: [https://aws.amazon.com/premiumsupport/pricing/?nc=sn&loc=3](https://aws.amazon.com/premiumsupport/pricing/?nc=sn&loc=3) +For more information about AWS Support Plans and Pricing, please see the AWS documentation here: [https://aws.amazon.com/premiumsupport/pricing/](https://aws.amazon.com/premiumsupport/pricing/?nc=sn&loc=3) diff --git a/docs/cloud/aws/lca0/getting-started/index.md b/docs/cloud/aws/lca0/getting-started/index.md index 4c618ae92..a9bd83beb 100644 --- a/docs/cloud/aws/lca0/getting-started/index.md +++ b/docs/cloud/aws/lca0/getting-started/index.md @@ -1,8 +1,7 @@ -# AWS - Getting Started +# Getting Started ```{toctree} :maxdepth: 2 -:caption: Getting Started Documentation aws-console-access aws-cli-access diff --git a/docs/cloud/aws/lca0/index.md b/docs/cloud/aws/lca0/index.md index 05048c298..0200dfaa7 100644 --- a/docs/cloud/aws/lca0/index.md +++ b/docs/cloud/aws/lca0/index.md @@ -4,48 +4,35 @@ These pages apply to all AWS accounts in the LCA0 landing zone. ```{toctree} :maxdepth: 1 -:caption: Frequently Asked Questions - faq/faq ``` ```{toctree} :maxdepth: 1 -:caption: Getting Started Documentation - getting-started/index ``` ```{toctree} :maxdepth: 1 -:caption: Billing Documentation - billing/index ``` ```{toctree} :maxdepth: 1 -:caption: Research Credits - -AWS-Programs-for-Research-and-Education +troubleshooting/troubleshooting ``` ```{toctree} :maxdepth: 1 -:caption: Troubleshooting Errors - -troubleshooting/troubleshooting +load-balancer/load-balancer ``` ```{toctree} :maxdepth: 1 -:caption: Load Balancer Setup - -load-balancer/load-balancer - -``` +AWS-Programs-for-Research-and-Education +``` \ No newline at end of file diff --git a/docs/cloud/aws/lca0/load-balancer/load-balancer.md b/docs/cloud/aws/lca0/load-balancer/load-balancer.md index 8acb67480..b0107767d 100644 --- a/docs/cloud/aws/lca0/load-balancer/load-balancer.md +++ b/docs/cloud/aws/lca0/load-balancer/load-balancer.md @@ -1,54 +1,98 @@ # Setting up a Load Balancer -Setup a load balancer to publicly expose services running on the internal VPC. This is to be used when you have a service running on the internal campus network (CFS VPC private subnets) and want to expose it to the outside internet. To accomplish this we must put a load balancer in front of the VPC. - -## Notes -There are many different ways to accomplish this goal. This is an example of one way that you can set this up. This example does not include setting up a domain name or certificates. - -Ensure that you are creating resources in the same region as your EC2 instance. +Setup a load balancer to publicly expose services running on the internal VPC. This is to be used when you have a service running on the internal campus network (CFS VPC private subnets) and want to expose it to the outside internet. To accomplish this we must put a load balancer in front of the VPC. There are many different ways to accomplish this goal. Below is an example of one way that you can set this up. ## Network Load Balancer Example In this example we assume the prerequisite of an EC2 instance using the CFS VPC on the private subnet. The EC2 instance is running nginx on port 443 and has an inbound security group rule allowing access to port 443 on the EC2 instance. We are going to expose it to the outside internet on port 443 using a network load balancer. +```{note} +This example does not include setting up a domain name or certificates. Ensure that you are creating resources in the same region as your EC2 instance. +``` + 1. Navigate to Load Balancers by searching for "Load Balancers" in the main search box. -![](images/search.png) +```{image} images/search.png +:alt: AWS Management Console search results for load balancers, with the EC2 Load balancers feature highlighted. +:align: center +``` 2. Select "Create load balancer" -![](images/create-lb.png) + +```{image} images/create-lb.png +:alt: AWS EC2 Load balancers page with a Create load balancer button. +:align: center +``` 3. Select "Network Load Balancer" -![](images/select-lb-type.png) + +```{image} images/select-lb-type.png +:alt: AWS Create load balancer page listing Application, Network, and Gateway load balancer types, with Network Load Balancer as the choice for this example. +:align: center +``` 4. Under the Basic configuration section, name the load balancer and leave the rest of the settings as defaults -![](images/name-nlb.png) + +```{image} images/name-nlb.png +:alt: AWS Network Load Balancer basic configuration section with a name field. +:align: center +``` 5. Under the Network mapping section, select "cfs-vpc". Then check the availability zones you would like to use. Make sure to select the public subnet. -![](images/select-subnet.png) + +```{image} images/select-subnet.png +:alt: AWS Network mapping section with cfs-vpc selected and public subnets checked for the chosen Availability Zones. +:align: center +``` 6. Scroll down to the "Security groups" section. Click the link to "create a new security group". This will open a new tab with the security group wizard. 7. For this example we will allow inbound traffic on port 443 from anywhere. Give your security group a name and description. Then click add inbound rule, select "HTTPS" as type, and choose "anywhere" as source. Then click "Create security group". Now go back to the Load balancer wizard tab. -![](images/security-group-wizard.png) + +```{image} images/security-group-wizard.png +:alt: AWS Create security group wizard with an inbound HTTPS rule from anywhere on port 443. +:align: center +``` 8. Under the Security group section, click the refresh icon next to the select security group box. Then remove the default security group and select the security group that was just created. -![](images/security-group.png) + +```{image} images/security-group.png +:alt: AWS load balancer Security groups section with the newly created security group selected. +:align: center +``` 9. Under the Listeners and routing section, select the "Create target group" link. This will open a new tab with the target group wizard. 10. In this example we will select "Instances" target type. Give your target group a name. -![](images/target-group-type.png) + +```{image} images/target-group-type.png +:alt: AWS Create target group page with Instances selected as the target type and a name field. +:align: center +``` 11. In this example we will use port 443. Make sure to select the "cfs-vpc" -![](images/target-group-port-443.png) + +```{image} images/target-group-port-443.png +:alt: AWS Create target group protocol and port settings with TCP port 443 and cfs-vpc selected. +:align: center +``` 12. Select your EC2 target(s) and then select "Include as pending below". Then select "Create target group" to complete the target group creation. -![](images/select-target-443.png) + +```{image} images/select-target-443.png +:alt: AWS Register targets page with an EC2 instance selected and Include as pending below available. +:align: center +``` 13. The target group is now created and the tab can be closed. Now go back to the Load balancer wizard, click the little refresh icon and then select the target group that was just created. Enter the load balancer listening port (443 in this example) and type of traffic (TCP in this example). Then scroll down and "Create load balancer" to complete the setup. -![](images/listeners443.png) -14. Once your load balancer state changes from provisioning to active you will be able to access your service at https:// followed by the load balancer DNS name. Please note there can be a few minute delay for the load balancer to be reachable. -![](images/load-balancer-dns.png) +```{image} images/listeners443.png +:alt: AWS Listeners and routing section with TCP port 443 forwarding to the new target group. +:align: center +``` +14. Once your load balancer state changes from provisioning to active you will be able to access your service at https:// followed by the load balancer DNS name. Please note there can be a few minute delay for the load balancer to be reachable. +```{image} images/load-balancer-dns.png +:alt: AWS Network Load Balancer details page showing Active status, DNS name, internet-facing scheme, and a TCP 443 listener. +:align: center +``` \ No newline at end of file diff --git a/docs/cloud/aws/lca0/troubleshooting/troubleshooting.md b/docs/cloud/aws/lca0/troubleshooting/troubleshooting.md index a0b2aabf4..c8815e5f7 100644 --- a/docs/cloud/aws/lca0/troubleshooting/troubleshooting.md +++ b/docs/cloud/aws/lca0/troubleshooting/troubleshooting.md @@ -1,12 +1,28 @@ -# AWS - Troubleshooting +# Troubleshooting -Troubleshooting AWS Errors +This page covers common AWS permission errors in Cloud Foundations Service (CFS) accounts. Most of these errors occur when a new IAM user or role is created without the required permissions boundary. + +If you are looking for general account questions, see the [AWS FAQs](../faq/faq.md). ## Failed to create role: not authorized to perform: iam:CreateRole -**Error:** +This error appears in the AWS Management Console when you create an IAM role without attaching the required permissions boundary. + +**Error message:** + +``` +Failed to create role -![](images/create-role.png) +User: arn:aws:sts:::assumed-role/Shibboleth-Customer-Admin/@colorado.edu +is not authorized to perform: iam:CreateRole +on resource: arn:aws:iam:::role/ +with an explicit deny in a permissions boundary +``` + +```{image} images/create-role.png +:alt: AWS console error banner stating Failed to create role because iam:CreateRole is denied by a permissions boundary. +:align: center +``` **Solution:** @@ -15,62 +31,110 @@ See [Admin Account Permission Exclusions](../getting-started/customer-permission ## Unable to create user: not authorized to perform: iam:CreateUser -**Error:** +This error appears in the AWS Management Console when you create an IAM user without attaching the required permissions boundary. -![](images/create-user.png) +**Error message:** + +``` +Unable to create user +AWS could not create the user you requested. + +User: arn:aws:sts:::assumed-role/Shibboleth-Customer-Admin/@colorado.edu +is not authorized to perform: iam:CreateUser +on resource: arn:aws:iam:::user/ +with an explicit deny in a permissions boundary +``` + +```{image} images/create-user.png +:alt: AWS console error titled Unable to create user, stating iam:CreateUser is denied by a permissions boundary. +:align: center +``` **Solution:** -When creating AWS Users, you must attach the "Customer_Admin_PermissionBoundary" Permission Boundary. -See [Admin Account Permission Exclusions](../getting-started/customer-permission-boundary.md) +When creating AWS users, attach the `Customer_Admin_PermissionBoundary` permissions boundary. See [Admin Account Permission Exclusions](../getting-started/customer-permission-boundary.md). + ## AccessDenied: not authorized to perform: iam:CreateRole | Module Block -Below error occurs when creating **EKS Cluster** using [Terraform module](https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest) from the Terraform registry. +This error occurs when creating an Amazon EKS cluster with the [Terraform EKS module](https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest) from the Terraform Registry. + +This is not an AWS or Terraform bug. It happens when CU Boulder AWS customers use the Customer Admin IAM role to create an EKS cluster without passing the permissions boundary into the module. -This error is not an AWS nor Terraform bug. This error is seen when AWS Customers at CU Boulder uses their customer admin IAM role to create an EKS cluster. +**Error message:** -**Error:** +``` +Error: creating IAM Role (): AccessDenied: +User: arn:aws:sts:::assumed-role/Shibboleth-Customer-Admin/ +is not authorized to perform: iam:CreateRole +on resource: arn:aws:iam:::role/ +with an explicit deny in a permissions boundary +status code: 403 + +Error: creating IAM Role (): AccessDenied: +User: arn:aws:sts:::assumed-role/Shibboleth-Customer-Admin/ +is not authorized to perform: iam:CreateRole +on resource: arn:aws:iam:::role/ +with an explicit deny in a permissions boundary +status code: 403 +``` -![](images/create-role-terraform.png) +The first error is raised from the EKS module IAM role. The second error is raised from the EKS managed node group submodule IAM role. + +```{image} images/create-role-terraform.png +:alt: Terminal output showing two Terraform AccessDenied errors for iam:CreateRole on EKS cluster and node group roles because of a permissions boundary. +:align: center +``` **Solution:** -When creating EKS cluster using terraform module from terraform registry, you must attach the "Customer_Admin_PermissionBoundary" Permission Boundary as an argument twice. First in the EKS module and second in the EKS Managed node groups submodule. +Pass the `Customer_Admin_PermissionBoundary` permissions boundary twice: once on the EKS module and once on each EKS managed node group. ``` module "eks" { - iam_role_permissions_boundary = "arn:aws:iam::policy/Customer_Admin_PermissionBoundary" + iam_role_permissions_boundary = "arn:aws:iam:::policy/Customer_Admin_PermissionBoundary" -eks_managed_node_groups = { + eks_managed_node_groups = { example = { - iam_role_permissions_boundary = "arn:aws:iam:::policy/Customer_Admin_PermissionBoundary" - + iam_role_permissions_boundary = "arn:aws:iam:::policy/Customer_Admin_PermissionBoundary" } -} + } } ``` ## AccessDenied: not authorized to perform: iam:CreateRole | Resource Block +This error occurs when creating an EKS cluster with an [AWS IAM role Terraform resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role). -Below error occurs when creating **EKS Cluster** using [Terraform resource block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster) from the Terraform registry documentation. - -This error is not an AWS nor Terraform bug. This error is seen when AWS Customers at CU Boulder uses their customer admin IAM role to create an EKS cluster. +This is not an AWS or Terraform bug. It happens when CU Boulder AWS customers use the Customer Admin IAM role to create an EKS cluster without attaching the permissions boundary to the role resource. +**Error message:** -**Error:** +``` +Error: creating IAM Role (eks-cluster-example): AccessDenied: +User: arn:aws:sts:::assumed-role/Shibboleth-Customer-Admin/ +is not authorized to perform: iam:CreateRole +on resource: arn:aws:iam:::role/eks-cluster-example +with an explicit deny in a permissions boundary +status code: 403 + +with aws_iam_role.example, +on eks.tf line 39, in resource "aws_iam_role" "example": + 39: resource "aws_iam_role" "example" { +``` -![](images/create-role-terraform-resource.png) +```{image} images/create-role-terraform-resource.png +:alt: Terminal output showing a Terraform AccessDenied error for iam:CreateRole on an aws_iam_role resource because of a permissions boundary. +:align: center +``` **Solution:** -When creating EKS cluster using terraform resource from terraform registry, you must attach the "Customer_Admin_PermissionBoundary" Permission Boundary as an argument in AWS IAM role +Attach the `Customer_Admin_PermissionBoundary` permissions boundary on the IAM role resource: ``` resource "aws_iam_role" "example" { - - permissions_boundary = "arn:aws:iam:::policy/Customer_Admin_PermissionBoundary" + permissions_boundary = "arn:aws:iam:::policy/Customer_Admin_PermissionBoundary" } ``` \ No newline at end of file diff --git a/docs/cloud/aws/lca1/billing/budget-actions.md b/docs/cloud/aws/lca1/billing/budget-actions.md index ebe915f81..4146e65a5 100644 --- a/docs/cloud/aws/lca1/billing/budget-actions.md +++ b/docs/cloud/aws/lca1/billing/budget-actions.md @@ -1,4 +1,4 @@ -# AWS - Budget Actions +# Budget Actions You can attach budget actions to an alert for either a cost budget or a usage budget. To configure a budget action on a new budget, first follow the steps for [Creating a cost budget](https://docs.aws.amazon.com/cost-management/latest/userguide/create-cost-budget.html) @@ -93,4 +93,4 @@ Once a budget action is taken place, you get alerts based on the chosen notifica ```{image} images/10.png :alt: AWS Budget email notification example - ``` + ``` \ No newline at end of file diff --git a/docs/cloud/aws/lca1/billing/index.md b/docs/cloud/aws/lca1/billing/index.md index 26895d0d0..9f0b81b0d 100644 --- a/docs/cloud/aws/lca1/billing/index.md +++ b/docs/cloud/aws/lca1/billing/index.md @@ -1,4 +1,4 @@ -# AWS - Billing +# Billing AWS provides numerous ways to predict, view, and manage your costs. @@ -12,10 +12,7 @@ Costs can be viewed directly in the [AWS Cost Explorer](./viewbilling). You shou ```{toctree} :maxdepth: 1 -:caption: View Billing - viewbilling - ``` ## Payment @@ -32,8 +29,5 @@ AWS accounts are paid via CU Purchase Order (PO). We will provide guidance on se ```{toctree} :maxdepth: 1 -:caption: Budget Actions - budget-actions - ``` diff --git a/docs/cloud/aws/lca1/billing/viewbilling.md b/docs/cloud/aws/lca1/billing/viewbilling.md index 1d3268b2e..793fc5dc3 100644 --- a/docs/cloud/aws/lca1/billing/viewbilling.md +++ b/docs/cloud/aws/lca1/billing/viewbilling.md @@ -1,4 +1,4 @@ -# AWS - View Billing Data +# View Billing Data ```{note} For all billing periods beginning after 6/30/2025, you should refer directly to [AWS Cost Explorer](https://aws.amazon.com/aws-cost-management/aws-cost-explorer/) and your invoices in the [CU Marketplace](https://www.cu.edu/uis/service-catalog/cu-marketplace). CloudCheckr is no longer used for billing information. @@ -36,17 +36,17 @@ Here's how to use AWS Cost Explorer to represent the charges you will see on an :alt: Search for "Billing and Cost Management" in the AWS console. ``` ```{image} images/cost-explorer-menu.png - :alt: Click on "Cost Explorer" in the menu on the left. + :alt: AWS Billing and Cost Management left menu with Cost Explorer selected. ``` 1. Filter on the billing month. ```{image} images/cost-explorer-billing-month.png - :alt: Filter the date range to July 2025. + :alt: AWS Cost Explorer date range filter set to July 2025. ``` 1. You’ll see the unfiltered cost at the top of the report. **This is NOT what you will be billed!** ```{image} images/cost-explorer-unfiltered.png - :alt: Unfiltered costs are $21,675.23. + :alt: AWS Cost Explorer unfiltered total of 21675.23 dollars. ``` 1. Remove automatically applied refunds by adding the filter `Charge Type → Excludes → Refund, Enterprise Discount Program Discount and Solutions Provider Program Discount ` under `More Filters`. `Enterprise Discount Program Discount` may not be present. @@ -59,12 +59,12 @@ Here's how to use AWS Cost Explorer to represent the charges you will see on an 1. Now you’ll see the raw costs for that billing period. ```{image} images/cost-explorer-raw.png - :alt: Raw costs are $22,669.03. + :alt: AWS Cost Explorer raw cost total of 22669.03 dollars. ``` 1. Add a filter to remove AWS Marketplace costs. Set `Billing Entity → Excludes → AWS Marketplace`. ```{image} images/cost-explorer-exclude-marketplace.png - :alt: Set the Billing entity filter to exclude AWS Marketplace. + :alt: AWS Cost Explorer Billing Entity filter excluding AWS Marketplace. ``` 1. Add a filter to remove S3: Storage - Glacier Deep Archive. Set `Usage type group → Excludes → S3: Storage - Glacier Deep Archive`. @@ -147,5 +147,5 @@ Here's how to use AWS Cost Explorer to represent the charges you will see on an ``` ```{note} -If you have any questions about your bill or need help calculating your costs, please [contact us](mailto:rc-help@colorado.edu). -``` +If you have any questions about your bill or need help calculating your costs, please contact us at [rc-help@colorado.edu](mailto:rc-help@colorado.edu). +``` \ No newline at end of file diff --git a/docs/cloud/aws/lca1/customer-ssp/index.md b/docs/cloud/aws/lca1/customer-ssp/index.md index b4a33e6fe..a493d67d4 100644 --- a/docs/cloud/aws/lca1/customer-ssp/index.md +++ b/docs/cloud/aws/lca1/customer-ssp/index.md @@ -22,16 +22,15 @@ is on the horizon. The rest of this document will discuss how the CFS service can help you meet some of your security requirements. We also have a guide to help you get started on your SSP journey. -## Contents * [Shared Responsibility Model](#shared-responsibility-model) * [CFS **LCA1** Features](#cfs-lca1-features) * [Getting Started](#getting-started) -### Shared Responsibility Model +## Shared Responsibility Model Start with understanding the [Shared Responsibility Model](../getting-started/shared-responsibility-model.md). It is important to know that the cloud provider, our service and you as the cloud customer all share the burden of securing systems. -### CFS **LCA1** Features +## CFS **LCA1** Features The OIT Research Computing [Cloud Foundations Service](https://www.colorado.edu/rc/cloudfoundations) (CFS) team owns and manages an [AWS Landing Zone](https://docs.aws.amazon.com/prescriptive-guidance/latest/migration-aws-environment/understanding-landing-zones.html) specifically designed to enable support of the [NIST SP 800-171 Rev. 2](https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final) @@ -109,10 +108,10 @@ Please contact us at [rc-help@colorado.edu](mailto:rc-help@colorado.edu) to requ Not sure where to start with your cloud journey? RC User Support is here to guide and assist! Reach out to us at [rc-help@colorado.edu](mailto:rc-help@colorado.edu). -### Getting Started +## Getting Started Beginning your SSP can be intimidating, but there are strategies your can take to set yourself up for success and streamline the process. These are the steps we recommend for working through your SSP. -#### Prepare for the SSP +### Prepare for the SSP Before you begin, make sure you have the necessary technical infrastructure and social processes defined to act as a consistent, coordinated team. 1. **Identify a service owner.** Your service needs a single person to be accountable for implementing and operating the service. This person will ensure security work is actually implemented and make the final decision about when to move forward after IT Security review. @@ -168,7 +167,7 @@ Here are some tools you might consider for implementing the systems above. Think * A database * [Airtable](https://www.airtable.com/) ``` -#### Implement the SSP +### Implement the SSP The next step is to stand up your service, creating the necessary security control implementations and documentation. 1. **Get the latest controls.** Reach out to [IT Security](https://oit.colorado.edu/services/it-security) to get the latest official list of required controls. Import this into your SSP tracking system. Confirm which subset of the controls apply to your service (usually based on data classification and service criticality). @@ -176,7 +175,7 @@ The next step is to stand up your service, creating the necessary security contr 3. **Stand up your service.** Get an account on **LCA1**. Reach out to [rc-help@colorado.edu](mailto:rc-help@colorado.edu) so that we can gather basic questionnaire information about your workload. Build out your service on AWS, but _do not put any non-public data in yet._ 4. **Secure your service.** Implement each of the required security controls by appropriately configuring your infrastructure, establishing team processes, and documenting everything. Ensure your documentation provides enough detail an auditor can use for evidence of proper implementation. Consider using references to your configuration management system and screenshots where appropriate. -#### Review the SSP +### Review the SSP Finally, review your SSP implementation with IT Security. After they have reviewed, the service owner can decide if it's appropriate for non-public data to be introduced to the service. 1. **Review.** Request an SSP review from [IT Security](https://oit.colorado.edu/services/it-security). Work with them to fix any gaps in the plan. If there are gaps that can't be addressed, work with IT Security to draft a [Plan of Action and Milestones (POA&M)](https://csrc.nist.gov/glossary/term/POAM) for those items or document the additional risk that gap creates. @@ -185,4 +184,4 @@ Finally, review your SSP implementation with IT Security. After they have review ```{important} A POA&M is essentially a promise to address a security gap in the future. It must have a plan and a **due date**. IT Security should be notified about completed POA&Ms, and they should be updated in your SSP. -``` +``` \ No newline at end of file diff --git a/docs/cloud/aws/lca1/data-classification.md b/docs/cloud/aws/lca1/data-classification.md index 7a9ef03fb..120e1bdfe 100644 --- a/docs/cloud/aws/lca1/data-classification.md +++ b/docs/cloud/aws/lca1/data-classification.md @@ -26,7 +26,7 @@ Externally-regulated data also includes, but is not limited to: contracts with a **No External (regulated) data of any kind is supported on LCA1.** If you need to host regulated data, please contact the [Secure Research Computing team](https://www.colorado.edu/rc/secure-research-computing-resources). They run a separate platform specifically designed to handle highly-secure data. ``` -## AWS LCA1 Data Classification Support +## Data Classification Support The table below outlines the level of support for the different data classifications in the AWS LCA1 landing zone. @@ -47,4 +47,4 @@ The table below outlines the level of support for the different data classificat ```{note} Even for supported data classifications, **the LCA1 platform alone does not satisfy all required security controls** to protect that data. You must implement additional controls within your workload. Please see [Shared Responsibility Model](getting-started/shared-responsibility-model.md) for more information. -``` +``` \ No newline at end of file diff --git a/docs/cloud/aws/lca1/faq/index.md b/docs/cloud/aws/lca1/faq/index.md index 23dd1cb03..fb73a83bb 100644 --- a/docs/cloud/aws/lca1/faq/index.md +++ b/docs/cloud/aws/lca1/faq/index.md @@ -1,6 +1,4 @@ -# AWS - FAQs - -Frequently Asked Questions +# Frequently Asked Questions ## What is the URL for the Single Sign-On Console? **Answer:** diff --git a/docs/cloud/aws/lca1/getting-started/aws-cli-access.md b/docs/cloud/aws/lca1/getting-started/aws-cli-access.md index d82a353ca..ce0453af2 100644 --- a/docs/cloud/aws/lca1/getting-started/aws-cli-access.md +++ b/docs/cloud/aws/lca1/getting-started/aws-cli-access.md @@ -214,4 +214,4 @@ This option is recommended when you want to use multiple shell sessions to acces 6. When done, log out from SSO and all accounts with: ```bash aws sso logout - ``` + ``` \ No newline at end of file diff --git a/docs/cloud/aws/lca1/getting-started/aws-console-access.md b/docs/cloud/aws/lca1/getting-started/aws-console-access.md index 219e59821..69af66e31 100644 --- a/docs/cloud/aws/lca1/getting-started/aws-console-access.md +++ b/docs/cloud/aws/lca1/getting-started/aws-console-access.md @@ -40,4 +40,4 @@ You can access your AWS Account from anywhere with internet access. You do not n ```{image} images/aws-console-access/select-region.png :alt: AWS Console home page with the region selection box circled in red ``` -7. To log out from the AWS console for an account, click on your role name in the upper right corner and choose "Sign out". To log out from the AWS account selection page, click your username in the upper right corner of the access portal and choose "Sign out". +7. To log out from the AWS console for an account, click on your role name in the upper right corner and choose "Sign out". To log out from the AWS account selection page, click your username in the upper right corner of the access portal and choose "Sign out". \ No newline at end of file diff --git a/docs/cloud/aws/lca1/getting-started/aws-restricted-regions.md b/docs/cloud/aws/lca1/getting-started/aws-restricted-regions.md index 57f22fddc..62e1abc25 100644 --- a/docs/cloud/aws/lca1/getting-started/aws-restricted-regions.md +++ b/docs/cloud/aws/lca1/getting-started/aws-restricted-regions.md @@ -1,10 +1,11 @@ # AWS Restricted Regions + Access to AWS Regions is limited to the default regions documented here: [see 'Regions disabled by default' subsection](https://docs.aws.amazon.com/singlesignon/latest/userguide/prereq-choose-region.html). If you are classified as a Confidential or above, you will be restricted to US-Only regions. If your confidential workload requires access to a Non-US region, -submit a request to and we can help evaluate the feasibility. +submit a request to [rc-help@colorado.edu](mailto:rc-help@colorado.edu) and we can help evaluate the feasibility. If you are restricted to US-Only regions, you will see the Non-US regions in the AWS Console to select. However, you will get API errors trying to use any Non-US regions. \ No newline at end of file diff --git a/docs/cloud/aws/lca1/getting-started/customer-permission-boundary.md b/docs/cloud/aws/lca1/getting-started/customer-permission-boundary.md index cb6a9235b..22bd8b22c 100644 --- a/docs/cloud/aws/lca1/getting-started/customer-permission-boundary.md +++ b/docs/cloud/aws/lca1/getting-started/customer-permission-boundary.md @@ -57,4 +57,4 @@ On Step 2 of the "Create role" or "Create user" wizard, search for and add the ` ```{image} images/customer-permission-boundary/permissions-boundary.png :alt: Attaching a permissions boundary to a new role in the AWS console -``` +``` \ No newline at end of file diff --git a/docs/cloud/aws/lca1/getting-started/index.md b/docs/cloud/aws/lca1/getting-started/index.md index a07f7e904..3d604e26b 100644 --- a/docs/cloud/aws/lca1/getting-started/index.md +++ b/docs/cloud/aws/lca1/getting-started/index.md @@ -1,8 +1,7 @@ -# AWS - Getting Started +# Getting Started ```{toctree} :maxdepth: 2 -:caption: Getting Started Documentation shared-responsibility-model aws-console-access diff --git a/docs/cloud/aws/lca1/getting-started/managing-customer-groups.md b/docs/cloud/aws/lca1/getting-started/managing-customer-groups.md index 75ebe0b89..f6ab7c949 100644 --- a/docs/cloud/aws/lca1/getting-started/managing-customer-groups.md +++ b/docs/cloud/aws/lca1/getting-started/managing-customer-groups.md @@ -99,5 +99,4 @@ Refer to [Microsoft's Documentation](https://learn.microsoft.com/en-us/entra/fun ### Removing Users Users can be removed from accessing the AWS account by removing them from the Entra Group. -Refer to [Microsoft's Documentation](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-manage-groups#remove-members-or-owners-of-a-group) to remove members from groups. - +Refer to [Microsoft's Documentation](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-manage-groups#remove-members-or-owners-of-a-group) to remove members from groups. \ No newline at end of file diff --git a/docs/cloud/aws/lca1/getting-started/shared-responsibility-model.md b/docs/cloud/aws/lca1/getting-started/shared-responsibility-model.md index 28ad58dfc..a309bda16 100644 --- a/docs/cloud/aws/lca1/getting-started/shared-responsibility-model.md +++ b/docs/cloud/aws/lca1/getting-started/shared-responsibility-model.md @@ -149,4 +149,4 @@ CFS-managed resources may be identified by one or more of the following: * Naming Prefix: `oit-cld-lza` ``` -If there are any questions about resource ownership, please contact [rc-help@colorado.edu](mailto:rc-help@colorado.edu). +If there are any questions about resource ownership, please contact [rc-help@colorado.edu](mailto:rc-help@colorado.edu). \ No newline at end of file diff --git a/docs/cloud/aws/lca1/incident-response.md b/docs/cloud/aws/lca1/incident-response.md index dea8042ec..b5ffd15a5 100644 --- a/docs/cloud/aws/lca1/incident-response.md +++ b/docs/cloud/aws/lca1/incident-response.md @@ -26,4 +26,4 @@ If Cloud Foundations-supported infrastructure in your AWS account is not behavin ```{note} While we may be able to advise, support is limited for AWS resources not managed by Cloud Foundations. We are not able to assist with issues specific to customer-managed applications. -``` +``` \ No newline at end of file diff --git a/docs/cloud/aws/lca1/index.md b/docs/cloud/aws/lca1/index.md index 11c15fbc6..047ac2340 100644 --- a/docs/cloud/aws/lca1/index.md +++ b/docs/cloud/aws/lca1/index.md @@ -4,56 +4,41 @@ These pages apply to all AWS accounts in the LCA1 landing zone. ```{toctree} :maxdepth: 1 -:caption: Frequently Asked Questions - faq/index ``` ```{toctree} :maxdepth: 1 -:caption: Getting Started Documentation - getting-started/index ``` ```{toctree} :maxdepth: 1 -:caption: Billing Documentation - billing/index ``` ```{toctree} :maxdepth: 2 -:caption: Data Classification - data-classification ``` ```{toctree} :maxdepth: 2 -:caption: Network Information - networking ``` ```{toctree} :maxdepth: 2 -:caption: Incident Response - incident-response ``` ```{toctree} :maxdepth: 2 -:caption: System Security Plan (SSP) Information - customer-ssp/index - ``` diff --git a/docs/cloud/aws/lca1/networking.md b/docs/cloud/aws/lca1/networking.md index 86b3508d0..bdd292122 100644 --- a/docs/cloud/aws/lca1/networking.md +++ b/docs/cloud/aws/lca1/networking.md @@ -90,4 +90,4 @@ Connectivity to CU Boulder networks is through redundant VPN tunnels. These tun ```{note} The Internet network does not route through the VPN tunnel. Customer deployments in the Internet network may require a firewall exception at the campus Border Firewall in order to access some CU Boulder resources. -``` \ No newline at end of file +``` diff --git a/docs/cloud/azure/Microsoft-Azure-for-Academic-Research.md b/docs/cloud/azure/Microsoft-Azure-for-Academic-Research.md index 3018ba0ae..c0701dcaf 100644 --- a/docs/cloud/azure/Microsoft-Azure-for-Academic-Research.md +++ b/docs/cloud/azure/Microsoft-Azure-for-Academic-Research.md @@ -2,9 +2,9 @@ Microsoft Azure provides free credits to qualifying users for research and education purposes. These credits can be used to access the cloud platform’s resources. Apply [here](https://www.microsoft.com/en-us/azure-academic-research/) -## [Academic research](https://www.microsoft.com/en-us/education/higher-education/academic-research) +## Academic research -Researchers can use Microsoft Azure to accelerate their research. Azure provides an open, flexible, global platform that supports multiple programming languages, tools, and frameworks allowing researchers to achieve faster results. Students and Researchers may take advantage of these research credits. [Click to learn more](https://info.microsoft.com/ww-landing-Contact-Microsoft-Education-website.html?lcid=en-us) +Researchers can use Microsoft Azure to accelerate their research. Azure provides an open, flexible, global platform that supports multiple programming languages, tools, and frameworks allowing researchers to achieve faster results. Students and Researchers may take advantage of these research credits. [Click to learn more](https://www.microsoft.com/en-us/education/higher-education/academic-research) Below are a few other Research funding options. @@ -26,8 +26,5 @@ Get $500 in credits per hardware provider and apply for up to $10,000 in credits ## Build in the cloud free with Azure for Students -Use your university or school email to sign up and renew each year you're a student. Start free with $100 credit to use in 12 months. While you have your credit, get free services too. After you use your credit, wait until the 12 months are over and sign up again if you’re still a student. You'll get $100 credit and free services—just like before. If you don't want to wait, move to pay as you go. You'll get 55+ services free always. Only pay if you use more than the free monthly amounts. - -Learn about eligibility [here](https://learn.microsoft.com/en-us/azure/education-hub/azure-dev-tools-teaching/program-faq#azure-for-students) - +Use your university or school email to sign up and renew each year you're a student. Start free with $100 credit to use in 12 months. While you have your credit, get free services too. After you use your credit, wait until the 12 months are over and sign up again if you’re still a student. You'll get $100 credit and free services—just like before. If you don't want to wait, move to pay as you go. You'll get 55+ services free always. Only pay if you use more than the free monthly amounts. Learn about eligibility [here](https://learn.microsoft.com/en-us/azure/education-hub/azure-dev-tools-teaching/program-faq#azure-for-students). For more details click [here](https://azure.microsoft.com/en-us/free/students/) \ No newline at end of file diff --git a/docs/cloud/azure/billing/billing.md b/docs/cloud/azure/billing/billing.md index dcd21b36a..19f20a144 100644 --- a/docs/cloud/azure/billing/billing.md +++ b/docs/cloud/azure/billing/billing.md @@ -1,8 +1,4 @@ -# Azure - Billing - -## Document Purpose - -This document describes the billing process for Azure subscriptions and the steps to be followed when checking the Azure subscription billing. +# Azure Billing ## Billing Process Azure billing is handled using SpeedType numbers. We support the following payment splitting methods: @@ -11,22 +7,96 @@ Azure billing is handled using SpeedType numbers. We support the following payme * Two or more speedtypes pay sequentially, with each paying up to a maximum amount before moving on to the next * Any mixed combination of the above -Speedtypes will be charged during the next FBO bill processing cycle. Please email [rc-help@colorado.edu](mailto:rc-help@colorado.edu) with any billing questions or concerns. -Billing details can be viewed in the emailed invoice and Azure billing portal. +Speedtypes will be charged during the next bill processing cycle. Please email [rc-help@colorado.edu](mailto:rc-help@colorado.edu) with any billing questions or concerns. +Billing details can be viewed in the emailed invoices sent to the designated billing contact or in the Azure billing portal. -## How to Login to Azure - -### Steps to Login +### How to Check your Bill in Azure 1. Navigate to the [Azure Login Portal](https://portal.azure.com/) -2. Enter your CU Credentials +2. Enter your CU Credentials +3. Once you log in, it will take you to your dashboard +4. In the top search bar, search for **Cost Management + Billing**. From the **Services** results, select **Cost Management + Billing**. +
![Azure portal search results for cost management, with Cost Management + Billing listed under Services. Described under Check your Bill in Azure.](images/navigate.png)

+5. In the left navigation, under **Billing**, select **Usage + charges**. This page lists monthly Azure charges, marketplace charges, and total charges. You can change the timespan filter and download charges for an individual month.
+
![Azure portal Usage + charges page with a monthly table of Azure charges, marketplace charges, total charges, and download icons. Described under Check your Bill in Azure.](images/view.png)

+6. For a more detailed breakdown, select **Cost analysis** in the left navigation under **Cost Management**. Use **Scope**, **View**, and the date range to filter costs, then download or share the view if needed. +
![Azure portal Cost analysis page with scope, view, and date range filters. Described under Check your Bill in Azure.](images/analysis.png)

+ +## Network Cost Guide + +There are thre network acess methods available: + +1) Internet Gateway - used with public IP +2) NAT Gateway - used with private or public IP +3) CFS Transit Gateway (VPN) - used with private IP address, VPN connects back to CU Boulder + +### 1. Internet Gateway + +```{Important} +Always check [Microsoft documentation](https://azure.microsoft.com/en-us/pricing/details/bandwidth/) for current pricing. +``` + +**Network costs** + +1) Downloads - no cost + +2) Uploads - first 100GB/month is free, tiered cost per 1GB transferred after + +**Sample Network Cost** + +2 Servers will download 100GB and upload 500GB in a month. + + 1) Download cost = $0 + 2) Upload cost = (100GB = $0) + ($0.087 x 400GB) = $34.80 + + Total Network Cost = $34.80/month + +### 2. NAT Gateway +```{Important} +Always check [Microsoft documentation](https://azure.microsoft.com/en-us/pricing/details/virtual-network/) for current pricing. +``` + +```{Important} +The CFS NAT Gateway will be deployed into subscriptions unless we are told otherwise. If you do not want to be charged for this and you do not require public internet access from your Azure environment, please contact [rc-help@colorado.edu](mailto:rc-help@colorado.edu). +``` + +**Network Costs** +1) Downloads - $0.045/GB +2) Uploads - $0.045/GB +3) NAT Gatway Resource - $0.045/hr +4) Public IP Resource - $0.0036/hr + +**Sample Network Cost** + +2 Servers on the same subnet will download 100GB and upload 500GB in a month. The NAT gateway will be on the entire month. + + 1) Download cost = $0.045 x 100 = $4.50 + 2) Upload cost = $0.045 x 500 = $22.50 + 3) NAT Gateway Instance = $0.045 x (24hr x 30day = 720hr) = $32.40 + 4) Public IP = $0.0036 x (24hr x 30day = 720hr) = $2.60 + + Total Network Cost = $62.00/month + +Creating another NAT Gateway without public internet access would incur the same costs with the exception of the Public IP for: + + Total Network Cost = $59.40/month + +### 3. CFS VNET Peering (VPN) + +```{Important} +Always check [Microsoft documentation](https://azure.microsoft.com/en-us/pricing/details/virtual-network/) for current pricing. +``` + +**Network Costs** +1) Downloads - $0.01/GB +2) Uploads - $0.01/GB + +**Sample Network Cost** + +2 Servers will download 100GB and upload 500GB in a month. The VPC attachment will be on the entire month. + + 1) Download cost = $0.01 x 100 = $1 + 2) Upload cost = $0.01 x 500 = $5 -## How to Check your Bill in Azure + Total Network Cost = $6/month -1. When you log into the Azure Portal as instructed in the above section. It will directly navigate to your dashboard. -2. In the top search bar, search for "Cost Management + Billing"
-
![](images/navigate.png)

-3. Click on the Usage + charges
-
![](images/view.png)

-4. For more details click on "Cost Analysis" -
![](images/analysis.png)

diff --git a/docs/cloud/azure/billing/cost-est.md b/docs/cloud/azure/billing/cost-est.md deleted file mode 100644 index 216e2c81a..000000000 --- a/docs/cloud/azure/billing/cost-est.md +++ /dev/null @@ -1,82 +0,0 @@ -# Azure - Network Cost Guide - -## Document Purpose - -This document gives some sample cost estimates for select network access methods and provides the URL's to find current pricing. - -## Network access methods - -1) Internet Gateway - used with public IP -2) NAT Gateway - used with private or public IP -3) CFS Transit Gateway (VPN) - used with private IP address, VPN connects back to CU Boulder - -### Internet Gateway - -```{Important} -Always check [Microsoft documentation](https://azure.microsoft.com/en-us/pricing/details/bandwidth/) for current pricing. -``` - -**Network costs** - -1) Downloads - no cost - -2) Uploads - first 100GB/month is free, tiered cost per 1GB transferred after - -**Sample Network Cost** - -2 Servers will download 100GB and upload 500GB in a month. - - 1) Download cost = $0 - 2) Upload cost = (100GB = $0) + ($0.087 x 400GB) = $34.80 - - Total Network Cost = $34.80/month - -### NAT Gateway -```{Important} -Always check [Microsoft documentation](https://azure.microsoft.com/en-us/pricing/details/virtual-network/) for current pricing. -``` - -```{Important} -The CFS NAT Gateway will be deployed into subscriptions unless we are told otherwise. If you do not want to be charged for this and you do not require public internet access from your Azure environment, please contact rc-help@colorado.edu. -``` - -**Network Costs** -1) Downloads - $0.045/GB -2) Uploads - $0.045/GB -3) NAT Gatway Resource - $0.045/hr -4) Public IP Resource - $0.0036/hr - -**Sample Network Cost** - -2 Servers on the same subnet will download 100GB and upload 500GB in a month. The NAT gateway will be on the entire month. - - 1) Download cost = $0.045 x 100 = $4.50 - 2) Upload cost = $0.045 x 500 = $22.50 - 3) NAT Gateway Instance = $0.045 x (24hr x 30day = 720hr) = $32.40 - 4) Public IP = $0.0036 x (24hr x 30day = 720hr) = $2.60 - - Total Network Cost = $62.00/month - -Creating another NAT Gateway without public internet access would incur the same costs with the exception of the Public IP for: - - Total Network Cost = $59.40/month - -### CFS VNET Peering (VPN) - -```{Important} -Always check [Microsoft documentation](https://azure.microsoft.com/en-us/pricing/details/virtual-network/) for current pricing. -``` - -**Network Costs** -1) Downloads - $0.01/GB -2) Uploads - $0.01/GB - -**Sample Network Cost** - -2 Servers will download 100GB and upload 500GB in a month. The VPC attachment will be on the entire month. - - 1) Download cost = $0.01 x 100 = $1 - 2) Upload cost = $0.01 x 500 = $5 - - Total Network Cost = $6/month - diff --git a/docs/cloud/azure/billing/index.md b/docs/cloud/azure/billing/index.md deleted file mode 100644 index b07360f16..000000000 --- a/docs/cloud/azure/billing/index.md +++ /dev/null @@ -1,19 +0,0 @@ - -# Azure - Billing - - -```{toctree} -:maxdepth: 1 -:caption: View Billing - -billing - -``` - -```{toctree} -:maxdepth: 1 -:caption: Network Cost Guide - -cost-est - -``` \ No newline at end of file diff --git a/docs/cloud/azure/budget-actions/budget-actions.md b/docs/cloud/azure/budget-actions/budget-actions.md index 95d32b3ad..6086b4712 100644 --- a/docs/cloud/azure/budget-actions/budget-actions.md +++ b/docs/cloud/azure/budget-actions/budget-actions.md @@ -1,4 +1,4 @@ -# Configuring Azure budget action +# Budget Actions Cost control is a critical component to maximizing the value of your investment in the cloud. To configure a Budget and Budget actions in Azure, you'll complete the following actions by using the steps provided in each section. This document specifically outlines an example of how to setup a budget action to shutdown virtual machine when it meets the configured alert condition. @@ -13,126 +13,147 @@ These actions included in this tutorial allow you to: 1. Sign in to the [Azure Management Console](https://portal.azure.com/#home) and search for **Automation accounts** on the top search bar. Click **Create** and choose the subscription that you intent to manage, A Resource Group to place the Automation account, Name and Region to host Automation account. -![](images/1.png) +![Azure portal Create an Automation Account Basics tab with Subscription, Resource group, Automation account name, and Region fields.](images/1.png) 2. Leave all other parameters to default. You may optionally choose to configure **Tags** as per your compliance standards. Click **Review+Create** and then click on **Create**. -![](images/2.png) +![Azure portal Review + Create tab showing a Validation passed banner and a summary of Automation account settings.](images/2.png) -![](images/3.png) +After the deployment finishes, open the new Automation account. The Overview page shows resource details such as resource group, location, subscription, and status. + +![Azure portal Overview page for a newly created Automation account showing Essentials details and job statistics.](images/3.png) 3. Once you are in your Automation Account, Click on **Runbooks** and click on **Browse Gallery** from the top pane. -![](images/4.png) +![Azure Automation Runbooks page with Create a runbook, Import a runbook, and Browse gallery buttons.](images/4.png) 4. Search for **Stop Azure V2 VMs** from the search bar. Make sure to choose **source** as **Github**. Click on Stop Azure V2 VMs graphical runbook. -![](images/5.png) +![Azure Automation Browse Gallery search results for Stop Azure V2 VMs, showing a Graphical Runbook and a PowerShell Runbook.](images/5.png) 5. Review the graphical flow to understand how this runbook will excute to stop all VMs at subscription or resource group level and then click on **Select** at the bottom. -![](images/6.png) +![Azure Automation import page for the Stop Azure V2 VMs graphical runbook, including a flowchart of Connect AzAccount, Get VMs, Merge VMs, Stop VM, and notification steps.](images/6.png) + +6. Name the runbook (for example, `Stop-VMs`) and select **Import**. -6. **Name** the Runbook and click **Import**. In **Edit graphical runbook** pane, Click on **Publish** and choose **Yes** +![Azure portal Import a runbook form with a runbook name field and an Import button.](images/7.png) -![](images/7.png) +7. In the **Edit graphical runbook** pane, select **Publish**, then confirm by selecting **Yes**. -![](images/8.png) +![Azure portal Edit graphical runbook pane with a Publish button in the toolbar.](images/8.png) -![](images/9.png) +![Azure portal confirmation dialog asking whether to publish the runbook, with Yes and No buttons.](images/9.png) ## Add VM Contributor Role Assignment 1. To check access level of the Automation account that you created, go to **Subscription** using top search bar and click on your subscription name. Then click on **Access control (IAM)** >> choose **check access** from top pane >> click on **check access** -![](images/9.1.png) +![Azure portal Access control (IAM) Check access tab for a subscription, with View my access, Check access, and Add role assignment buttons.](images/9.1.png) 2. Choose **Managed Identity** and choose your **subscription**. Under 'Managed Indentity' choose **Automation Accounts** and select your automation account. This will show you manually or auto assigned Role assignments for this automation account (if any). -![](images/9.2.png) +![Azure portal Check access pane with Managed Identity selected and filters for subscription and Automation Accounts.](images/9.2.png) -![](images/9.3.png) +![Azure portal role assignments list for the selected Automation account managed identity.](images/9.3.png) 3. In case you don't see any Role assignments, Click on **Add** in **Access Control (IAM)** blade of your subscription and choose **Add role assignment**. In **Role** >> **Job function roles** >> search for **virtual machine contributor** and click on it. Then click **Next** to assign this role to our automation account. -![](images/9.4.png) +![Azure portal Add role assignment page with the Role tab selected.](images/9.4.png) -![](images/9.5.png) +![Azure portal Job function roles list with Virtual Machine Contributor selected.](images/9.5.png) 4. Choose **Managed Identity** radio button, click on **select members** to select your automation account. Once your clicked on **select**, click on **Review+Assign**. -![](images/9.6.png) +![Azure portal Add role assignment Members tab with Managed identity selected and a Select members button.](images/9.6.png) ## Create Budget and Action Group -1. To create budgets, choose **Budgets** in your subscription +1. Open your subscription and, under **Cost Management**, select **Budgets**. Select **Add** to create a new budget. -![](images/10.png) +![Azure portal Budgets page for a subscription, with an Add button and an empty budgets table.](images/10.png) -2. Name, choose **reset period** (I chose monthly). You may consider to leave **creation and expiration dates** as is and finally enter Total Budget **amount** and click **next**. +2. Enter a budget name and choose a **Reset period** (this example uses monthly). You can leave the creation and expiration dates at their defaults. Enter the total budget **Amount**, then select **Next**. -![](images/11.png) +![Azure portal Create a budget form with name, reset period, date range, and amount fields.](images/11.png) 3. In **Set alerts** tab, click on **Manage action group**. Click **Create** to create a new action group. -![](images/12.png) +![Azure portal Set alerts tab with a Manage action group link.](images/12.png) + +![Azure portal Action groups page with a Create button for a new action group.](images/13.png) + +4. On the **Basics** tab, choose the subscription and resource group, set **Region** to **Global**, and enter an action group name and a display name (the display name is limited to 12 characters). Select **Next: Notifications**. + +![Azure portal Create action group Basics tab with subscription, resource group, region, action group name, and display name fields.](images/14.png) + +5. Under **Notification type**, select **Email/SMS message/Push/Voice**, choose the notification method you want (this example uses email), enter the recipient address, then select **OK**. Name the notification, then select **Next: Actions**. + +![Azure portal Create action group Notifications tab with Email, SMS, Push, and Voice notification options.](images/15.png) -![](images/13.png) +![Azure portal Notifications tab after an email notification has been named.](images/16.png) -4. Enter necessary details in **Basics** tab as per below screenshot and click **Next:Notifications**. Choose **Email/SMS/Push/Voice** and choose the option convenient for you (I choose email in this example) and click **OK**. Finally Name the Notification and click on **Next:Actions**. +6. Under **Actions**, set **Action type** to **Automation Runbook**. Configure the runbook as follows: -![](images/14.png) + - **Run runbook:** Enabled + - **Runbook source:** User + - **Subscription:** the subscription you are managing + - **Automation account:** the Automation account you created + - **Runbook:** the imported Stop VMs runbook -![](images/15.png) + Select **Configure parameters**. **Subscription** is the only required parameter. Leave resource group blank to apply the action at subscription scope, or enter a resource group name to limit the action to that group. Select **OK** as needed, name the action, then select **Review + create** and **Create**. -![](images/16.png) -5. Under **Actions** choose **Automation Runbook** as **Action type**. Choose relevant options as per screenshot below and finally click on **Configure Parameters**. You may choose to **Resourcegroupname** if you want to enforce budget actions at RG level. **Subscription** is the only mandatory parameter, hence in this example I am enforcing budget actions at Subscription level. Click **OK** multiple times and finally name the Action. Click on **Review+create** and then **Create** +![Azure portal Create action group Actions tab with Automation Runbook selected and a Configure Runbook pane listing subscription, Automation account, and runbook.](images/17.png) -![](images/17.png) +![Azure portal Configure parameters form for the Automation runbook webhook.](images/18.png) -![](images/18.png) +![Azure portal runbook parameters with Subscription filled in as the required field.](images/19.png) -![](images/19.png) +![Azure portal Actions tab with the Automation Runbook action named.](images/20.png) -![](images/20.png) +![Azure portal Create action group Review + create tab summarizing basics, notifications, and actions.](images/21.png) -![](images/21.png) +7. Once you are back on **Action Groups** page, give it 10-20 seconds for the new Action group to show up. Click on **Refresh** if needed. Once you see your Action group, carefully click on Red **X** at the top right corner, only Once, to come back to **Create Budget** pane. -6. Once you are back on **Action Groups** page, give it 10-20 seconds for the new Action group to show up. Click on **Refresh** if needed. Once you see your Action group, carefully click on Red **X** at the top right corner, only Once, to come back to **Create Budget** pane. +![Azure portal Action groups list showing the newly created action group, with a close control in the upper-right corner.](images/24.png) -![](images/24.png) +8. After the action group is created, Azure sends a confirmation email to the notification recipient. The message is from `azure-noreply@microsoft.com` and states that the recipient has been added to the action group. It includes the resource group name and action group name. -7. When action group is created you'll receive an email notification like below +```{note} +Add `azure-noreply@microsoft.com` to your email allow list so budget and action-group messages are not delivered to spam. +``` -![](images/22.png) +![Email from Microsoft Azure stating the recipient has been added to an Azure Monitor action group, including resource group and action group names.](images/22.png) -8. On **Create Budget** pane, configure **alert conditions** as needed, I chose to not perform any action for 80% and enforce budget action when my budget hits 100% utilization, in this example. Make sure to select the action group which you have created in previous step. Click **Create** in the bottom, once you have filled all relevant fields as per below screenshot. In the next section, we will test this action group if it really works. +9. On **Create Budget** pane, configure **alert conditions** as needed, I chose to not perform any action for 80% and enforce budget action when my budget hits 100% utilization, in this example. Make sure to select the action group which you have created in previous step. Click **Create** in the bottom, once you have filled all relevant fields as per below screenshot. In the next section, we will test this action group if it really works. -![](images/25.png) +![Azure portal Create budget Set alerts tab with 80 percent and 100 percent actual-spend thresholds and an action group selected at 100 percent.](images/25.png) ## Test Azure Monitor Action Group -Don't test this if you have any production VMs running which you do not intend to stop. Create a new Resource Group with a couple of test VMs to test this. Make sure your webhook in Automation Runbook is set to take action at Resoruce Group level. +```{warning} +Testing an action group that is configured to stop VMs will stop those VMs. Use a test resource group, and make sure the runbook webhook is scoped to that resource group if you do not want subscription-wide impact. +``` -1. The Action Group that we created be found under **Monitor** >> **Alerts** >> **Action Groups** on the top pane. Use the top search bar to find Azure Monitor service. +1. Search for **Monitor** in the top search bar. Open **Monitor**, select **Alerts**, then select **Action groups** in the toolbar. -![](images/26.png) +![Azure Monitor Alerts page with the Action groups option selected in the toolbar.](images/26.png) -2. In the **Actions Groups** Pane select the checkbox right next to the action group you've created and click on **Test action group** from the top. +2. In the Action groups list, select the checkbox next to the action group you created, then select **Test action group**. -![](images/27.png) +![Azure portal Action groups list with one action group selected and a Test action group button.](images/27.png) -3. Leave the default selection of notification and action test. Choose **Cost Budget alert** from the drop down for **sample type**. This will send a test email to ensure email notification is working and will test if the webhook fires up to stop VMs from the Subscription/Resource group (based on your webhook configuration) +3. Leave the default notification and action tests selected. For **Select sample type**, choose **Cost budget alert**. This sends a test email and fires the webhook to stop VMs in the configured subscription or resource group. -![](images/28.png) +![Azure portal Test action group pane with Cost budget alert selected as the sample type.](images/28.png) -4. Once the test completes, you will either see a success or a failure error status on the screen. You may navigate to VM service to view if you notice your virtual machines are in disallocated state. +4. When the test finishes, the portal shows a success or failure status. Open **Virtual machines** to confirm that the test VMs are in a deallocated state. -![](images/29.png) +![Azure portal test result showing whether the action group notification and action tests succeeded or failed.](images/29.png) -5. You would receive an email like this if your email notification test succeeds. +5. If the email notification test succeeds, you receive a message confirming that a test alert was sent for the action group. -![](images/30.png) +![Email from Microsoft Azure confirming a successful test of an Azure Monitor action group notification.](images/30.png) diff --git a/docs/cloud/azure/faq/faq.md b/docs/cloud/azure/faq.md similarity index 89% rename from docs/cloud/azure/faq/faq.md rename to docs/cloud/azure/faq.md index 5e2096bbd..0fa969a12 100644 --- a/docs/cloud/azure/faq/faq.md +++ b/docs/cloud/azure/faq.md @@ -1,6 +1,4 @@ -# Azure - FAQs - -Frequently Asked Questions +# Frequently Asked Questions ## What is the URL for the Single Sign-On Console? **Answer:** @@ -15,4 +13,4 @@ Please email [rc-help@colorado.edu](mailto:rc-help@colorado.edu) for any billing ## How do I close my Azure subscription? **Answer:** -Send an email to [rc-help@colorado.edu](mailto:rc-help@colorado.edu) and provide the subscription number or account alias for the Azure Account you wish to close. +Send an email to [rc-help@colorado.edu](mailto:rc-help@colorado.edu) and provide the subscription number or account alias for the Azure Account you wish to close. \ No newline at end of file diff --git a/docs/cloud/azure/index.md b/docs/cloud/azure/index.md index 7d2bee8f5..164603188 100644 --- a/docs/cloud/azure/index.md +++ b/docs/cloud/azure/index.md @@ -1,39 +1,41 @@ -# Azure +# Microsoft Azure +Microsoft Azure is a commercial cloud platform supported by CU Research Computing. To use a CU-managed Azure account, you must be affiliated with the University of Colorado Boulder as a student, faculty member, or staff member. -Microsoft Azure Documentation +CU Research Computing provides support for billing Azure usage against CU funds, as well as high-level guidance on using Azure services. Account holders are responsible for managing their own applications, data, and use of Azure services. -For users who are using a **Research Computing Cloud Team** managed Azure account. +Once your account has been provisioned, sign in to the Azure portal at [https://portal.azure.com](https://portal.azure.com) with your CU IdentiKey and Microsoft multi-factor authentication (MFA). + +If you are looking to get a new Azure subscription or have questions about an existing subscription, email [rc-help@colorado.edu](mailto:rc-help@colorado.edu). + + +## What should I read next? ```{toctree} :maxdepth: 1 -:caption: Frequently Asked Questions -faq/faq +faq ``` ```{toctree} :maxdepth: 1 -:caption: Billing Documentation -billing/index +billing/billing ``` ```{toctree} :maxdepth: 1 -:caption: Research Credits -Microsoft-Azure-for-Academic-Research +budget-actions/budget-actions ``` ```{toctree} :maxdepth: 1 -:caption: Budget Actions -budget-actions/budget-actions +Microsoft-Azure-for-Academic-Research ``` \ No newline at end of file diff --git a/docs/cloud/gcp/Google-Cloud-research-credits.md b/docs/cloud/gcp/Google-Cloud-research-credits.md index ed78d3969..e6c4327e7 100644 --- a/docs/cloud/gcp/Google-Cloud-research-credits.md +++ b/docs/cloud/gcp/Google-Cloud-research-credits.md @@ -1,9 +1,10 @@ -# Apply for Google Cloud research credits +# Google Cloud research credits Google Cloud research credits can advance your research by giving you access to computing power that will make the next big thing possible. Learn more about Google's [programs for researchers](https://cloud.google.com/edu/researchers?hl=en). -## [Kickstart Your Research With Google Cloud Credits](https://services.google.com/fh/files/emails/kickstart_your_research_with_google_cloud_credits_tips_on_applying.pdf) -## [Program overview](https://support.google.com/google-cloud-higher-ed/answer/10723679?hl=en&ref_topic=10322294&sjid=6709602353601652929-NC) +* [Program overview](https://support.google.com/google-cloud-higher-ed/answer/10723679?hl=en&ref_topic=10322294&sjid=6709602353601652929-NC) +* [Kickstart Your Research With Google Cloud Credits](https://services.google.com/fh/files/emails/kickstart_your_research_with_google_cloud_credits_tips_on_applying.pdf) + ## Academic Research Grants @@ -12,44 +13,44 @@ Eligibility for research grants is limited to faculty, PhD students and postdoct ## Application guidelines ### How do I apply to the GCP research credits program? - +**Answer:** Academic researchers can apply using Google's [online application form](https://edu.google.com/programs/credits/research/?modal_active=none). ### Is there a deadline to apply? - +**Answer:** Google accepts applications on an ongoing basis. ### What information do I need to submit before I apply? - +**Answer:** You will need to submit a research proposal outlining how you plan to use Google Cloud credits. You will also need to submit an estimate on expected costs using GCP pricing calculator. Finally, please make sure that you create a Google Cloud billing account before you apply to the program. For more information, check out [this video](https://cloudonair.withgoogle.com/events/virtual_faculty_summit_2020/watch?talk=track1_session8_kickstart_your_research_with_gc_credits). ### How long will it take for my application to be reviewed and approved? - +**Answer:** In general, Google reviews and make decisions on applications within 4-6 weeks. You may be contacted by GCP team to discuss your application further if necessary. Please indicate any urgent requests or timelines within your application proposal. ### Can multiple individuals from the same research proposal apply? - +**Answer:** Only one person per research proposal may apply. ### Can graduate students or PhDs conducting research apply? - +**Answer:** PhD students conducting research may apply for $1000 in GCP Credit per year. Students on a Masters degree program are not eligible for research credits. ### Can I apply for more credits for the same project? - +**Answer:** No, if you are a faculty member or postdoctoral researcher you are only eligible to apply one time to the research credits program. ### Can I apply for GCP credits multiple times? - +**Answer:** PhD students may apply once a year for credits of up to $1,000 USD. Faculty and Postdoctoral researchers are eligible for one award of up to $5,000 USD. ### Can I receive another research credits award for referring other researchers? - +**Answer:** Google's referral program allows you to receive additional credits for referring other faculty researchers to the research credits program. If you refer two qualified applicants to GCP's program then you can qualify for a new research grant. If this sounds like a path to pursue, please have your referrals apply to Google's program and share their university email addresses with us after you’ve confirmed with them that they’ve applied (with their matching university email address). Please note that credits are awarded at Google’s discretion and not all applications may be supported. ### Who should I contact if I have any questions? - +**Answer:** For any additional questions, please contact . Please check your spam folder and [enable](https://support.google.com/mail/answer/1366858?co=GENIE.Platform%3DDesktop&hl=en) access from Google's email alias through your email settings if you do not receive a confirmation email for your application within 24 hours (i.e. unmark email address from spam list). This ensures all notifications and program updates are communicated to each applicant. diff --git a/docs/cloud/gcp/index.md b/docs/cloud/gcp/index.md index f62796f7e..7ce06e422 100644 --- a/docs/cloud/gcp/index.md +++ b/docs/cloud/gcp/index.md @@ -1,14 +1,13 @@ -# GCP +# Google Cloud Platform -Google Cloud Platform (GCP) Documentation +Google Cloud Platform (GCP) is a commercial cloud service supported by CU Research Computing (CURC) in collaboration with CU Anschutz. CURC can provision GCP accounts for University of Colorado affiliates. Account holders will manage their own applications, data, and use of GCP services. Billing for GCP services is done via SpeedTypes. If you are looking to get a new GCP account or have questions about an existing account, email [rc-help@colorado.edu](mailto:rc-help@colorado.edu) -For users who are using a **Research Computing Cloud Team** managed GCP account. +## What should I read next? ```{toctree} :maxdepth: 1 -:caption: Research Credits Google-Cloud-research-credits -``` \ No newline at end of file +``` From 3e8c84d8dbb4e06a7bbccb27a9bb9df182ea78bf Mon Sep 17 00:00:00 2001 From: mohalkh5 Date: Thu, 17 Sep 2026 08:49:45 -0600 Subject: [PATCH 2/3] azure pages update --- .../Microsoft-Azure-for-Academic-Research.md | 15 ++-- docs/cloud/azure/billing/billing.md | 8 +- .../azure/budget-actions/budget-actions.md | 78 +++++++++---------- docs/cloud/azure/faq.md | 2 +- 4 files changed, 51 insertions(+), 52 deletions(-) diff --git a/docs/cloud/azure/Microsoft-Azure-for-Academic-Research.md b/docs/cloud/azure/Microsoft-Azure-for-Academic-Research.md index c0701dcaf..ae94e145f 100644 --- a/docs/cloud/azure/Microsoft-Azure-for-Academic-Research.md +++ b/docs/cloud/azure/Microsoft-Azure-for-Academic-Research.md @@ -1,30 +1,29 @@ # Microsoft Azure for Academic Research -Microsoft Azure provides free credits to qualifying users for research and education purposes. These credits can be used to access the cloud platform’s resources. Apply [here](https://www.microsoft.com/en-us/azure-academic-research/) +Microsoft Azure provides free credits to qualifying users for research and education purposes. These credits can be used to access the cloud platform’s resources. Apply through the [Microsoft Azure for Academic Research application](https://www.microsoft.com/en-us/azure-academic-research/). ## Academic research -Researchers can use Microsoft Azure to accelerate their research. Azure provides an open, flexible, global platform that supports multiple programming languages, tools, and frameworks allowing researchers to achieve faster results. Students and Researchers may take advantage of these research credits. [Click to learn more](https://www.microsoft.com/en-us/education/higher-education/academic-research) +Researchers can use Microsoft Azure to accelerate their research. Azure provides an open, flexible, global platform that supports multiple programming languages, tools, and frameworks allowing researchers to achieve faster results. Students and Researchers may take advantage of these research credits. For additional information, see the [Microsoft Azure academic research program](https://www.microsoft.com/en-us/education/higher-education/academic-research). Below are a few other Research funding options. ## NIH STRIDES initiative -NIH-funded researchers can access special discounts on Microsoft Azure services to accelerate their research. [Learn More](https://www.microsoft.com/en-us/microsoftstrides/) +NIH-funded researchers can access special discounts on Microsoft Azure services to accelerate their research. See [Microsoft STRIDES initiative](https://www.microsoft.com/en-us/microsoftstrides/) for more details. ## National Science Foundation (NSF) CloudBank -CloudBank provides access to Microsoft Azure for computer science research and education. [Learn More](https://www.cloudbank.org/) +CloudBank provides access to Microsoft Azure for computer science research and education. Visit the [NSF CloudBank program](https://www.cloudbank.org/) for additional information. ## Microsoft Research fellowships -Microsoft Research offers fellowships and collaborative research opportunities across a variety of disciplines. [Explore Opportunities](https://www.microsoft.com/en-us/research/academic-programs/) +Microsoft Research offers fellowships and collaborative research opportunities across a variety of disciplines. Explore the [Microsoft Research academic programs](https://www.microsoft.com/en-us/research/academic-programs/) for available opportunities. ## Receive Azure Quantum credits -Get $500 in credits per hardware provider and apply for up to $10,000 in credits for quantum research projects. [Read the program terms](https://quantum.microsoft.com/en-us/terms-of-use#azure-quantum-credit-program-terms-of-use) and then submit your application. Apply [here](https://microsoft.qualtrics.com/jfe/form/SV_3fl9dfFrkC3g0aG?aq_source=acom) +Get $500 in credits per hardware provider and apply for up to $10,000 in credits for quantum research projects. Review the [Azure Quantum credit program terms of use](https://quantum.microsoft.com/en-us/terms-of-use#azure-quantum-credit-program-terms-of-use) before submitting your application. Submit an [Azure Quantum credit](https://microsoft.qualtrics.com/jfe/form/SV_3fl9dfFrkC3g0aG?aq_source=acom) application. ## Build in the cloud free with Azure for Students -Use your university or school email to sign up and renew each year you're a student. Start free with $100 credit to use in 12 months. While you have your credit, get free services too. After you use your credit, wait until the 12 months are over and sign up again if you’re still a student. You'll get $100 credit and free services—just like before. If you don't want to wait, move to pay as you go. You'll get 55+ services free always. Only pay if you use more than the free monthly amounts. Learn about eligibility [here](https://learn.microsoft.com/en-us/azure/education-hub/azure-dev-tools-teaching/program-faq#azure-for-students). -For more details click [here](https://azure.microsoft.com/en-us/free/students/) \ No newline at end of file +Use your university or school email to sign up and renew each year you're a student. Start free with $100 credit to use in 12 months. While you have your credit, get free services too. After you use your credit, wait until the 12 months are over and sign up again if you’re still a student. You'll get $100 credit and free services—just like before. If you don't want to wait, move to pay as you go. You'll get 55+ services free always. Only pay if you use more than the free monthly amounts. Learn about eligibility through the [Azure for Students program FAQ](https://learn.microsoft.com/en-us/azure/education-hub/azure-dev-tools-teaching/program-faq#azure-for-students). For additional information, visit the [Microsoft Azure for Students program](https://azure.microsoft.com/en-us/free/students/). \ No newline at end of file diff --git a/docs/cloud/azure/billing/billing.md b/docs/cloud/azure/billing/billing.md index 19f20a144..5ab081d8d 100644 --- a/docs/cloud/azure/billing/billing.md +++ b/docs/cloud/azure/billing/billing.md @@ -16,15 +16,15 @@ Billing details can be viewed in the emailed invoices sent to the designated bil 2. Enter your CU Credentials 3. Once you log in, it will take you to your dashboard 4. In the top search bar, search for **Cost Management + Billing**. From the **Services** results, select **Cost Management + Billing**. -
![Azure portal search results for cost management, with Cost Management + Billing listed under Services. Described under Check your Bill in Azure.](images/navigate.png)

+
![Azure portal search results for cost management, with Cost Management + Billing listed under Services. Described under Check your Bill in Azure. Described under How to Check your Bill in Azure.](images/navigate.png)

5. In the left navigation, under **Billing**, select **Usage + charges**. This page lists monthly Azure charges, marketplace charges, and total charges. You can change the timespan filter and download charges for an individual month.
-
![Azure portal Usage + charges page with a monthly table of Azure charges, marketplace charges, total charges, and download icons. Described under Check your Bill in Azure.](images/view.png)

+
![Azure portal Usage + charges page with a monthly table of Azure charges, marketplace charges, total charges, and download icons. Described under Check your Bill in Azure. Described under How to Check your Bill in Azure.](images/view.png)

6. For a more detailed breakdown, select **Cost analysis** in the left navigation under **Cost Management**. Use **Scope**, **View**, and the date range to filter costs, then download or share the view if needed. -
![Azure portal Cost analysis page with scope, view, and date range filters. Described under Check your Bill in Azure.](images/analysis.png)

+
![Azure portal Cost analysis page with scope, view, and date range filters. Described under Check your Bill in Azure. Described under How to Check your Bill in Azure.](images/analysis.png)

## Network Cost Guide -There are thre network acess methods available: +There are three network acess methods available: 1) Internet Gateway - used with public IP 2) NAT Gateway - used with private or public IP diff --git a/docs/cloud/azure/budget-actions/budget-actions.md b/docs/cloud/azure/budget-actions/budget-actions.md index 6086b4712..6fe0abf2c 100644 --- a/docs/cloud/azure/budget-actions/budget-actions.md +++ b/docs/cloud/azure/budget-actions/budget-actions.md @@ -4,96 +4,96 @@ Cost control is a critical component to maximizing the value of your investment These actions included in this tutorial allow you to: - 1. Create an Azure Automation Account, Import relevant Runbook, which will use webhooks to stop VMs. - 2. If needed, Add role assignment to provide relevant access to the Automation account to perform operations on virtual machines. - 3. If haven't already,Create the budget with the wanted thresholds and wire it to the action group. - 4. Azure Monitor Action Group will be configured to trigger the Webhook when the budget threshold is met. This behaviour can be tested using 'Test action group'. + 1. Create an Azure Automation Account and import relevant Runbook, which will use webhooks to stop VMs. + 2. If needed, add role assignment to provide relevant access to the Automation account to perform operations on virtual machines. + 3. If haven't already, create the budget with the wanted thresholds and wire it to the action group. + 4. Azure Monitor Action Group will be configured to trigger the webhook when the budget threshold is met. This behaviour can be tested using 'Test action group'. ## Creating Azure Automation Account 1. Sign in to the [Azure Management Console](https://portal.azure.com/#home) and search for **Automation accounts** on the top search bar. Click **Create** and choose the subscription that you intent to manage, A Resource Group to place the Automation account, Name and Region to host Automation account. -![Azure portal Create an Automation Account Basics tab with Subscription, Resource group, Automation account name, and Region fields.](images/1.png) +![Azure portal Create an Automation Account Basics tab with Subscription, Resource group, Automation account name, and Region fields. Described under Creating Azure Automation Account.](images/1.png) 2. Leave all other parameters to default. You may optionally choose to configure **Tags** as per your compliance standards. Click **Review+Create** and then click on **Create**. -![Azure portal Review + Create tab showing a Validation passed banner and a summary of Automation account settings.](images/2.png) +![Azure portal Review + Create tab showing a Validation passed banner and a summary of Automation account settings. Described under Creating Azure Automation Account.](images/2.png) After the deployment finishes, open the new Automation account. The Overview page shows resource details such as resource group, location, subscription, and status. -![Azure portal Overview page for a newly created Automation account showing Essentials details and job statistics.](images/3.png) +![Azure portal Overview page for a newly created Automation account showing Essentials details and job statistics. Described under Creating Azure Automation Account.](images/3.png) 3. Once you are in your Automation Account, Click on **Runbooks** and click on **Browse Gallery** from the top pane. -![Azure Automation Runbooks page with Create a runbook, Import a runbook, and Browse gallery buttons.](images/4.png) +![Azure Automation Runbooks page with Create a runbook, Import a runbook, and Browse gallery buttons. Described under Creating Azure Automation Account.](images/4.png) 4. Search for **Stop Azure V2 VMs** from the search bar. Make sure to choose **source** as **Github**. Click on Stop Azure V2 VMs graphical runbook. -![Azure Automation Browse Gallery search results for Stop Azure V2 VMs, showing a Graphical Runbook and a PowerShell Runbook.](images/5.png) +![Azure Automation Browse Gallery search results for Stop Azure V2 VMs, showing a Graphical Runbook and a PowerShell Runbook. Described under Creating Azure Automation Account.](images/5.png) 5. Review the graphical flow to understand how this runbook will excute to stop all VMs at subscription or resource group level and then click on **Select** at the bottom. -![Azure Automation import page for the Stop Azure V2 VMs graphical runbook, including a flowchart of Connect AzAccount, Get VMs, Merge VMs, Stop VM, and notification steps.](images/6.png) +![Azure Automation import page for the Stop Azure V2 VMs graphical runbook, including a flowchart of Connect AzAccount, Get VMs, Merge VMs, Stop VM, and notification steps. Described under Creating Azure Automation Account.](images/6.png) 6. Name the runbook (for example, `Stop-VMs`) and select **Import**. -![Azure portal Import a runbook form with a runbook name field and an Import button.](images/7.png) +![Azure portal Import a runbook form with a runbook name field and an Import button. Described under Creating Azure Automation Account.](images/7.png) 7. In the **Edit graphical runbook** pane, select **Publish**, then confirm by selecting **Yes**. -![Azure portal Edit graphical runbook pane with a Publish button in the toolbar.](images/8.png) +![Azure portal Edit graphical runbook pane with a Publish button in the toolbar. Described under Creating Azure Automation Account.](images/8.png) -![Azure portal confirmation dialog asking whether to publish the runbook, with Yes and No buttons.](images/9.png) +![Azure portal confirmation dialog asking whether to publish the runbook, with Yes and No buttons. Described under Creating Azure Automation Account.](images/9.png) ## Add VM Contributor Role Assignment 1. To check access level of the Automation account that you created, go to **Subscription** using top search bar and click on your subscription name. Then click on **Access control (IAM)** >> choose **check access** from top pane >> click on **check access** -![Azure portal Access control (IAM) Check access tab for a subscription, with View my access, Check access, and Add role assignment buttons.](images/9.1.png) +![Azure portal Access control (IAM) Check access tab for a subscription, with View my access, Check access, and Add role assignment buttons. Described under Add VM Contributor Role Assignment.](images/9.1.png) 2. Choose **Managed Identity** and choose your **subscription**. Under 'Managed Indentity' choose **Automation Accounts** and select your automation account. This will show you manually or auto assigned Role assignments for this automation account (if any). -![Azure portal Check access pane with Managed Identity selected and filters for subscription and Automation Accounts.](images/9.2.png) +![Azure portal Check access pane with Managed Identity selected and filters for subscription and Automation Accounts. Described under Add VM Contributor Role Assignment.](images/9.2.png) -![Azure portal role assignments list for the selected Automation account managed identity.](images/9.3.png) +![Azure portal role assignments list for the selected Automation account managed identity. Described under Add VM Contributor Role Assignment.](images/9.3.png) 3. In case you don't see any Role assignments, Click on **Add** in **Access Control (IAM)** blade of your subscription and choose **Add role assignment**. In **Role** >> **Job function roles** >> search for **virtual machine contributor** and click on it. Then click **Next** to assign this role to our automation account. -![Azure portal Add role assignment page with the Role tab selected.](images/9.4.png) +![Azure portal Add role assignment page with the Role tab selected. Described under Add VM Contributor Role Assignment.](images/9.4.png) -![Azure portal Job function roles list with Virtual Machine Contributor selected.](images/9.5.png) +![Azure portal Job function roles list with Virtual Machine Contributor selected. Described under Add VM Contributor Role Assignment.](images/9.5.png) 4. Choose **Managed Identity** radio button, click on **select members** to select your automation account. Once your clicked on **select**, click on **Review+Assign**. -![Azure portal Add role assignment Members tab with Managed identity selected and a Select members button.](images/9.6.png) +![Azure portal Add role assignment Members tab with Managed identity selected and a Select members button. Described under Add VM Contributor Role Assignment.](images/9.6.png) ## Create Budget and Action Group 1. Open your subscription and, under **Cost Management**, select **Budgets**. Select **Add** to create a new budget. -![Azure portal Budgets page for a subscription, with an Add button and an empty budgets table.](images/10.png) +![Azure portal Budgets page for a subscription, with an Add button and an empty budgets table. Described under Create Budget and Action Group.](images/10.png) 2. Enter a budget name and choose a **Reset period** (this example uses monthly). You can leave the creation and expiration dates at their defaults. Enter the total budget **Amount**, then select **Next**. -![Azure portal Create a budget form with name, reset period, date range, and amount fields.](images/11.png) +![Azure portal Create a budget form with name, reset period, date range, and amount fields. Described under Create Budget and Action Group.](images/11.png) 3. In **Set alerts** tab, click on **Manage action group**. Click **Create** to create a new action group. -![Azure portal Set alerts tab with a Manage action group link.](images/12.png) +![Azure portal Set alerts tab with a Manage action group link. Described under Create Budget and Action Group.](images/12.png) -![Azure portal Action groups page with a Create button for a new action group.](images/13.png) +![Azure portal Action groups page with a Create button for a new action group. Described under Create Budget and Action Group.](images/13.png) 4. On the **Basics** tab, choose the subscription and resource group, set **Region** to **Global**, and enter an action group name and a display name (the display name is limited to 12 characters). Select **Next: Notifications**. -![Azure portal Create action group Basics tab with subscription, resource group, region, action group name, and display name fields.](images/14.png) +![Azure portal Create action group Basics tab with subscription, resource group, region, action group name, and display name fields. Described under Create Budget and Action Group.](images/14.png) 5. Under **Notification type**, select **Email/SMS message/Push/Voice**, choose the notification method you want (this example uses email), enter the recipient address, then select **OK**. Name the notification, then select **Next: Actions**. -![Azure portal Create action group Notifications tab with Email, SMS, Push, and Voice notification options.](images/15.png) +![Azure portal Create action group Notifications tab with Email, SMS, Push, and Voice notification options. Described under Create Budget and Action Group.](images/15.png) -![Azure portal Notifications tab after an email notification has been named.](images/16.png) +![Azure portal Notifications tab after an email notification has been named. Described under Create Budget and Action Group.](images/16.png) 6. Under **Actions**, set **Action type** to **Automation Runbook**. Configure the runbook as follows: @@ -106,19 +106,19 @@ In **Role** >> **Job function roles** >> search for **virtual machine contributo Select **Configure parameters**. **Subscription** is the only required parameter. Leave resource group blank to apply the action at subscription scope, or enter a resource group name to limit the action to that group. Select **OK** as needed, name the action, then select **Review + create** and **Create**. -![Azure portal Create action group Actions tab with Automation Runbook selected and a Configure Runbook pane listing subscription, Automation account, and runbook.](images/17.png) +![Azure portal Create action group Actions tab with Automation Runbook selected and a Configure Runbook pane listing subscription, Automation account, and runbook. Described under Create Budget and Action Group.](images/17.png) -![Azure portal Configure parameters form for the Automation runbook webhook.](images/18.png) +![Azure portal Configure parameters form for the Automation runbook webhook. Described under Create Budget and Action Group.](images/18.png) -![Azure portal runbook parameters with Subscription filled in as the required field.](images/19.png) +![Azure portal runbook parameters with Subscription filled in as the required field. Described under Create Budget and Action Group.](images/19.png) -![Azure portal Actions tab with the Automation Runbook action named.](images/20.png) +![Azure portal Actions tab with the Automation Runbook action named. Described under Create Budget and Action Group.](images/20.png) -![Azure portal Create action group Review + create tab summarizing basics, notifications, and actions.](images/21.png) +![Azure portal Create action group Review + create tab summarizing basics, notifications, and actions. Described under Create Budget and Action Group.](images/21.png) 7. Once you are back on **Action Groups** page, give it 10-20 seconds for the new Action group to show up. Click on **Refresh** if needed. Once you see your Action group, carefully click on Red **X** at the top right corner, only Once, to come back to **Create Budget** pane. -![Azure portal Action groups list showing the newly created action group, with a close control in the upper-right corner.](images/24.png) +![Azure portal Action groups list showing the newly created action group, with a close control in the upper-right corner. Described under Create Budget and Action Group.](images/24.png) 8. After the action group is created, Azure sends a confirmation email to the notification recipient. The message is from `azure-noreply@microsoft.com` and states that the recipient has been added to the action group. It includes the resource group name and action group name. @@ -126,11 +126,11 @@ In **Role** >> **Job function roles** >> search for **virtual machine contributo Add `azure-noreply@microsoft.com` to your email allow list so budget and action-group messages are not delivered to spam. ``` -![Email from Microsoft Azure stating the recipient has been added to an Azure Monitor action group, including resource group and action group names.](images/22.png) +![Email from Microsoft Azure stating the recipient has been added to an Azure Monitor action group, including resource group and action group names. Described under Create Budget and Action Group.](images/22.png) 9. On **Create Budget** pane, configure **alert conditions** as needed, I chose to not perform any action for 80% and enforce budget action when my budget hits 100% utilization, in this example. Make sure to select the action group which you have created in previous step. Click **Create** in the bottom, once you have filled all relevant fields as per below screenshot. In the next section, we will test this action group if it really works. -![Azure portal Create budget Set alerts tab with 80 percent and 100 percent actual-spend thresholds and an action group selected at 100 percent.](images/25.png) +![Azure portal Create budget Set alerts tab with 80 percent and 100 percent actual-spend thresholds and an action group selected at 100 percent. Described under Create Budget and Action Group.](images/25.png) ## Test Azure Monitor Action Group @@ -140,20 +140,20 @@ Testing an action group that is configured to stop VMs will stop those VMs. Use 1. Search for **Monitor** in the top search bar. Open **Monitor**, select **Alerts**, then select **Action groups** in the toolbar. -![Azure Monitor Alerts page with the Action groups option selected in the toolbar.](images/26.png) +![Azure Monitor Alerts page with the Action groups option selected in the toolbar. Described under Test Azure Monitor Action Group.](images/26.png) 2. In the Action groups list, select the checkbox next to the action group you created, then select **Test action group**. -![Azure portal Action groups list with one action group selected and a Test action group button.](images/27.png) +![Azure portal Action groups list with one action group selected and a Test action group button. Described under Test Azure Monitor Action Group.](images/27.png) 3. Leave the default notification and action tests selected. For **Select sample type**, choose **Cost budget alert**. This sends a test email and fires the webhook to stop VMs in the configured subscription or resource group. -![Azure portal Test action group pane with Cost budget alert selected as the sample type.](images/28.png) +![Azure portal Test action group pane with Cost budget alert selected as the sample type. Described under Test Azure Monitor Action Group.](images/28.png) 4. When the test finishes, the portal shows a success or failure status. Open **Virtual machines** to confirm that the test VMs are in a deallocated state. -![Azure portal test result showing whether the action group notification and action tests succeeded or failed.](images/29.png) +![Azure portal test result showing whether the action group notification and action tests succeeded or failed. Described under Test Azure Monitor Action Group.](images/29.png) 5. If the email notification test succeeds, you receive a message confirming that a test alert was sent for the action group. -![Email from Microsoft Azure confirming a successful test of an Azure Monitor action group notification.](images/30.png) +![Email from Microsoft Azure confirming a successful test of an Azure Monitor action group notification. Described under Test Azure Monitor Action Group.](images/30.png) diff --git a/docs/cloud/azure/faq.md b/docs/cloud/azure/faq.md index 0fa969a12..8a2909cb9 100644 --- a/docs/cloud/azure/faq.md +++ b/docs/cloud/azure/faq.md @@ -2,7 +2,7 @@ ## What is the URL for the Single Sign-On Console? **Answer:** -Login using your [CU IdentiKey](https://oit.colorado.edu/services/identity-access-management/identikey) here: [http://portal.azure.com](http://portal.azure.com). +Sign in to the Azure portal at [https://portal.azure.com](https://portal.azure.com) using your [CU IdentiKey](https://oit.colorado.edu/services/identity-access-management/identikey). ## What region has the lowest latency from CU Campus? **Answer:** From 1f5860af50c4ad30f7c9ccd47c9562c1d98f7340 Mon Sep 17 00:00:00 2001 From: mohalkh5 Date: Thu, 17 Sep 2026 09:02:47 -0600 Subject: [PATCH 3/3] gcp section updates --- docs/cloud/azure/index.md | 11 ---- .../gcp/Google-Cloud-research-credits.md | 56 ------------------ docs/cloud/gcp/index.md | 59 +++++++++++++++++-- 3 files changed, 53 insertions(+), 73 deletions(-) delete mode 100644 docs/cloud/gcp/Google-Cloud-research-credits.md diff --git a/docs/cloud/azure/index.md b/docs/cloud/azure/index.md index 164603188..c694e3073 100644 --- a/docs/cloud/azure/index.md +++ b/docs/cloud/azure/index.md @@ -14,28 +14,17 @@ If you are looking to get a new Azure subscription or have questions about an ex ```{toctree} :maxdepth: 1 - faq - ``` - ```{toctree} :maxdepth: 1 - billing/billing - ``` - ```{toctree} :maxdepth: 1 - budget-actions/budget-actions - ``` - ```{toctree} :maxdepth: 1 - Microsoft-Azure-for-Academic-Research - ``` \ No newline at end of file diff --git a/docs/cloud/gcp/Google-Cloud-research-credits.md b/docs/cloud/gcp/Google-Cloud-research-credits.md deleted file mode 100644 index e6c4327e7..000000000 --- a/docs/cloud/gcp/Google-Cloud-research-credits.md +++ /dev/null @@ -1,56 +0,0 @@ -# Google Cloud research credits - -Google Cloud research credits can advance your research by giving you access to computing power that will make the next big thing possible. Learn more about Google's [programs for researchers](https://cloud.google.com/edu/researchers?hl=en). - -* [Program overview](https://support.google.com/google-cloud-higher-ed/answer/10723679?hl=en&ref_topic=10322294&sjid=6709602353601652929-NC) -* [Kickstart Your Research With Google Cloud Credits](https://services.google.com/fh/files/emails/kickstart_your_research_with_google_cloud_credits_tips_on_applying.pdf) - - -## Academic Research Grants - -Eligibility for research grants is limited to faculty, PhD students and postdoctoral researchers from accredited higher education institutions and eligible nonprofit research institutions in approved countries. - -## Application guidelines - -### How do I apply to the GCP research credits program? -**Answer:** -Academic researchers can apply using Google's [online application form](https://edu.google.com/programs/credits/research/?modal_active=none). - -### Is there a deadline to apply? -**Answer:** -Google accepts applications on an ongoing basis. - -### What information do I need to submit before I apply? -**Answer:** -You will need to submit a research proposal outlining how you plan to use Google Cloud credits. You will also need to submit an estimate on expected costs using GCP pricing calculator. Finally, please make sure that you create a Google Cloud billing account before you apply to the program. For more information, check out [this video](https://cloudonair.withgoogle.com/events/virtual_faculty_summit_2020/watch?talk=track1_session8_kickstart_your_research_with_gc_credits). - - -### How long will it take for my application to be reviewed and approved? -**Answer:** -In general, Google reviews and make decisions on applications within 4-6 weeks. You may be contacted by GCP team to discuss your application further if necessary. Please indicate any urgent requests or timelines within your application proposal. - -### Can multiple individuals from the same research proposal apply? -**Answer:** -Only one person per research proposal may apply. - -### Can graduate students or PhDs conducting research apply? -**Answer:** -PhD students conducting research may apply for $1000 in GCP Credit per year. Students on a Masters degree program are not eligible for research credits. - -### Can I apply for more credits for the same project? -**Answer:** -No, if you are a faculty member or postdoctoral researcher you are only eligible to apply one time to the research credits program. - -### Can I apply for GCP credits multiple times? -**Answer:** -PhD students may apply once a year for credits of up to $1,000 USD. Faculty and Postdoctoral researchers are eligible for one award of up to $5,000 USD. - -### Can I receive another research credits award for referring other researchers? -**Answer:** -Google's referral program allows you to receive additional credits for referring other faculty researchers to the research credits program. If you refer two qualified applicants to GCP's program then you can qualify for a new research grant. If this sounds like a path to pursue, please have your referrals apply to Google's program and share their university email addresses with us after you’ve confirmed with them that they’ve applied (with their matching university email address). - -Please note that credits are awarded at Google’s discretion and not all applications may be supported. - -### Who should I contact if I have any questions? -**Answer:** -For any additional questions, please contact . Please check your spam folder and [enable](https://support.google.com/mail/answer/1366858?co=GENIE.Platform%3DDesktop&hl=en) access from Google's email alias through your email settings if you do not receive a confirmation email for your application within 24 hours (i.e. unmark email address from spam list). This ensures all notifications and program updates are communicated to each applicant. diff --git a/docs/cloud/gcp/index.md b/docs/cloud/gcp/index.md index 7ce06e422..d77de7675 100644 --- a/docs/cloud/gcp/index.md +++ b/docs/cloud/gcp/index.md @@ -1,13 +1,60 @@ - # Google Cloud Platform Google Cloud Platform (GCP) is a commercial cloud service supported by CU Research Computing (CURC) in collaboration with CU Anschutz. CURC can provision GCP accounts for University of Colorado affiliates. Account holders will manage their own applications, data, and use of GCP services. Billing for GCP services is done via SpeedTypes. If you are looking to get a new GCP account or have questions about an existing account, email [rc-help@colorado.edu](mailto:rc-help@colorado.edu) -## What should I read next? +# Google Cloud research credits + +Google Cloud research credits can advance your research by giving you access to computing power that will make the next big thing possible. Learn more about Google's [programs for researchers](https://cloud.google.com/edu/researchers?hl=en). + +* [Google Cloud research credits program overview](https://support.google.com/google-cloud-higher-ed/answer/10723679?hl=en&ref_topic=10322294&sjid=6709602353601652929-NC) +* [Kickstart Your Research With Google Cloud Credits](https://services.google.com/fh/files/emails/kickstart_your_research_with_google_cloud_credits_tips_on_applying.pdf) + + +## Academic Research Grants + +Eligibility for research grants is limited to faculty, PhD students and postdoctoral researchers from accredited higher education institutions and eligible nonprofit research institutions in approved countries. + +## Application guidelines + +### How do I apply to the GCP research credits program? +**Answer:** +Academic researchers can apply using Google's [GCP research credits online application form](https://edu.google.com/programs/credits/research/?modal_active=none). + +### Is there a deadline to apply? +**Answer:** +Google accepts applications on an ongoing basis. + +### What information do I need to submit before I apply? +**Answer:** +You will need to submit a research proposal outlining how you plan to use Google Cloud credits. You will also need to submit an estimate on expected costs using GCP pricing calculator. Finally, please make sure that you create a Google Cloud billing account before you apply to the program. For more information, check out [Google Cloud research credits application guidance video](https://cloudonair.withgoogle.com/events/virtual_faculty_summit_2020/watch?talk=track1_session8_kickstart_your_research_with_gc_credits). + + +### How long will it take for my application to be reviewed and approved? +**Answer:** +In general, Google reviews and make decisions on applications within 4-6 weeks. You may be contacted by GCP team to discuss your application further if necessary. Please indicate any urgent requests or timelines within your application proposal. + +### Can multiple individuals from the same research proposal apply? +**Answer:** +Only one person per research proposal may apply. -```{toctree} -:maxdepth: 1 +### Can graduate students or PhDs conducting research apply? +**Answer:** +PhD students conducting research may apply for $1000 in GCP Credit per year. Students on a Masters degree program are not eligible for research credits. + +### Can I apply for more credits for the same project? +**Answer:** +No, if you are a faculty member or postdoctoral researcher you are only eligible to apply one time to the research credits program. + +### Can I apply for GCP credits multiple times? +**Answer:** +PhD students may apply once a year for credits of up to $1,000 USD. Faculty and Postdoctoral researchers are eligible for one award of up to $5,000 USD. + +### Can I receive another research credits award for referring other researchers? +**Answer:** +Google's referral program allows you to receive additional credits for referring other faculty researchers to the research credits program. If you refer two qualified applicants to GCP's program then you can qualify for a new research grant. If this sounds like a path to pursue, please have your referrals apply to Google's program and share their university email addresses with us after you’ve confirmed with them that they’ve applied (with their matching university email address). -Google-Cloud-research-credits +Please note that credits are awarded at Google’s discretion and not all applications may be supported. -``` +### Who should I contact if I have any questions? +**Answer:** +For any additional questions, please contact . Please check your spam folder and [follow Google's instructions for managing email spam settings](https://support.google.com/mail/answer/1366858?co=GENIE.Platform%3DDesktop&hl=en) if you do not receive a confirmation email for your application within 24 hours. This includes removing the email address from your spam list if necessary. This ensures that all notifications and program updates are communicated to each applicant. \ No newline at end of file