A New Approach to Back-End Cloud Governance

Who’s doing what in your cloud? That’s a question that has been difficult to answer. 

Cloud administrators have long had control over front-end governance of the cloud – that is, who comes in the front door. You can control who has access by roles, responsibilities, and assets. 

Once someone is already inside your house, however, it has been difficult to assess what they’re doing. Are they stepping out of bounds? What resources are they updating? Why were a bunch of resources suddenly updated or deleted? Figuring out what happened used to mean auditing what access permissions were given in the beginning. 

Earlier this year, Azure added functionality to its Azure Resource Graph (ARG) tool that allows you to track how resources are created, changed, and deleted on your cloud. Previously, admins could see only what resources were present in your Azure cloud. Now, admins can see who initiated changes, and with which client a change was made, across all tenants and all subscriptions.

The new feature is called Change Actor Functionality. Specifically, you can see:

• Who made the change  
• With which client the change was made  
• What operation was called  

Using Change Actor Functionality, you can audit, troubleshoot, and govern at scale. By using Azure Resource Graph to query your resource changes, you can craft charts and pin results to Azure dashboards based on specific change queries.

This new functionality also improves the reporting available for FinOps Dashboards. Monitoring cloud operational costs by cost center, service type, application, or other tags provides insights into the budgetary control of your cloud practice. The Change Actor Functionality supplements cost data by showing which users directly affect those resources, as well as the state of the resources. For instance, now you can tell if a resource was added, updated, or removed and by whom for each cost center, service type, or application – AND the cost implications of that action. 

At CoStrategix, we are building audit reports and notifications to align the user permissions we created with users’ actions being taken. We can supplement existing data cloud reports with back-end cloud governance reports for project managers and technical managers, detailing how individual projects within an Azure tenant are functioning.