حوكمة البنية التحتية
في هذه الصفحة 9 موضوعات
نص الدروس والتمارين باللغة الإنجليزية، بينما تبقى واجهة الموقع وعناوين الدروس بالعربية.
نظرة عامة
الموضوعات
- مناطق الهبوط (Landing Zones)
- السياسات
- الوسم (Tagging)
- البنية التحتية ككود (Infrastructure as Code)
تعلّم أولًا
3 ساعة تدريب (تقدير)
مخرجات التعلم
- Design a landing zone: account/subscription hierarchy, baseline networking, logging, and security services.
- Enforce guardrails with policies (preventive and detective).
- Define tagging standards for ownership, cost, and data classification.
- Require infrastructure as code with review for all environments.
الدروس
المختبر والتمارين
Lab
ARC-020-LAB1 · Larkspur landing zone
Outcomes: 1–4 · Time: ~3 h (one provider; verify service names before recording)
- Design the account/subscription hierarchy.
- Define baseline networking, central logging, and security services.
- Write guardrail policies, marking each preventive or detective.
- Define the tagging standard and its enforcement.
- Define the IaC workflow with review and policy checks.
- Walk through a non-compliant resource being blocked or detected.
Acceptance: a non-compliant resource is blocked or detected in a walkthrough.
Exercises (case-based; six exercises)
| ID | Outcome | Task |
|---|---|---|
| ARC-020-EX01 | 1 | Explain to a delivery manager why the landing zone is built before the first workload. |
| ARC-020-EX02 | 1 | Draw a hierarchy for Larkspur with five groups and state which policy applies at each level. |
| ARC-020-EX03 | 2 | Write six guardrails and classify them as preventive or detective. |
| ARC-020-EX04 | 3 | Define the mandatory tag set and how each tag is enforced. |
| ARC-020-EX05 | 4 | Describe the IaC workflow for a networking change in prod. |
| ARC-020-EX06 | 4 | A team requests console access to fix prod quickly. Write the policy response with an exception path. |
أظهر الحلول
- EX01 Guardrails retrofitted onto live workloads cost more and carry risk; teams start faster in a prepared structure; inconsistent setups multiply security and cost problems.
- EX02 Root; Security (log archive, tooling); Shared network; Workloads with Prod and Non-prod; Sandbox with budget limits. Policies: region and logging at root; production strictness at Prod; spending limit at Sandbox.
- EX03 Preventive: deny unapproved regions, deny public data stores, require encryption, block disabling of logging. Detective: untagged resources, drift from IaC, overly broad roles.
- EX04 Owner, cost center, environment, application, data classification; require at creation by policy or pipeline check, detect missing tags with weekly report and owner follow-up.
- EX05 Pull request, peer review, static policy checks, plan output reviewed, approval, pipeline apply with a deploy role, drift check afterwards.
- EX06 Default is no write access; fixes go through the pipeline with an expedited review path; break-glass role with logging, approval, and expiry; follow-up to codify the fix.
Workplace evidence: a landing zone or guardrail set you designed.
Outcome coverage: all outcomes covered by exercises and the lab.
الاختبار
Outcomes: O1 landing zone · O2 guardrails · O3 tagging · O4 infrastructure as code.
اختبار ذاتي لك: لا توجد درجات، ولا يُحفظ أو يُرسل أي شيء. اختر إجابة ثم تحقق منها، ويمكنك المحاولة مرة أخرى كما تشاء.
الجزء العملي
Landing zone review of the ARC-020-LAB1 design and walkthrough plus exercises ARC-020-EX01 to EX06. Pass: quiz at least 8/10, at least five of six exercises correct, and a non-compliant resource blocked or detected in the walkthrough.
أخطاء شائعة
Guardrails added after workloads are live; tags without enforcement.
التقييم
Landing zone review.
دليل من بيئة العمل
A landing zone or guardrail set you designed.
الصلة بالمسار الوظيفي
Cost architecture (ARC-021) and compliance (ARC-029).