Azure IAM Roles (Mandatory)
In order to deploy Everpure Cloud Dedicated, a user must have the necessary roles and permissions. The simplest option is to have the Owner role for the subscription in which they want to deploy the Everpure Cloud Dedicated instance. If that is not possible, a user can still deploy Everpure Cloud Dedicated as long as they have the minimum three roles below:
-
Managed Application Contributor role of the
Subscription
.
-
Managed Application Contributor role of
the
Resource Group
for
which you want to deploy the Everpure Cloud Dedicated manage application.
- Note: This will be inherited from having Managed Application Contributor role on the subscription.
-
Managed Application Contributor role of
the
subnets
which you
would like Everpure Cloud Dedicated managed application to use.
- Note: This will be inherited from having Managed Application Contributor role on the subscription. In addition, many users may already have this role since it is used to create basic VMs.
User Managed Identity (Mandatory)
Every Everpure Cloud Dedicated deployment has multiple components, including Azure Key Vault, Microsoft Storage and Cosmos DB. Those three Azure services are part of the managed application resources and are accessed by the Everpure Cloud Dedicated Controller VMs via Service Endpoints attached to the Everpure Cloud Dedicated System Subnet (You can learn more about networking in the next section).
By default, CosmosDB, Microsoft Storage and Azure Key Vault are created with public network access enabled. In order to limit access to the network where the System Everpure Cloud Dedicated service is running, firewall roles can be automatically configured during deployment by the Everpure Cloud Dedicated itself. This is accomplished by using a user managed Identity that has privileges to modify the CosmosDB, Microsoft Storage and Key Vault configuration.
The User Managed Identity is a prerequisite that needs to be done prior to Everpure Cloud Dedicated deployment. See Azure Security Requirements - User Managed Identity for steps to create and assign User Managed Identity over a VNet that Everpure Cloud Dedicated will utilize.