Uptime funk: Microsoft has lifted availability of Azure Key Vault to 99.99%
- Reference: 1621418471
- News link: https://www.theregister.co.uk/2021/05/19/azure_key_vault/
- Source link:
The previous level had been backed by a 99.9 per cent Service Level Agreement (SLA) and the company claimed that extra 9 represented it "taking the next step in our commitment to the resilience and availability" of the service.
[2]Azure Key Vault is a rather important service for those that have bought into Microsoft's cloud vision. All manner of secret stuff can be stashed in it, such as API keys, passwords, certificates or cryptographic keys.
[3]
[4]
[5]
As such, an outage has the potential to be on the catastrophic side. But hey, at least [6]there's that SLA , right?
Of course there is, but we'd strongly recommend taking a very close look at SLAs (both of Microsoft and its rivals) when making strategic decisions.
Word SLA-ad
In the case of the Azure Key Vault SLA, Microsoft "guarantees" that a Key Vault transaction will be processed within 5 seconds 99.99 per cent of the time. The company also works out its uptime on a monthly basis. A downtime minute is counted where continuous attempts to perform a valid transaction during the minute result in either a wait longer than five seconds or an error code.
The calculation of that uptime percentage is then relatively simple: "Monthly Uptime % = (Maximum Available Minutes - Downtime) / Maximum Available Minutes"
By our reckoning, that equates to around 4.5 minutes of outage in a given 31 day month for the 99.99 per cent SLA.
[7]
What you actually get back from Microsoft (and its rivals) should the SLA be tripped is worthy of inspection, however. In the case of Azure Key Vault, there's 10 per cent service credit on offer if things dip below 99.9 per cent (at time of writing) and 25 per cent if it gets worse and goes below 99 per cent.
However, the potential cost to the business is likely considerably more than 10 per cent of the service fees when things fall over. And that's only if you claim. Despite Microsoft rarely hesitating to trumpet its analytic smarts, it is up to you as the user to file a claim when things go south.
So, while adding that extra 9 is always nice, we'd advise always checking the SLA carefully since it may not afford quite the protection you're expecting; a bit of extra redundancy might cost less than some surprise downtime. [8]And public clouds do tend to totter at the most inconvenient of times . ®
Get our [9]Tech Resources
[1] https://azure.microsoft.com/en-us/updates/9999-uptime-for-azure-key-vault/
[2] https://docs.microsoft.com/en-us/azure/key-vault/general/basic-concepts
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YKU2HOT8WQlz7@X3lFZZnAAAAI0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YKU2HOT8WQlz7@X3lFZZnAAAAI0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YKU2HOT8WQlz7@X3lFZZnAAAAI0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://azure.microsoft.com/en-au/support/legal/sla/key-vault/v1_0/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YKU2HOT8WQlz7@X3lFZZnAAAAI0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/04/01/microsoft_azure_dns_outage/
[9] https://whitepapers.theregister.com/
AKV is a little pricey and slow. Something on the order of 0.2p per 1000 reads and 10ms per read, I think.
The result of that is that it's often worthwhile to cache values you get from AKV (and possibly periodically re-fetch them in the background).
If you're caching the data from AKV for a while, it's pretty plausible that you might not ever notice five minute drops.
This, even if you did a rolling restart of your cluster during a 5 minute downtime period, the first new pod wouldn't startup properly, and everything will just wait until it is ready.
And nothing at all like ..
... Office 365 360 350 etc.
hmm
I call the time crimz had access to 0365 as downtime, so I disagree with MS self evaluation.
Hourly vs monthly
Be careful when trying to compare SLAs between providers as it’s not always as easy as it appears.
Microsoft calculates uptime on a monthly basis vs AWS,for example, that calculates it on an hourly basis. So what looks like a better SLA in Azure is actually worse. Those pesky marketing people at Microsoft don’t miss a trick.
I store my API keys and letters to Mum on GitHub!
"And public clouds do tend to totter at the most inconvenient of times"
That is the most quintessentially British euphemism for "unreliable" I have ever seen.
Well done !