Architecture
Two on-premises Ubuntu servers (simulated locally with Multipass) onboard to Azure Arc, then get governed by free Azure services. Everything below the control plane is reproduced from infrastructure as code.
LOCAL HOST · APPLE SILICON
Multipass — 2 × Ubuntu 22.04 LTS (arm64)
vm-01
Azure Connected Machine agent
tagged env=lab
vm-02
Azure Connected Machine agent
untagged (demo)
AZURE
Arc control plane
inventory · RBAC · tags
Free
Azure Policy ×3
tag · region · AMA
Free
Update Manager
patch assessment + schedule
Free
Log Analytics
minimal DCR (≤5 GB/mo)
Free
OPTIONAL · AZURE VM (B1ls)
Hybrid networking (M9) — ~$2/month, deallocated when idle.
Responsibility boundary
Each tool owns a single, non-overlapping concern.
Terraform
Azure-side resources — resource group, tags, policies, workspace, DCR.
onboard-linux.sh
Runs azcmagent connect inside each VM.
Lynis
Open-source OS security audit — replaces paid Machine Configuration.
Ansible (ansible-lockdown)
CIS hardening enforcement — hardening index 59 → 71.