ECSA Epic on Azure Knowledge Transfer (CloudTest CTEAST)

Key Stakeholders

The following Optum and Accenture team members were identified as key stakeholders for ECSA-related knowledge transfer:

The following items were identified as requiring Knowledge Transfer to transition the in-scope environments to the Optum ECSA team for ongoing support:

Server Names and Corresponding Epic Groups

1. East Non-Prod VMs: CloudTestEastVMs.xlsx
2. Kuiper URL: https://epiccloudtestkuiper.uhc.com/Kuiper
3. System Pulse URL: https://epiccloudtestsystempulse.uhc.com/SystemPulse
4. Storefront: Citrix Workspace

Confirm Server Access & Required Tools

• Ensure access to Hashicorp Vault: https://vault.uhg.com
• Namespaces: Aide-0085665 (West), Aide-0085666 (East)
• Used for static secrets:
  • Local admin passwords
  • MSNONPROD service accounts – kv/service_accounts/msnonprod-epic-svc-accounts
• Epic infrastructure is ONLY in msnonprod.dsnonprod.uhc.com domain
• EMP, Fixed Key, ESMP, Kuiper, and System Pulse keys/configuration accounts remain the same
• Ensure access to Cyberark: https://cyberark.optum.com/PasswordVault/v10/logon
  • View and copy service account passwords
  • Domain-based secrets
  • Epic service accounts (filter on CloudTest location): Epic on Azure Service Accounts.xlsx
• Ensure access to Cloud SAW
• VMWare Horizon
  • Preferred way to RDP into CloudTest Azure VMs
  • Ensure elevated credentials are in the AD group
  • GPO is applied to Epic on Azure Windows VMs to allow admin access to this AD group
  • Check https://adlookup.optum.com to ensure access has been granted

Azure Access

• Ensure login and access to VM details in the portal: https://portal.azure.com
• Process for “Contributor” access in Azure is currently unknown – Placeholder follow-up (Optum Cloud Operations, Indhu and Jeff, 4/22 jm)
• Use Azure Bastion for console-level access to VMs if unreachable via RDP

CloudTest Access

• Request both primary and secondary accounts for MSNONPROD domain from Charles Fuller
• Log into Cloud SAW
• RDP to remote machine FQDN using MSNONPROD user account
• Ensure access to Kuiper and System Pulse VIPs and authentication
  • Contact Jonathan Saucier if access issues arise
  • In future, this step will be owned by Optum’s operations

List of Deliverables

• Quick Reference Guide: Optum_Epic on Azure Infrastructure - Quick Reference Guide.xlsx
• Low-level Design Document: Low-Level_Design_v1.0.docx
• Deployment Plans: Deployment Plan
• Epic IP Address Allocation: EPIC IP Address Allocation-100%CDO.xlsx
• Network Architecture Diagram: Optum - Network Diagrams Draft v2.6-updated2.vsdx

Architecture & Business Continuity (DR Considerations)

• Applicable for Production only; not applicable for non-prod.

Server Configuration Details

• Refer to the Bill of Materials used to request the deployed infrastructure.

Application Configuration Details

• Applicable for Production only; not applicable for non-prod.

Monitoring

• System Pulse can be configured to match on-prem Alert Definitions.
• Alerting not configured due to testing-only nature of implementation.
• To configure System Pulse alerts https://epiccloudtestsystempulse.uhc.com/SystemPulse
  • Enable alerts from servers
  • Complete SMTP configuration
  • SMTP server: mailo2.uhc.com -Netscaler VIP Status

SOP for Admin Tasks

(e.g., add new disk, expand disk, upgrade SKU, add new machine, start/stop server)

• Out of scope for Epic on Azure team; details should be shared by Cloud Operations.

Patching Schedule/Process

• Out of scope for Epic on Azure team; details should be shared by Cloud Operations.

Accenture Team will provide Hypercare through Friday, April 18, 2025. Optum’s ECSA team will take over ongoing support starting Monday, April 21, 2025.

Acknowledgement Section