lpichler / topological_inventory-azure

topological_inventory-azure

---

Create Azure service principal and configure roles

Red Hat recommends configuring dedicated credentials to grant topological inventory read-only access to Azure data.

1. Once in the Azure portal, enter the cloud shell by clicking on the terminal icon on the top menu bar.

2. In the shell environment, run the following command to obtain your Azure subscription ID:

   az account show --query "{subscription_id: id }"

   The subscription ID will be required for one of the following steps.

3. Now, run the following command to create the TopologicalInventory service principle with an initial role of Reader. The command will return the API keys that will be used by the Azure source.

   az ad sp create-for-rbac -n "https://TopologicalInventory" --role "Reader" --query '{"tenant": tenant, "client_id": appId, "secret": password}'

   Note: Service principal names are global for the Azure account, so you may need to use a different name if https://TopologicalInventory already exists.

4. Finally, we need to add the Storage Account Contributor role to our newly created service principal, to enable topological inventory to collect storage information. This is accomplished by running the following:

   az role assignment create --role "Storage Account Contributor" --assignee https://TopologicalInventory --subscription <SubscriptionID>

   Note: Replace with the value obtained in the first step.

Assigning API keys to Azure source

The az ad sp create-for-rbac ... command mentioned above, should return the keys in the following format:

{
  "client_id": "XXX",
  "secret": "YYY",
  "tenant": "ZZZ"
}

When seeding the source information via the scripts in the guides repository, assign these values in your config.sh as follows:

export AZURE_CLIENT_ID="XXX"
export AZURE_CLIENT_SECRET="YYY"
export AZURE_TENANT_ID="ZZZ"