Managed Service Identity dla zasobów w Microsoft Azure Kiedy nawet maszyna wirtualna ma własną tożsamość…
Michał Smereczyński Cloud Architect Linux Guy DevOps Od czasu do czasu Dev.py Wieczny student @smereczynski https://omada.net http://free-media.eu https://lnx.azurewebites.net
Tożsamość w Azure
User Principal
DEMO
Service Principal
DEMO
Managed Service Identity Azure Resource Manager receives a message to enable MSI on a VM. Azure Resource Manager creates a Service Principal in Azure AD to represent the identity of the VM. The Service Principal is created in the Azure AD tenant that is trusted by this subscription. Azure Resource Manager configures the Service Principal details in the MSI VM Extension of the VM. This step includes configuring client ID and certificate used by the extension to get access tokens from Azure AD. Now that the Service Principal identity of the VM is known, it can be granted access to Azure resources. For example, if your code needs to call Azure Resource Manager, then you would assign the VM’s Service Principal the appropriate role using Role-Based Access Control (RBAC) in Azure AD. If your code needs to call Key Vault, then you would grant your code access to the specific secret or key in Key Vault. Your code running on the VM requests a token from a local endpoint that is hosted by the MSI VM extension: http://localhost:50342/oauth2/token. The resource parameter specifies the service to which the token is sent. For example, if you want your code to authenticate to Azure KeyVault, you would use resource=https://vault.azure.net/. The MSI VM Extension uses its configured client ID and certificate to request an access token from Azure AD. Azure AD returns a JSON Web Token (JWT) access token. Your code sends the access token on a call to a service that supports Azure AD authentication.
Włączenie MSI – Azure CLI az vm assign-identity -g myResourceGroup -n myVm
Włączenie MSI – PowerShell $vm = Get-AzureRmVM -ResourceGroupName myResourceGroup -Name myVM Update-AzureRmVM -ResourceGroupName myResourceGroup -VM $vm -IdentityType "SystemAssigned"
Włączenie MSI – Szablon ARM
Włączenie MSI – Portal
DEMO