Managed Service Identity dla zasobów w Microsoft Azure

Prezentacja na temat: "Managed Service Identity dla zasobów w Microsoft Azure"— Zapis prezentacji:

1 Managed Service Identity dla zasobów w Microsoft Azure
Kiedy nawet maszyna wirtualna ma własną tożsamość…

2 Michał Smereczyński Cloud Architect Linux Guy DevOps
Od czasu do czasu Dev.py Wieczny student @smereczynski

3 Tożsamość w Azure

4 User Principal

5 DEMO

6 Service Principal

7 DEMO

8 Managed Service Identity
Azure Resource Manager receives a message to enable MSI on a VM. Azure Resource Manager creates a Service Principal in Azure AD to represent the identity of the VM. The Service Principal is created in the Azure AD tenant that is trusted by this subscription. Azure Resource Manager configures the Service Principal details in the MSI VM Extension of the VM. This step includes configuring client ID and certificate used by the extension to get access tokens from Azure AD. Now that the Service Principal identity of the VM is known, it can be granted access to Azure resources. For example, if your code needs to call Azure Resource Manager, then you would assign the VM’s Service Principal the appropriate role using Role-Based Access Control (RBAC) in Azure AD. If your code needs to call Key Vault, then you would grant your code access to the specific secret or key in Key Vault. Your code running on the VM requests a token from a local endpoint that is hosted by the MSI VM extension:  The resource parameter specifies the service to which the token is sent. For example, if you want your code to authenticate to Azure KeyVault, you would use resource= The MSI VM Extension uses its configured client ID and certificate to request an access token from Azure AD. Azure AD returns a JSON Web Token (JWT) access token. Your code sends the access token on a call to a service that supports Azure AD authentication.

9 Włączenie MSI – Azure CLI
az vm assign-identity -g myResourceGroup -n myVm

10 Włączenie MSI – PowerShell
$vm = Get-AzureRmVM -ResourceGroupName myResourceGroup -Name myVM Update-AzureRmVM -ResourceGroupName myResourceGroup -VM $vm -IdentityType "SystemAssigned"

11 Włączenie MSI – Szablon ARM

12 Włączenie MSI – Portal

13 DEMO