Generate SAS Tokens in ARM Templates Without much fanfare, MS recently updated the ARM template spec to allow the creation of SAS tokens inside a template. This is excellent news for anyone who is deploying resources with ARM templates that rely on storage accounts and need a SAS token to access them.
For those not familiar with SAS tokens, you can read more on them here but essentially Shared Access Signatures (SAS) provide a way to generate a key to undertake operations on a storage account, without needing the actual storage account key.
A few months back we looked at how we can use a tool called Packer to automate the creation of virtual machine images, which could then be used with VM Scale Sets. If this is something you are interested in doing, I would recommend taking a look at the original article, which walks you through the whole process.
At the end of that article, I said we were next going to look at how we can use continuous integration to build this image on a regular schedule, or when applications are updated.
As we head towards the end of the year, I wanted to take a look back over all the Azure updates and announcements we have seen throughout this year and review some of the highlights.
Based on the data from the Azure Updates site, we have seen 842 updates and announcements throughout the last year. As you might expect we’ve seen the number of announcements increase month on month, up to the big announcement windows of Build and Ignite.
If you are writing ARM templates to deploy your Azure Infrastructure, then it’s more than likely you are utilising some of the functions provided by the ARM language. Functions allow you to perform simple operations inside your template to transform or creation values that you use in your deployment. Some of the most common ones you’ll see include:
Concat - for joining strings, regularly used to join parameters, variables and constants together to form resource names, app settings, connection strings and so on.
If your application is running on a Kubernetes cluster in Azure (AKS, ACS or ACS Engine), then it is likely that you will need to access other Azure resources from your pods that are secured with Azure AD. These operations could include retrieving secrets from Key Vault, files from Blob storage or just interacting with other applications or API’s that use Azure AD as their identity provider. To be able to do this your application needs to be able to provide an identity to access these resources securely.
If you are working with Azure then ARM templates are a great way to define your resource and deploy them declaratively. However, if you find you need to do anything other than creating Azure resources as part of your deployment, then you are a bit stuck, as ARM templates don’t offer any way to call external resources or run scripts.
An example that we will use for this rest of this article is something I needed to do recently.
A little while ago I wrote a series of posts talking about how to send your SmartThings home automation data to Azure to capture and report on, using tools like Event Hub, Cosmos DB and Power BI. This solution works great, and I am still running this today, but there was one downside. To transfer the data we collected from Event Hub to Cosmos we were using Azure Stream Analytics. This process worked fine, but it was overkill for what we were doing.
While you can create an Azure Storage account with an ARM template very quickly, it’s not been possible to create anything inside this storage account, such as blob containers, tables, queues, using the same ARM template. If you wanted to do this, you either needed to look at running scripts after your template completes, or using something like Terraform, which does allow you to create these things.
However, a recent update to the ARM schema means you can now create Blob containers in your template.
Azure Active Directory is not Active Directory! If you’ve been working with Azure for a while you likely already know this, but this topic is something I see over and over again with people who are getting started with Azure. Azure Active Directory is not a cloud version of Active Directory, and in fact, it bears minimal resemblance to its on-premises namesake at all.
The question I see over and over again with people new to Azure, I even answered this question just this week, is “how do I join my servers to Azure AD?
Azure has offered the ability to get static public IP addresses for many years now, however when you request an IP you will receive one from the general pool of available addresses and it is very unlikely you will receive multiple IPs in the same range. A new preview feature announced at Ignite changes this, called Public IP Address Prefixes.
Instead of requesting a single static IP you can request a Prefix, which will give you a contiguous range of IP addresses.
