github.com/marksheahan/packer@v0.10.2-0.20160613200515-1acb2d6645a0/website/source/docs/builders/azure-setup.html.md (about)

     1  ---
     2  description: |
     3      
     4  layout: docs
     5  page_title: Authorizing Packer Builds in Azure
     6  ...
     7  
     8  # Authorizing Packer Builds in Azure
     9  
    10  In order to build VMs in Azure Packer needs 6 configuration options to be specified:
    11  
    12  - `tenant_id` - UUID identifying your Azure account (where you login)
    13  - `subscription_id` - UUID identifying your Azure subscription (where billing is handled)
    14  - `client_id` - UUID identifying the Active Directory service principal that will run your Packer builds
    15  - `client_secret` - service principal secret / password
    16  - `resource_group_name` - name of the resource group where your VHD(s) will be stored
    17  - `storage_account` - name of the storage account where your VHD(s) will be stored
    18  
    19  -> Behind the scenes Packer uses the OAuth protocol to authenticate against Azure Active Directory and authorize requests to the Azure Service Management API. These topics are unnecessarily complicated so we will try to ignore them for the rest of this document.<br /><br />You do not need to understand how OAuth works in order to use Packer with Azure, though the Active Directory terms "service principal" and "role" will be useful for understanding Azure's access policies.
    20  
    21  In order to get all of the items above, you will need a username and password for your Azure account.
    22  
    23  ## Device Login
    24  
    25  Device login is an alternative way to authorize in Azure Packer.  Device login only requires you to know your
    26  Subscription ID. (Device login is only supported for Linux based VMs.) Device login is intended for those who are first
    27  time users, and just want to ''kick the tires.'' We recommend the SPN approach if you intend to automate Packer, or for
    28  deploying Windows VMs.
    29  
    30  > Device login is for **interactive** builds, and SPN is **automated** builds.
    31  
    32  There are three pieces of information you must provide to enable device login mode.
    33  
    34   1. SubscriptionID
    35   1. Resource Group - parent resource group that Packer uses to build an image.
    36   1. Storage Account - storage account where the image will be placed.
    37  
    38  > Device login mode is enabled by not setting client_id, client_secret, and tenant_id.
    39  
    40  The device login flow asks that you open a web browser, navigate to http://aka.ms/devicelogin, and input the supplied
    41  code. This authorizes the Packer for Azure application to act on your behalf. An OAuth token will be created, and stored
    42  in the user's home directory (~/.azure/packer/oauth-TenantID.json). This token is used if the token file exists, and it
    43  is refreshed as necessary.  The token file prevents the need to continually execute the device login flow.
    44  
    45  ## Install the Azure CLI
    46  
    47  To get the credentials above, we will need to install the Azure CLI. Please refer to Microsoft's official [installation guide](https://azure.microsoft.com/en-us/documentation/articles/xplat-cli-install/).
    48  
    49  -> The guides below also use a tool called [`jq`](https://stedolan.github.io/jq/) to simplify the output from the Azure CLI, though this is optional. If you use homebrew you can simply `brew install node jq`.
    50  
    51  If you already have node.js installed you can use `npm` to install `azure-cli`:
    52  
    53      npm install -g azure-cli --no-progress
    54  
    55  ## Guided Setup
    56  
    57  The Packer project includes a [setup script](https://github.com/mitchellh/packer/blob/master/contrib/azure-setup.sh) that can help you setup your account. It uses an interactive bash script to log you into Azure, name your resources, and export your Packer configuration.
    58  
    59  ## Manual Setup
    60  
    61  If you want more control or the script does not work for you, you can also use the manual instructions below to setup your Azure account. You will need to manually keep track of the various account identifiers, resource names, and your service principal password.
    62  
    63  ### Identify Your Tenant and Subscription IDs
    64  
    65  Login using the Azure CLI
    66  
    67      azure config mode arm
    68      azure login -u USERNAME
    69  
    70  Get your account information
    71  
    72      azure account list --json | jq .[].name
    73      azure account set ACCOUNTNAME
    74      azure account show --json | jq ".[] | .tenantId, .id"
    75  
    76  -> Throughout this document when you see a command pipe to `jq` you may instead omit `--json` and everything after it, but the output will be more verbose. For example you can simply run `azure account list` instead._
    77  
    78  This will print out two lines that look like this:
    79  
    80      "4f562e88-8caf-421a-b4da-e3f6786c52ec"
    81      "b68319b-2180-4c3e-ac1f-d44f5af2c6907"
    82  
    83  The first one is your `tenant_id`. The second is your `subscription_id`. Note these for later.
    84  
    85  ### Create a Resource Group
    86  
    87  A [resource group](https://azure.microsoft.com/en-us/documentation/articles/resource-group-overview/#resource-groups) is used to organize related resources. Resource groups and storage accounts are tied to a location. To see available locations, run:
    88  
    89      azure location list
    90      ...
    91      azure group create -n GROUPNAME -l LOCATION
    92  
    93  Your storage account (below) will need to use the same `GROUPNAME` and `LOCATION`.
    94  
    95  ### Create a Storage Account
    96  
    97  We will need to create a storage account where your Packer artifacts will be stored. We will create a `LRS` storage account which is the least expensive price/GB at the time of writing.
    98  
    99      azure storage account create -g GROUPNAME \
   100          -l LOCATION --type LRS STORAGENAME
   101  
   102  -> `LRS` is meant as a literal "LRS" and not as a variable.
   103  
   104  Make sure that `GROUPNAME` and `LOCATION` are the same as above.
   105  
   106  ### Create an Application
   107  
   108  An application represents a way to authorize access to the Azure API. Note that you will need to specify a URL for your application (this is intended to be used for OAuth callbacks) but these do not actually need to be valid URLs.
   109  
   110      azure ad app create -n APPNAME -i APPURL --home-page APPURL -p PASSWORD
   111  
   112  Password is your `client_secret` and can be anything you like. I recommend using `openssl rand -base64 24`.
   113  
   114  ### Create a Service Principal
   115  
   116  You cannot directly grant permissions to an application. Instead, you create a service principal associated with the application and assign permissions to the service principal.
   117  
   118  First, get the `APPID` for the application we just created.
   119  
   120      azure ad app list --json | \ 
   121          jq '.[] | select(.displayName | contains("APPNAME")) | .appId'
   122      azure ad sp create --applicationId APPID
   123  
   124  ### Grant Permissions to Your Application
   125  
   126  Finally, we will associate the proper permissions with our application's service principal. We're going to assign the `Owner` role to our Packer application and change the scope to manage our whole subscription. (The `Owner` role can be scoped to a specific resource group to further reduce the scope of the account.) This allows Packer to create temporary resource groups for each build.
   127  
   128      azure role assignment create --spn APPURL -o "Owner" \
   129          -c /subscriptions/SUBSCRIPTIONID
   130  
   131  There are a lot of pre-defined roles and you can define your own with more granular permissions, though this is out of scope. You can see a list of pre-configured roles via:
   132  
   133      azure role list --json | \
   134          jq ".[] | {name:.Name, description:.Description}"
   135  
   136  
   137  ### Configuring Packer
   138  
   139  Now (finally) everything has been setup in Azure. Let's get our configuration keys together:
   140  
   141  Get `tenant_id` and `subscription_id`:
   142  
   143      azure account show --json | jq ".[] | .tenantId, .id"
   144  
   145  Get `client_id`
   146  
   147      azure ad app list --json | \
   148          jq '.[] | select(.displayName | contains("APPNAME")) | .appId'
   149  
   150  Get `client_secret`
   151  
   152  This cannot be retrieved. If you forgot this, you will have to delete and re-create your service principal and the associated permissions.
   153  
   154  Get `resource_group_name`
   155  
   156      azure group list
   157  
   158  Get `storage_account`
   159  
   160      azure storage account list