github.com/ratanraj/packer@v1.3.2/website/source/docs/builders/azure-setup.html.md (about)

     1  ---
     2  description: |
     3      In order to build VMs in Azure, Packer needs various configuration options.
     4      These options and how to obtain them are documented on this page.
     5  layout: docs
     6  page_title: 'Setup - Azure - Builders'
     7  sidebar_current: 'docs-builders-azure-setup'
     8  ---
     9  
    10  # Authorizing Packer Builds in Azure
    11  
    12  In order to build VMs in Azure Packer needs 6 configuration options to be specified:
    13  
    14  -   `subscription_id` - UUID identifying your Azure subscription (where billing is handled)
    15  
    16  -   `client_id` - UUID identifying the Active Directory service principal that will run your Packer builds
    17  
    18  -   `client_secret` - service principal secret / password
    19  
    20  -   `resource_group_name` - name of the resource group where your VHD(s) will be stored
    21  
    22  -   `storage_account` - name of the storage account where your VHD(s) will be stored
    23  
    24  -&gt; Behind the scenes Packer uses the OAuth protocol to authenticate against Azure Active Directory and authorize requests to the Azure Service Management API. These topics are unnecessarily complicated so we will try to ignore them for the rest of this document.<br /><br />You do not need to understand how OAuth works in order to use Packer with Azure, though the Active Directory terms "service principal" and "role" will be useful for understanding Azure's access policies.
    25  
    26  In order to get all of the items above, you will need a username and password for your Azure account.
    27  
    28  ## Device Login
    29  
    30  Device login is an alternative way to authorize in Azure Packer. Device login only requires you to know your
    31  Subscription ID. (Device login is only supported for Linux based VMs.) Device login is intended for those who are first
    32  time users, and just want to ''kick the tires.'' We recommend the SPN approach if you intend to automate Packer.
    33  
    34  > Device login is for **interactive** builds, and SPN is **automated** builds.
    35  
    36  There are three pieces of information you must provide to enable device login mode.
    37  
    38  1.  SubscriptionID
    39  2.  Resource Group - parent resource group that Packer uses to build an image.
    40  3.  Storage Account - storage account where the image will be placed.
    41  
    42  > Device login mode is enabled by not setting client\_id and client\_secret.
    43  
    44  > Device login mode is for the Public and US Gov clouds only.
    45  
    46  The device login flow asks that you open a web browser, navigate to <http://aka.ms/devicelogin>, and input the supplied
    47  code. This authorizes the Packer for Azure application to act on your behalf. An OAuth token will be created, and stored
    48  in the user's home directory (~/.azure/packer/oauth-TenantID.json). This token is used if the token file exists, and it
    49  is refreshed as necessary. The token file prevents the need to continually execute the device login flow. Packer will ask
    50  for two device login auth, one for service management endpoint and another for accessing temp keyvault secrets that it creates.
    51  
    52  ## Install the Azure CLI
    53  
    54  To get the credentials above, we will need to install the Azure CLI. Please refer to Microsoft's official [installation guide](https://azure.microsoft.com/en-us/documentation/articles/xplat-cli-install/).
    55  
    56  -&gt; The guides below also use a tool called [`jq`](https://stedolan.github.io/jq/) to simplify the output from the Azure CLI, though this is optional. If you use homebrew you can simply `brew install node jq`.
    57  
    58  You can also use the Azure CLI in Docker. It also comes with `jq` pre-installed:
    59  
    60  ```shell
    61  $ docker run -it microsoft/azure-cli
    62  ```
    63  
    64  ## Guided Setup
    65  
    66  The Packer project includes a [setup script](https://github.com/hashicorp/packer/blob/master/contrib/azure-setup.sh) that can help you setup your account. It uses an interactive bash script to log you into Azure, name your resources, and export your Packer configuration.
    67  
    68  ## Manual Setup
    69  
    70  If you want more control or the script does not work for you, you can also use the manual instructions below to setup your Azure account. You will need to manually keep track of the various account identifiers, resource names, and your service principal password.
    71  
    72  ### Identify Your Tenant and Subscription IDs
    73  
    74  Login using the Azure CLI
    75  
    76  ``` shell
    77  $ az login
    78  # Note, we have launched a browser for you to login. For old experience with device code, use "az login --use-device-code"
    79  ```
    80  
    81  Once you've completed logging in, you should get a JSON array like the one below:
    82  
    83  ```shell
    84  [
    85    {
    86      "cloudName": "AzureCloud",
    87      "id": "$uuid",
    88      "isDefault": false,
    89      "name": "Pay-As-You-Go",
    90      "state": "Enabled",
    91      "tenantId": "$tenant_uuid",
    92      "user": {
    93        "name": "my_email@anywhere.com",
    94        "type": "user"
    95      }
    96    }
    97  ]
    98  
    99  ```
   100  Get your account information
   101  
   102  ``` shell
   103  $ az account list --output json | jq -r '.[].name'
   104  $ az account set --subscription ACCOUNTNAME
   105  $ az account show --output json | jq -r '.id'
   106  ```
   107  
   108  -&gt; Throughout this document when you see a command pipe to `jq` you may instead omit `--output json` and everything after it, but the output will be more verbose. For example you can simply run `az account list` instead.
   109  
   110  This will print out one line that look like this:
   111  
   112      4f562e88-8caf-421a-b4da-e3f6786c52ec
   113  
   114  This is your `subscription_id`. Note it for later.
   115  
   116  ### Create a Resource Group
   117  
   118  A [resource group](https://azure.microsoft.com/en-us/documentation/articles/resource-group-overview/#resource-groups) is used to organize related resources. Resource groups and storage accounts are tied to a location. To see available locations, run:
   119  
   120  ``` shell
   121  $ az account list-locations
   122  $ LOCATION=xxx
   123  $ GROUPNAME=xxx
   124  # ...
   125  
   126  $ az group create --name $GROUPNAME --location $LOCATION
   127  ```
   128  
   129  Your storage account (below) will need to use the same `GROUPNAME` and `LOCATION`.
   130  
   131  ### Create a Storage Account
   132  
   133  We will need to create a storage account where your Packer artifacts will be stored. We will create a `LRS` storage account which is the least expensive price/GB at the time of writing.
   134  
   135  ``` shell
   136  $ az storage account create \
   137    --name STORAGENAME
   138    --resource-group $GROUPNAME \
   139    --location $LOCATION \
   140    --sku Standard_LRS \
   141    --kind Storage
   142  ```
   143  
   144  -&gt; `LRS` and `Standard_LRS` are meant as literal "LRS" or "Standard_LRS" and not as variables.
   145  
   146  Make sure that `GROUPNAME` and `LOCATION` are the same as above. Also, ensure that `GROUPNAME` is less than 24 characters long and contains only lowercase letters and numbers.
   147  
   148  ### Create an Application
   149  
   150  An application represents a way to authorize access to the Azure API. Note that you will need to specify a URL for your application (this is intended to be used for OAuth callbacks) but these do not actually need to be valid URLs.
   151  
   152  First pick APPNAME, APPURL and PASSWORD:
   153  
   154  ```shell
   155  APPNAME=packer.test
   156  APPURL=packer.test
   157  PASSWORD=xxx
   158  ```
   159  Password is your `client_secret` and can be anything you like. I recommend using ```openssl rand -base64 24```.
   160  
   161  ``` shell
   162  $ az ad app create \
   163    --display-name $APPNAME \
   164    --identifier-uris $APPURL \
   165    --home-page $APPURL \
   166    --password $PASSWORD
   167  ```
   168  
   169  ### Create a Service Principal
   170  
   171  You cannot directly grant permissions to an application. Instead, you create a service principal and assign permissions to the service principal. To create a service principal for use with Packer, run the below command specifying the subscription. This will grant Packer the contributor role to the subscription. The output of this command is your service principal credentials, save these in a safe place as you will need these to configure Packer.
   172  
   173  ```shell
   174  az ad sp create-for-rbac -n "Packer" --role contributor \
   175                              --scopes /subscriptions/{SubID}
   176  ```
   177  
   178  The service principal credentials.
   179  
   180  ```shell
   181  {
   182    "appId": "AppId",
   183    "displayName": "Packer",
   184    "name": "http://Packer",
   185    "password": "Password",
   186    "tenant": "TenantId"
   187  }
   188  ```
   189  
   190  There are a lot of pre-defined roles and you can define your own with more granular permissions, though this is out of scope. You can see a list of pre-configured roles via:
   191  
   192  ``` shell
   193  $ az role definition list --output json | jq ".[] | {name:.roleName, description:.description}"
   194  ```
   195  
   196  ### Configuring Packer
   197  
   198  Now (finally) everything has been setup in Azure and our service principal has been created. You can use the output from creating your service principal in your template.