Install an Azure connector on ACI using Azure CLI

Learn how to deploy a connector in an Azure environment

Azure Container Instances (ACI) is a managed, serverless compute platform for running containerized applications. This guide explains how to install and configure an Apono connector on ACI in your Azure environment using Azure CLI.

Prerequisites

Item
Description

Apono Token

Account-specific Apono authentication value

Use the following steps to obtain your token:

  1. On the Connectors page, click Install Connector. The Install Connector page appears.

  2. Click Cloud installation > Azure > Install and Connect Azure Account > CLI (Container Instance).

  3. Copy the token listed on the page in step 1.

Azure Cloud Command Line Interface (AZ CLI)

Tool that enables interacting with Azure services using your command-line shell

Azure Cloud Information

Information for your Azure Cloud instance:

Owner Role (Azure RBAC)

Azure role with the following permissions:

  • Grants full access to manage all resources

  • Assigns roles in Azure RBAC

Global Administrator

The user following this guide should have an Microsoft Entra role with the following permission:

  • Manages all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities

❗Apono does not require Global Administrator access. This is required for the admin following this guide. ❗

Install a new connector

You can install a connector for an Azure Management Group or Subscription.

The connector requires the following roles:

  1. Directory Readers - to validate users in Azure

  2. User Access Administrator - to provision and deprovision access in the Management Group

Read more about these Microsoft Entra ID roles here.

Follow these steps to install a new connector:

  1. At the shell prompt, set the environment variables.

export APONO_CONNECTOR_ID=<A_UNIQUE_CONNECTOR_NAME>
export APONO_TOKEN=<APONO_TOKEN>
export SUBSCRIPTION_ID=<AZURE_SUBSCRIPTION_ID>
export RESOURCE_GROUP_NAME=<AZURE_RESOURCE_GROUP_NAME>
export MANAGEMENT_GROUP_NAME=<AZURE_MANAGEMENT_GROUP_NAME>

  1. Log in to your Azure account.

az login

  1. Set the REGION environment variable.

export REGION=$(az group show --name $RESOURCE_GROUP_NAME --query location --output tsv)

  1. Run the following command to deploy the connector on your ACI.

export PRINCIPAL_ID=$(az container create --subscription $SUBSCRIPTION_ID --resource-group $RESOURCE_GROUP_NAME --name $APONO_CONNECTOR_ID --ports 80 --os-type linux --image registry.apono.io/apono-connector:v1.6.7 --environment-variables APONO_CONNECTOR_ID=$APONO_CONNECTOR_ID APONO_TOKEN=$APONO_TOKEN APONO_URL=api.apono.io CONNECTOR_METADATA='{"cloud_provider":"AZURE","subscription_id":"'"$SUBSCRIPTION_ID"'","resource_group":"'"$RESOURCE_GROUP_NAME"'","region":"'"$REGION"'","is_azure_admin":true}' --cpu 1 --memory 1.5 --registry-login-server registry.apono.io --registry-username apono --registry-password $APONO_TOKEN --location $REGION --assign-identity --query identity.principalId --output tsv)

  1. Add the User Access Administrator role to the connector in the management group scope.

az role assignment create --assignee-object-id $PRINCIPAL_ID --assignee-principal-type ServicePrincipal --role "User Access Administrator" --scope /providers/Microsoft.Management/managementGroups/$MANAGEMENT_GROUP_NAME

  1. For Azure AD, add the Director Readers role to the connector. For Azure AD Groups, add the Groups Administrator and Privileged Role Administrator roles.

az rest --method POST --uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments' --body '{"principalId": "'"$PRINCIPAL_ID"'", "roleDefinitionId": "88d8e3e3-8f55-4a1e-953a-9b9898b8876b", "directoryScopeId": "/"}'

  1. On the Connectors page, verify that the connector has been updated.

You can now integrate with an Azure Management Group or Azure Subscription.

PreviousApono Connector for AzureNextInstall an Azure connector on ACI using PowerShell

Last updated

Was this helpful?