1 of 5

Apono Connector for Azure

How to install a Connector on your Azure environment to integrate with Azure management group or subscription

If your organization uses Azure as it's cloud provider, you can take advantage of Apono Azure integrations, allowing you to create just-in-time access management based on Access Flows and user requests to your Azure resources.

The integration between Azure and Apono requires an Azure Apono connector installed in your Azure environment.

The remainder of this guide focuses on installing and configuring the Azure Apono connector on ACI in your Azure environment.

Prerequisites

Azure user with the following permissions on your Azure management group/subscription:

Role

Permissions

Kubectl Command-line.

The Apono Azure Management Groups integration allows you to auto-discover all resources under your Tenant by installing the connector on one of the Azure Subscriptions under the Tenant Root Management Group.

Installation Steps

In Apono

Go to Integrations, under Environment from the left navigator.
Under Integrations, click the Catalog tab and select Azure under Cloud provider category.

In Azure integration page under Discovery, choose between Azure Management Group and Azure Subscription, then select the resource types you want to integrate with.

Under Apono connector, choose + Add new connector.
Choose installation method and copy the Apono token.

In Azure

Install an Azure connector on ACI using Azure CLI

Learn how to deploy a connector in an Azure environment

Azure Container Instances (ACI) is a managed, serverless compute platform for running containerized applications. This guide explains how to install and configure an Apono connector on ACI in your Azure environment using Azure CLI.

Prerequisites

Item

Description

Install a new connector

You can install a connector for an Azure Management Group or Subscription.

Follow these steps to install a new connector:

At the shell prompt, set the environment variables.

export APONO_CONNECTOR_ID=<A_UNIQUE_CONNECTOR_NAME>
export APONO_TOKEN=<APONO_TOKEN>
export SUBSCRIPTION_ID=<AZURE_SUBSCRIPTION_ID>
export RESOURCE_GROUP_NAME=<AZURE_RESOURCE_GROUP_NAME>
export MANAGEMENT_GROUP_NAME=<AZURE_MANAGEMENT_GROUP_NAME>

az login

Set the REGION environment variable.

export REGION=$(az group show --name $RESOURCE_GROUP_NAME --query location --output tsv)

Run the following command to deploy the connector on your ACI.

export PRINCIPAL_ID=$(az container create --subscription $SUBSCRIPTION_ID --resource-group $RESOURCE_GROUP_NAME --name $APONO_CONNECTOR_ID --ports 80 --os-type linux --image registry.apono.io/apono-connector:v1.6.7 --environment-variables APONO_CONNECTOR_ID=$APONO_CONNECTOR_ID APONO_TOKEN=$APONO_TOKEN APONO_URL=api.apono.io CONNECTOR_METADATA='{"cloud_provider":"AZURE","subscription_id":"'"$SUBSCRIPTION_ID"'","resource_group":"'"$RESOURCE_GROUP_NAME"'","region":"'"$REGION"'","is_azure_admin":true}' --cpu 1 --memory 1.5 --registry-login-server registry.apono.io --registry-username apono --registry-password $APONO_TOKEN --location $REGION --assign-identity --query identity.principalId --output tsv)

Add the User Access Administrator role to the connector in the management group scope.

az role assignment create --assignee-object-id $PRINCIPAL_ID --assignee-principal-type ServicePrincipal --role "User Access Administrator" --scope /providers/Microsoft.Management/managementGroups/$MANAGEMENT_GROUP_NAME

For Azure AD, add the Director Readers role to the connector. For Azure AD Groups, add the Groups Administrator and Privileged Role Administrator roles.

az rest --method POST --uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments' --body '{"principalId": "'"$PRINCIPAL_ID"'", "roleDefinitionId": "88d8e3e3-8f55-4a1e-953a-9b9898b8876b", "directoryScopeId": "/"}'

# First role assignment
az rest --method POST --uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments' --body '{"principalId": "'"$PRINCIPAL_ID"'", "roleDefinitionId": "fdd7a751-b60b-444a-984c-02652fe8fa1c", "directoryScopeId": "/"}'

# Second role assignment
az rest --method POST --uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments' --body '{"principalId": "'"$PRINCIPAL_ID"'", "roleDefinitionId": "e8611ab8-c189-46e8-94e1-60213ab1f814", "directoryScopeId": "/"}'

On the Connectors page, verify that the connector has been updated.

You can now integrate with an Azure Management Group or Azure Subscription.

Follow these steps to install a new connector:

Export the following environment variables.

export APONO_CONNECTOR_ID=<A_UNIQUE_CONNECTOR_NAME>
export APONO_TOKEN=<APONO_TOKEN>
export SUBSCRIPTION_ID=<AZURE_SUBSCRIPTION_ID>
export RESOURCE_GROUP_NAME=<AZURE_RESOURCE_GROUP_NAME>

az login

Set the REGION environment variable.

export REGION=$(az group show --name $RESOURCE_GROUP_NAME --query location --output tsv)

Run the following command to deploy the connector on your ACI.

export PRINCIPAL_ID=$(az container create --subscription $SUBSCRIPTION_ID --resource-group $RESOURCE_GROUP_NAME --name $APONO_CONNECTOR_ID --ports 80 --os-type linux --image registry.apono.io/apono-connector:v1.6.7 --environment-variables APONO_CONNECTOR_ID=$APONO_CONNECTOR_ID APONO_TOKEN=$APONO_TOKEN APONO_URL=api.apono.io CONNECTOR_METADATA='{"cloud_provider":"AZURE","subscription_id":"'"$SUBSCRIPTION_ID"'","resource_group":"'"$RESOURCE_GROUP_NAME"'","region":"'"$REGION"'","is_azure_admin":true}' --cpu 1 --memory 1.5 --registry-login-server registry.apono.io --registry-username apono --registry-password $APONO_TOKEN --location $REGION --assign-identity --query identity.principalId --output tsv)

Add the User Access Administrator role to the connector in the subscription scope.

az role assignment create --assignee-object-id $PRINCIPAL_ID --assignee-principal-type ServicePrincipal --role "User Access Administrator" --scope /subscriptions/$SUBSCRIPTION_ID

For Azure AD, add the Director Readers role to the connector. For Azure AD Groups, add the Groups Administrator and Privileged Role Administrator roles.

az rest --method POST --uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments' --body '{"principalId": "'"$PRINCIPAL_ID"'", "roleDefinitionId": "88d8e3e3-8f55-4a1e-953a-9b9898b8876b", "directoryScopeId": "/"}'

# First role assignment
az rest --method POST --uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments' --body '{"principalId": "'"$PRINCIPAL_ID"'", "roleDefinitionId": "fdd7a751-b60b-444a-984c-02652fe8fa1c", "directoryScopeId": "/"}'

# Second role assignment
az rest --method POST --uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments' --body '{"principalId": "'"$PRINCIPAL_ID"'", "roleDefinitionId": "e8611ab8-c189-46e8-94e1-60213ab1f814", "directoryScopeId": "/"}'

On the Connectors page, verify that the connector has been updated.

You can now create integrate with an Azure Management Group or Azure Subscription.

Install an Azure connector on ACI using PowerShell

Learn how to deploy a connector in an Azure environment

Prerequisites

Item

Description

Install a new connector

You can install a connector for an Azure Management Group or Subscription.

Follow these steps to install a new connector:

At the shell prompt, set the environment variables.

Set the REGION environment variable.

Run the following command to deploy the connector on your ACI.

Add the User Access Administrator role to the connector in the management group scope.

For Azure AD, add the Director Readers role to the connector. For Azure AD Groups, add the Groups Administrator and Privileged Role Administrator roles.

Follow these steps to install a new connector:

Export the following environment variables.

Set the REGION environment variable.

Run the following command to deploy the connector on your ACI.

Add the User Access Administrator role to the connector in the subscription scope.

For Azure AD, add the Director Readers role to the connector. For Azure AD Groups, add the Groups Administrator and Privileged Role Administrator roles.

Install an Azure connector on ACI using Terraform

Learn how to deploy a connector in an Azure environment

Prerequisites

Item

Description

Install a new connector

Follow these steps to set up a new connector:

At the shell prompt, set the Apono environment variables to your account token.

export APONO_TOKEN=<APONO_TOKEN>
export RESOURCE_GROUP_NAME=<AZURE_RESOURCE_GROUP_NAME>
export SUBNET_ID=[<SUBNET_ID>]

In a new or existing Terraform (.tf) file, add the following provider and module information to create a connector with permissions or without permissions:

Enables installing the connector in the cloud environment and managing access to resources

module "connector" {
    source = "github.com/apono-io/terraform-modules/azure/connector-with-permissions/stacks/apono-connector"
    aponoToken = $APONO_TOKEN
    resourceGroup = $AZURE_RESOURCE_GROUP
    ipAddressType = // "Private" or "None"
    subnetIds = [$SUBNET_ID]
}

Enables installing the connector in the cloud environment but managing access to non-Azure resources, such as self-hosted databases

module "connector" {
    source = "github.com/apono-io/terraform-modules/azure/connector-without-permissions/stacks/apono-connector"
    aponoToken = $APONO_TOKEN
    resourceGroup = $AZURE_RESOURCE_GROUP
    ipAddressType = // "Private" or "None"
    subnetIds = [$SUBNET_ID]
}

At the Terraform CLI, download and install the provider plugin and module.

terraform init

Apply the Terraform changes. The proposed changes and a confirmation prompt will be listed.

terraform apply

Enter yes to confirm deploying the changes to your Azure account.
On the Connectors page, verify that the connector has been deployed.

You can now integrate with an Azure Management Group or Azure Subscription.

Updating a connector in Azure

Learn how to update a connector through the Azure CLI

Periodically, you may need to update your Azure connector to help maintain functionality, performance, and security.

This article explains how to update and redeploy a connector through the Azure CLI.

Prerequisites

Item

Description

Update a connector

To update an Apono connector for Azure, follow these steps in the shell environment with Azure CLI installed:

Set the APONO_CONNECTOR_ID environment variable to your chosen connector ID.
```
export APONO_CONNECTOR_ID=apono-connector
```
Set the APONO_TOKEN environment variable to your account token.
```
export APONO_TOKEN=abcd1234-e5f6-7g8h-90123i45678
```
Set the SUBSCRIPTION_ID environment variable to the Azure subscription ID.
```
export SUBSCRIPTION_ID=abcdef01-23456789-0abc-def012345678
```
Set the RESOURCE_GROUP_NAME environment variable to the Azure resource group name.
```
export RESOURCE_GROUP_NAME=myResourceGroup0816
```

Set the REGION environment variable.

export REGION=$(az group show --name $RESOURCE_GROUP_NAME --query location --output tsv)

Run the following command to deploy an updated version of the connector on the Azure Container Instance service.

```shell
az container create --subscription $SUBSCRIPTION_ID --resource-group $RESOURCE_GROUP_NAME --name $APONO_CONNECTOR_ID --ports 80 --os-type linux --image registry.apono.io/apono-connector:<<connectorVersion>> --environment-variables APONO_CONNECTOR_ID=$APONO_CONNECTOR_ID APONO_TOKEN=$APONO_TOKEN APONO_URL=api.apono.io CONNECTOR_METADATA='{"cloud_provider":"AZURE","subscription_id":"'"$SUBSCRIPTION_ID"'","resource_group":"'"$RESOURCE_GROUP_NAME"'","region":"'"$REGION"'","is_azure_admin":true}' --cpu 1 --memory 1.5 --registry-login-server registry.apono.io --registry-username apono --registry-password $APONO_TOKEN --location $REGION --assign-identity --query identity.principalId --output tsv
```

7. On the [**Connectors**](https://app.apono.io/connectors) page, verify that the connector has been updated.

Install an Azure connector on ACI using Azure CLI

Learn how to deploy a connector in an Azure environment

Prerequisites

Item

Description

Install a new connector

You can install a connector for an Azure Management Group or Subscription.

Follow these steps to install a new connector:

At the shell prompt, set the environment variables.

export APONO_CONNECTOR_ID=<A_UNIQUE_CONNECTOR_NAME>
export APONO_TOKEN=<APONO_TOKEN>
export SUBSCRIPTION_ID=<AZURE_SUBSCRIPTION_ID>
export RESOURCE_GROUP_NAME=<AZURE_RESOURCE_GROUP_NAME>
export MANAGEMENT_GROUP_NAME=<AZURE_MANAGEMENT_GROUP_NAME>

az login

Set the REGION environment variable.

export REGION=$(az group show --name $RESOURCE_GROUP_NAME --query location --output tsv)

Run the following command to deploy the connector on your ACI.

export PRINCIPAL_ID=$(az container create --subscription $SUBSCRIPTION_ID --resource-group $RESOURCE_GROUP_NAME --name $APONO_CONNECTOR_ID --ports 80 --os-type linux --image registry.apono.io/apono-connector:v1.6.7 --environment-variables APONO_CONNECTOR_ID=$APONO_CONNECTOR_ID APONO_TOKEN=$APONO_TOKEN APONO_URL=api.apono.io CONNECTOR_METADATA='{"cloud_provider":"AZURE","subscription_id":"'"$SUBSCRIPTION_ID"'","resource_group":"'"$RESOURCE_GROUP_NAME"'","region":"'"$REGION"'","is_azure_admin":true}' --cpu 1 --memory 1.5 --registry-login-server registry.apono.io --registry-username apono --registry-password $APONO_TOKEN --location $REGION --assign-identity --query identity.principalId --output tsv)

Add the User Access Administrator role to the connector in the management group scope.

az role assignment create --assignee-object-id $PRINCIPAL_ID --assignee-principal-type ServicePrincipal --role "User Access Administrator" --scope /providers/Microsoft.Management/managementGroups/$MANAGEMENT_GROUP_NAME

For Azure AD, add the Director Readers role to the connector. For Azure AD Groups, add the Groups Administrator and Privileged Role Administrator roles.

az rest --method POST --uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments' --body '{"principalId": "'"$PRINCIPAL_ID"'", "roleDefinitionId": "88d8e3e3-8f55-4a1e-953a-9b9898b8876b", "directoryScopeId": "/"}'

# First role assignment
az rest --method POST --uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments' --body '{"principalId": "'"$PRINCIPAL_ID"'", "roleDefinitionId": "fdd7a751-b60b-444a-984c-02652fe8fa1c", "directoryScopeId": "/"}'

# Second role assignment
az rest --method POST --uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments' --body '{"principalId": "'"$PRINCIPAL_ID"'", "roleDefinitionId": "e8611ab8-c189-46e8-94e1-60213ab1f814", "directoryScopeId": "/"}'

On the Connectors page, verify that the connector has been updated.

You can now integrate with an Azure Management Group or Azure Subscription.

Follow these steps to install a new connector:

Export the following environment variables.

export APONO_CONNECTOR_ID=<A_UNIQUE_CONNECTOR_NAME>
export APONO_TOKEN=<APONO_TOKEN>
export SUBSCRIPTION_ID=<AZURE_SUBSCRIPTION_ID>
export RESOURCE_GROUP_NAME=<AZURE_RESOURCE_GROUP_NAME>

az login

Set the REGION environment variable.

export REGION=$(az group show --name $RESOURCE_GROUP_NAME --query location --output tsv)

Run the following command to deploy the connector on your ACI.

export PRINCIPAL_ID=$(az container create --subscription $SUBSCRIPTION_ID --resource-group $RESOURCE_GROUP_NAME --name $APONO_CONNECTOR_ID --ports 80 --os-type linux --image registry.apono.io/apono-connector:v1.6.7 --environment-variables APONO_CONNECTOR_ID=$APONO_CONNECTOR_ID APONO_TOKEN=$APONO_TOKEN APONO_URL=api.apono.io CONNECTOR_METADATA='{"cloud_provider":"AZURE","subscription_id":"'"$SUBSCRIPTION_ID"'","resource_group":"'"$RESOURCE_GROUP_NAME"'","region":"'"$REGION"'","is_azure_admin":true}' --cpu 1 --memory 1.5 --registry-login-server registry.apono.io --registry-username apono --registry-password $APONO_TOKEN --location $REGION --assign-identity --query identity.principalId --output tsv)

Add the User Access Administrator role to the connector in the subscription scope.

az role assignment create --assignee-object-id $PRINCIPAL_ID --assignee-principal-type ServicePrincipal --role "User Access Administrator" --scope /subscriptions/$SUBSCRIPTION_ID

For Azure AD, add the Director Readers role to the connector. For Azure AD Groups, add the Groups Administrator and Privileged Role Administrator roles.

az rest --method POST --uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments' --body '{"principalId": "'"$PRINCIPAL_ID"'", "roleDefinitionId": "88d8e3e3-8f55-4a1e-953a-9b9898b8876b", "directoryScopeId": "/"}'

# First role assignment
az rest --method POST --uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments' --body '{"principalId": "'"$PRINCIPAL_ID"'", "roleDefinitionId": "fdd7a751-b60b-444a-984c-02652fe8fa1c", "directoryScopeId": "/"}'

# Second role assignment
az rest --method POST --uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments' --body '{"principalId": "'"$PRINCIPAL_ID"'", "roleDefinitionId": "e8611ab8-c189-46e8-94e1-60213ab1f814", "directoryScopeId": "/"}'

On the Connectors page, verify that the connector has been updated.

You can now create integrate with an Azure Management Group or Azure Subscription.

Install an Azure connector on ACI using PowerShell

Learn how to deploy a connector in an Azure environment

Prerequisites

Item

Description

Install a new connector

You can install a connector for an Azure Management Group or Subscription.

Follow these steps to install a new connector:

At the shell prompt, set the environment variables.

Set the REGION environment variable.

Run the following command to deploy the connector on your ACI.

Add the User Access Administrator role to the connector in the management group scope.

New-AzRoleAssignment -ObjectId $PRINCIPAL_ID -ObjectType "ServicePrincipal" -RoleDefinitionName "User Access Administrator" -Scope /providers/Microsoft.Management/managementGroups/$MANAGEMENT_GROUP_NAME

For Azure AD, add the Director Readers role to the connector. For Azure AD Groups, add the Groups Administrator and Privileged Role Administrator roles.

$payload = @{
    principalId = $PRINCIPAL_ID
    roleDefinitionId = "88d8e3e3-8f55-4a1e-953a-9b9898b8876b"
    directoryScopeId = "/"
} | ConvertTo-Json -Depth 3

Invoke-AzRestMethod -Method POST -Uri https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments -Payload $payload

# First role assignment
$payload1 = @{
    principalId = $PRINCIPAL_ID
    roleDefinitionId = "fdd7a751-b60b-444a-984c-02652fe8fa1c"
    directoryScopeId = "/"
} | ConvertTo-Json -Depth 3

Invoke-AzRestMethod -Method POST -Uri https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments -Payload $payload1

# Second role assignment
$payload2 = @{
    principalId = $PRINCIPAL_ID
    roleDefinitionId = "e8611ab8-c189-46e8-94e1-60213ab1f814"
    directoryScopeId = "/"
} | ConvertTo-Json -Depth 3

Invoke-AzRestMethod -Method POST -Uri https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments -Payload $payload2

On the page, verify that the connector has been updated.

You can now integrate with an .

Follow these steps to install a new connector:

Export the following environment variables.

APONO_CONNECTOR_ID=<A_UNIQUE_CONNECTOR_NAME>
APONO_TOKEN=<APONO_TOKEN>
SUBSCRIPTION_ID=<AZURE_SUBSCRIPTION_ID>
RESOURCE_GROUP_NAME=<AZURE_RESOURCE_GROUP_NAME>

Connect-AzAccount

Set the REGION environment variable.

$REGION=$(Get-AzResourceGroup -Name $RESOURCE_GROUP_NAME).Location

Run the following command to deploy the connector on your ACI.

$port = New-AzContainerInstancePortObject -Port 80 -Protocol TCP

$env_var1 = New-AzContainerInstanceEnvironmentVariableObject -Name "APONO_CONNECTOR_ID" -Value $APONO_CONNECTOR_ID

$env_var2 = New-AzContainerInstanceEnvironmentVariableObject -Name "APONO_TOKEN" -Value $APONO_TOKEN

$env_var3 = New-AzContainerInstanceEnvironmentVariableObject -Name "APONO_URL" -Value "api.apono.io"

$jsonValue = @{
    cloud_provider = "AZURE"
    subscription_id = $SUBSCRIPTION_ID
    resource_group = $RESOURCE_GROUP_NAME
    region = $REGION
    is_azure_admin = $true
} | ConvertTo-Json -Compress

$env_var4 = New-AzContainerInstanceEnvironmentVariableObject -Name "CONNECTOR_METADATA" -Value $jsonValue

$container = New-AzContainerInstanceObject -Image registry.apono.io/apono-connector:v1.6.7 -Name $APONO_CONNECTOR_ID -Port @($port) -EnvironmentVariable @($env_var1, $env_var2, $env_var3, $env_var4) -RequestCpu 1 -RequestMemoryInGb 1.5 

$imageRegistryCredential = New-AzContainerGroupImageRegistryCredentialObject -Server "registry.apono.io" -Username "apono" -Password (ConvertTo-SecureString $APONO_TOKEN -AsPlainText -Force)

$PRINCIPAL_ID=$(New-AzContainerGroup -SubscriptionId $SUBSCRIPTION_ID -ResourceGroupName $RESOURCE_GROUP_NAME -Name $APONO_CONNECTOR_ID -Container $container -OsType Linux -ImageRegistryCredential $imageRegistryCredential -Location $REGION -IdentityType "SystemAssigned").IdentityPrincipalId

Add the User Access Administrator role to the connector in the subscription scope.

New-AzRoleAssignment -ObjectId $PRINCIPAL_ID -ObjectType "ServicePrincipal" -RoleDefinitionName "User Access Administrator" -Scope /subscriptions/$SUBSCRIPTION_ID

For Azure AD, add the Director Readers role to the connector. For Azure AD Groups, add the Groups Administrator and Privileged Role Administrator roles.

$payload = @{
    principalId = $PRINCIPAL_ID
    roleDefinitionId = "88d8e3e3-8f55-4a1e-953a-9b9898b8876b"
    directoryScopeId = "/"
} | ConvertTo-Json -Depth 3

Invoke-AzRestMethod -Method POST -Uri https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments -Payload $payload

# First role assignment
$payload1 = @{
    principalId = $PRINCIPAL_ID
    roleDefinitionId = "fdd7a751-b60b-444a-984c-02652fe8fa1c"
    directoryScopeId = "/"
} | ConvertTo-Json -Depth 3

Invoke-AzRestMethod -Method POST -Uri https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments -Payload $payload1

# Second role assignment
$payload2 = @{
    principalId = $PRINCIPAL_ID
    roleDefinitionId = "e8611ab8-c189-46e8-94e1-60213ab1f814"
    directoryScopeId = "/"
} | ConvertTo-Json -Depth 3

Invoke-AzRestMethod -Method POST -Uri https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments -Payload $payload2

On the page, verify that the connector has been updated.

You can now create integrate with an .