PluginVersion 3.0.0

Azure

Builds and runs a team's own Azure resources, signed in as the person: resource groups, Bicep and ARM deployments checked by what-if first, registry builds, Azure SQL databases and SQL, storage blobs, tables and queues, Key Vault, Container Apps with their logs and custom domains, DNS zones, budgets and role assignments for its managed identities.

Download azure-plugin-3.0.0.zip Source

6.5 MB. Check the download against its SHA-256 below.

What it contains

Settings: Subscription ID, Regions, Mode, Allow deletes, Shared SQL servers, Shared container registries, Shared registries (old name), Monthly budget, Budget alert emails, Resource group name prefix
Keys: App secret 1, App secret 2, App secret 3, App secret 4, App secret 5, App secret 6, App secret 7, App secret 8
Sign-ins: Microsoft, App secrets
Events: What a changing command would do, or what a deployment's what-if found: counts by change type and any refusals. A change was made in apply mode. One Azure resource a command created, changed or deleted in apply mode, beside that command's applied summary; at most 25 a command, and past that the summary alone covers the rest. A command was refused: outside what the team owns, a role or principal not allowed, a delete with allowDelete off, a path outside the team's folders, a secret outside Key Vault and this member's app secret connections, or bad arguments.
Skills: plugin-azure-plugin

Documentation

What it does

Key Vault and the apps' logs are reached through Azure management, so the Microsoft sign-in asks for Azure management, Azure SQL and Azure Storage only.

It changes only what it created, which carries the tags yawble-owner and yawble-plugin, plus the shared SQL servers and registries a person lists. It acts with the person's own Azure rights, never more. What-if by default: every changing command says what it would do and changes nothing until a person sets mode to apply. It never reads a key, a connection string or a Key Vault secret's value, and no token reaches its output; an app's secret comes from Key Vault or from an API-key connection bound to its appSecrets slot, set in Team settings -> Connections, and its value is never written out.

What it needs

Accounts you connect

Microsoft required

a Microsoft account

The Microsoft account that signs in to Azure; the member acts with that account's own Azure rights.

App secrets optional

an Apikey account

The secrets an app made by containerapp create reads as secret environment variables: API-key connections (preset Other), each field one secret by the name the team refers to it with, through secret=<NAME>=<field name>. Added and assigned to this team in Team settings -> Connections; bind as many as needed. A value is never shown again or written out.

Keys set on the Host

A plugin names its secret fields; you choose the key each one reads when you hire it.

appSecret1required: Moved: from 3.0.0 the app secrets are held by the API-key connections bound to the appSecrets slot, set in Team settings -> Connections. Declared only so an update carries an existing value over into that slot, as a connection field still named appSecret1, so secret=<NAME>=appSecret1 keeps working.
appSecret2required: Moved: from 3.0.0 the app secrets are held by the API-key connections bound to the appSecrets slot, set in Team settings -> Connections. Declared only so an update carries an existing value over into that slot, as a connection field still named appSecret2, so secret=<NAME>=appSecret2 keeps working.
appSecret3required: Moved: from 3.0.0 the app secrets are held by the API-key connections bound to the appSecrets slot, set in Team settings -> Connections. Declared only so an update carries an existing value over into that slot, as a connection field still named appSecret3, so secret=<NAME>=appSecret3 keeps working.
appSecret4required: Moved: from 3.0.0 the app secrets are held by the API-key connections bound to the appSecrets slot, set in Team settings -> Connections. Declared only so an update carries an existing value over into that slot, as a connection field still named appSecret4, so secret=<NAME>=appSecret4 keeps working.
appSecret5required: Moved: from 3.0.0 the app secrets are held by the API-key connections bound to the appSecrets slot, set in Team settings -> Connections. Declared only so an update carries an existing value over into that slot, as a connection field still named appSecret5, so secret=<NAME>=appSecret5 keeps working.
appSecret6required: Moved: from 3.0.0 the app secrets are held by the API-key connections bound to the appSecrets slot, set in Team settings -> Connections. Declared only so an update carries an existing value over into that slot, as a connection field still named appSecret6, so secret=<NAME>=appSecret6 keeps working.
appSecret7required: Moved: from 3.0.0 the app secrets are held by the API-key connections bound to the appSecrets slot, set in Team settings -> Connections. Declared only so an update carries an existing value over into that slot, as a connection field still named appSecret7, so secret=<NAME>=appSecret7 keeps working.
appSecret8required: Moved: from 3.0.0 the app secrets are held by the API-key connections bound to the appSecrets slot, set in Team settings -> Connections. Declared only so an update carries an existing value over into that slot, as a connection field still named appSecret8, so secret=<NAME>=appSecret8 keeps working.

Settings you choose

subscriptionoptional: The id of the Azure subscription this member works in, such as 00000000-0000-0000-0000-000000000000; run setup after signing in and it lists the subscriptions your account can read.
regionsoptional: The Azure regions resource groups may be created in, chosen from the list; eastus2 unless a person picks others.
modeoptional: whatif answers what each changing command would do and changes nothing in Azure; apply makes the changes.
allowDeleteoptional: Off: every delete is refused, in whatif and apply; on: the member may delete what its team owns.
sharedSqlServersoptional: Existing SQL servers, by name such as my-sql-server, on which the member may create its own databases; it never changes the server or another database on it.
sharedContainerRegistriesoptional: Existing Azure Container Registries (ACR), by name such as myregistry, that the member may build and push images to and grant pull rights on to its own managed identities; a Container App's image is pulled from one of them.
sharedRegistriesoptional: The old name of sharedContainerRegistries, still read; move its registries to sharedContainerRegistries.
monthlyBudgetoptional: A monthly budget, in the subscription's currency, put on every resource group the member creates, with alerts at 80% and 100%; 0 means no budget.
budgetEmailsoptional: The email addresses the budget alerts go to; needed when monthlyBudget is more than 0.
namePrefixoptional: Text put before the name of every resource group the member creates, such as team1-; empty by default.

Setting it up

Accounts you connect

Microsoft required

a Microsoft account

The Microsoft account that signs in to Azure; the member acts with that account's own Azure rights.

App secrets optional

an Apikey account

Settings and secrets

Subscription ID optional

No default.

The id of the Azure subscription this member works in, such as 00000000-0000-0000-0000-000000000000; run setup after signing in and it lists the subscriptions your account can read.

Regions optional

Default: eastus2

The Azure regions resource groups may be created in, chosen from the list; eastus2 unless a person picks others.

Mode optional

Default: whatif

whatif answers what each changing command would do and changes nothing in Azure; apply makes the changes.

Allow deletes optional

Default: Off

Off: every delete is refused, in whatif and apply; on: the member may delete what its team owns.

Shared SQL servers optional

No default.

Existing SQL servers, by name such as my-sql-server, on which the member may create its own databases; it never changes the server or another database on it.

Shared container registries optional

No default.

Existing Azure Container Registries (ACR), by name such as myregistry, that the member may build and push images to and grant pull rights on to its own managed identities; a Container App's image is pulled from one of them.

Shared registries (old name) optional

No default.

The old name of sharedContainerRegistries, still read; move its registries to sharedContainerRegistries.

Monthly budget optional

Default: 0

A monthly budget, in the subscription's currency, put on every resource group the member creates, with alerts at 80% and 100%; 0 means no budget.

Budget alert emails optional

No default.

The email addresses the budget alerts go to; needed when monthlyBudget is more than 0.

Resource group name prefix optional

No default.

Text put before the name of every resource group the member creates, such as team1-; empty by default.

App secret 1 secret, optional

Moved: from 3.0.0 the app secrets are held by the API-key connections bound to the appSecrets slot, set in Team settings -> Connections. Declared only so an update carries an existing value over into that slot, as a connection field still named appSecret1, so secret=<NAME>=appSecret1 keeps working.