->`LRS` and `Standard_LRS` are meant as literal "LRS" or "Standard_LRS" and not as variables.
@ -178,21 +180,29 @@ Make sure that `GROUPNAME` and `LOCATION` are the same as above. Also, ensure th
An application represents a way to authorize access to the Azure API. Note that you will need to specify a URL for your application (this is intended to be used for OAuth callbacks) but these do not actually need to be valid URLs.
First pick APPNAME, APPURL and PASSWORD:
```shell
APPNAME=packer.test
APPURL=packer.test
PASSWORD=xxx
```
Password is your `client_secret` and can be anything you like. I recommend using ```openssl rand -base64 24```.
``` shell
$ azure ad app create \
-n APPNAME \
-i APPURL \
--home-page APPURL \
-p PASSWORD
-n $APPNAME \
-i $APPURL \
--home-page $APPURL \
-p $PASSWORD
```
Python:
```shell
az ad app create --display-name APPNAME --identifier-uris APPURL --homepage APPURL --password PASSWORD
$ az ad app create --display-name $APPNAME --identifier-uris $APPURL --homepage $APPURL --password $PASSWORD
```
Password is your `client_secret` and can be anything you like. I recommend using `openssl rand -base64 24`.
### Create a Service Principal
@ -201,18 +211,21 @@ You cannot directly grant permissions to an application. Instead, you create a s
First, get the `APPID` for the application we just created.
$ azure ad app show --json --search $APPNAME | jq '.[0] | .appId'
$ APPID=$(!!)
# ...
$ azure ad sp create --applicationId APPID
$ azure ad sp create --applicationId $APPID
```
Python:
```shell
$ id=$(az ad app list | jq -r '.[] | select(.displayName == "Packer") | .appId')
$ az ad sp create --id "$id"
$ az ad app list | jq -r ".[] | select(.displayName == \"${APPNAME}\") | .appId"
$ APPID=$(!!)
#...
$ az ad sp create --id $APPID
```
### Grant Permissions to Your Application
@ -221,7 +234,7 @@ Finally, we will associate the proper permissions with our application's service
``` shell
$ azure role assignment create \
--spn APPURL \
--spn $APPURL \
-o "Owner" \
-c /subscriptions/SUBSCRIPTIONID
```
@ -230,14 +243,13 @@ Python:
```shell
# NOTE: Trying to assign the role to the service principal by name directly yields a HTTP 400 error. See: https://github.com/Azure/azure-cli/issues/4911
$ az role assignment create --assignee "$(az ad sp list | jq -r '.[] | select(.displayName == "APPNAME") | .objectId')" --role Owner
$ az role assignment create --assignee "$(az ad sp list | jq -r ".[] | select(.displayName == \"$APPNAME\") | .objectId")" --role Owner
```
There are a lot of pre-defined roles and you can define your own with more granular permissions, though this is out of scope. You can see a list of pre-configured roles via: