Azure Data Source

Edit online

This data source establishes a connection to Microsoft Azure for extracting assets such as virtual machines or load balancers.

Connection configuration

Edit online

The Data Source requires an App registration to be configured. From this application, the Data Source needs the following parameters:

  • Client App ID - The application (client) ID
  • Tenant - The tenant ID of the application
  • Password - The key/secret of the application
  • Subscription ID - The Azure subscription ID (optional - if not provided, all accessible subscriptions will be queried)
  • Azure Environment - The Azure region

The official documentation of Azure details how to build an according application with step by step instructions. If the cloud infrastructure is distributed over several regions, a Microsoft Azure Data Source must be added for each region.

Permission configuration

Edit online

As a prerequisite to configure an Azure importer Txture platform needs to be able to access Azure based resources as part of its data collection process. For this typically a read-only access policy is used together with an API-only access credential.

To configure an Azure data source in Txture you need the following credentials:

  • Application (client) ID
  • Directory (tenant) ID
  • Password (secret value)
  • Subcription IDs (optional)

Create Service Principal with the Azure CLI (easy step)

Edit online

Please follow the Azure documentation for creating a service principal and follow the role assignment steps.

Example command: az ad sp create-for-rbac --name txture-import --role Reader

You may want to limit the account to certain subscriptions or resource groups by using --scopes:

az ad sp create-for-rbac --name txture-import --scopes /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/resourceGroup1 --role Reader

Create Service Principal with the Azure Portal

Edit online

Please follow these steps to create access credentials that are required as part of the data source configuration in Txture:

  1. Logon to your Microsoft Azure Portal and select the Azure Active Directory service and go to App registration (or directly via this link). Create new registration in Azure AD App registration
  2. Click on New registration and setup new app registration. Use "Accounts in this organizational directory only" as the supported account type.
  3. Click on your new registration. You should now see the Application (client) ID and the Directory (tenant) ID you need to configure your Azure data source in Txture. Retrieve Application (client) ID and Directory (tenant) ID
  4. Next we need to create a Client Secret. To do so, click on certificate and secret link in your registration. Create new client secret - step 1
  5. In the client secret section, click on New client secret and setup a new secret. Select an appropriate period for which the secret should be valid. Create new client secret - step 2
  6. After having created your new secret, the column Value represents your Password (secret value). Copy the secret value to you data source in Txture. It will be visible in Azure only during the setup process. Value is your password
  7. Finally, we can add Subcription IDs optionally to restrict access. You find your subscriptions in Azure Home --> Subscriptions (or directly via this link). Each subscription ID represents a separate billing in Azure. For each billing you have your Azure resources that are then imported into Txture. If no subscription IDs are added Txture will request resources for all accessible subscriptions.
Warning:

Make sure your Azure service principal has the permissions to read your subscriptions (Azure Documentation).

Warning:

When you do not assign Role Reader to the service principal, then be sure that you add the permission:

  • Microsoft.ApiManagement/service/subscriptions/read, if you do not add Subscription IDs to datasource.

Importable types and permissions

Edit online

The Azure importer has a fixed schema with the following asset types and required permissions:

Asset-Type Required Permissions
Virtual Machine Microsoft.Compute/virtualMachines/read, Microsoft.Network/networkInterfaces/read and Microsoft.Network/publicIPAddresses/read
App Service microsoft.web/webappstacks/read
Application Gateway Microsoft.Network/applicationGateways/read
Azure Subscription Microsoft.ApiManagement/service/subscriptions/read
Bestion Microsoft.Network/bastionHosts/read
Container Registry Microsoft.ContainerRegistry/registries/read
Disk Microsoft.Compute/disks/read
DNS Microsoft.Network/dnszones/read and Microsoft.Network/dnszones/recordsets/read
Event Hub Microsoft.EventHub/namespaces/read
Express Route Circuit Microsoft.Network/expressRouteCrossConnections/read
Firewall Microsoft.Network/azurefirewalls/read
Function App microsoft.web/functionappstacks/read
Image Microsoft.Compute/galleries/read, Microsoft.Compute/galleries/images/read and Microsoft.Compute/galleries/images/versions/read
Kubernetes Cluster Microsoft.ContainerService/managedClusters/read and Microsoft.Resources/subscriptions/resourcegroups/read
Kubernetes VM Microsoft.ContainerService/managedClusters/agentPools and Microsoft.Resources/subscriptions/resourcegroups/read
Load Balancer Microsoft.Network/loadBalancers/read
Local Network Gateway Microsoft.Network/localnetworkgateways/read
Network Microsoft.Network/virtualNetworks/read
Network Interface Microsoft.Network/networkInterfaces/read
Private DNS Microsoft.Network/privateDnsZones/read and Microsoft.Network/privateDnsZones/recordsets/read
Public IP Address Microsoft.Network/publicIPAddresses/read
Redis Cache Microsoft.Cache/redis/read
Scalable Compute Group Microsoft.Compute/virtualMachineScaleSets/read
Service Fabric Cluster Microsoft.ServiceFabric/clusters/read
Service Fabric Virtual Machine Microsoft.Compute/virtualMachineScaleSets/read and Microsoft.Compute/virtualMachineScaleSets/virtualMachines
SQL Database Microsoft.Sql/servers/databases/read
SQL Elastic Pool Database Microsoft.Sql/servers/elasticPools/databases
SQL Server Microsoft.Sql/servers/read
Subnet Microsoft.Network/virtualNetworks/subnets/read
Storage Account Microsoft.ClassicStorage/storageAccounts/read
Virtual Network Gateway Microsoft.Network/virtualNetworkGateways/read
Virtual Private Network Gateway Microsoft.Network/vpnGateways/read
Virtual WAN Microsoft.Network/virtualWans/read
Web Application Firewall Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/read
Note: If you want to import usage data for specific asset-types, please add the following permission:

Configuring memory usage metrics for Virtual Machines

Edit online

To receive insights of RAM usage on your virtual machines (VMs), follow these steps:

  1. Access Your VM in Azure Console a. Open the Azure portal and navigate to your VM. b. From the Monitor dropdown menu, select Insights:

  2. Enable Insights for Your VM a. Click Enable Insights and wait for the process to complete.

  3. Verify Data Collection a. Once Insights are enabled, go to the Azure Monitor section at the top of the page. This will open the Insights overview:
  4. Check Performance Metrics a. Navigate to the Performance tab to ensure data collection has started and that Insights are active:

By completing these steps, you will enable memory usage insights for your virtual machine.