Azure / Azure/DevOps-Self-Hosted

Deployment in locked down environment

Open
#30 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PowerShell
Stars
74
Forks
26
Avg merge
10d 9h
Merged PRs (30d)
1

Description

**Describe the bug**
I'm trying to create the images with Azure Image Builder with the following guide [Creating images with the Azure Image Builder](https://github.com/Azure/DevOps-Self-Hosted/wiki/Creating%20images%20with%20the%20Azure%20Image%20Builder) in an Azure environment 'locked' down with Azure Policies. One of the Azure Policies prohibits the deployment of Azure Storage Accounts with a public network access. Public network access must be disabled for PaaS services.

To conform to these Azure Policies I configured the Azure environment as follows.
1. [Azure VM Image Builder networking using an existing VNet](https://learn.microsoft.com/en-us/azure/virtual-machines/linux/image-builder-networking#deploy-using-an-existing-vnet)
2. Azure Storage Account being used by Azure VM Image Builder with virtual network rule to allow access from VNet Subnet (configured in Azure VM Image Builder)
3. During pipeline deployment of DevOps-Self-Hosted - Create images with Azure Image Builder adding IP address of Microsoft Hosted Build Agent to allowed IP addresses on the Firewall of the Azure Storage Account used by Image Builder. This enables the upload of the files to storage account.

Even after above configurations I get the following error message during the Deploy Resources Azure DevOps Job with the task name "Deploy [imageTemplate.deploy.bicep] via service connection [Service Connection]"

- Not authorized to access the resource: https://\.blob.core.windows.net/aibscripts/LinuxInstallPowerShell.sh?[REDACTED] Please check the user assigned identity has the correct permissions. For more details, go to https://aka.ms/azvmimagebuilderts. (Code:Unauthorized)

I checked the permissions of the deployed MSI (aibMSI) and it has Contributor permissions on the scope of the Azure Subscription.

**High Level Architecture**

Resource Group where the Azure Image Builder Resources are being deployed:
![rg1](https://github.com/Azure/DevOps-Self-Hosted/assets/2125385/4e1157c1-69f2-4fc0-b5a9-aa754397a294)

Resource Group with VNet and Subnet:
![rg2](https://github.com/Azure/DevOps-Self-Hosted/assets/2125385/788fa9aa-8e93-48d7-83a0-0425649f4089)

What do I need to do to get this resolved?

Stefan [MSFT]

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.