Connecting Azure Resources

Azure Resources integration enables AWS DevOps Agent to discover and investigate resources in your Azure subscriptions during incident investigations. The agent uses Azure Resource Graph for resource discovery and can access metrics, logs, and configuration data across your Azure environment.

This integration follows a two-step process: register Azure at the AWS account level, then associate specific Azure subscriptions with individual Agent Spaces.

Prerequisites

Before connecting Azure Resources, ensure you have:

Registering Azure Resources via Admin Consent

The Admin Consent method uses a consent-based flow with the AWS DevOps Agent managed application.

Step 1: Start the registration

Step 2: Complete Admin Consent

Step 3: Complete user authorization

Step 4: Assign roles

See Assigning Azure roles below. Search for AWS DevOps Agent when selecting members.

Registering Azure Resources via App Registration

The App Registration method uses your own Entra application with federated identity credentials.

Step 1: Start the registration

Step 2: Create and configure your Entra application

Follow the instructions displayed in the console to:

Step 3: Provide registration details

Fill in the registration form with:

Step 4: Create the IAM role

An IAM role will be automatically created when you submit the registration through the console. It permits AWS DevOps Agent to assume credentials and invoke sts:GetWebIdentityToken.

Step 5: Assign roles

See Assigning Azure roles below. Search for the Entra application you created when selecting members.

Step 6: Complete the registration

Assigning Azure roles

After registration, grant the application read access to your Azure subscription. This step is the same for both the Admin Consent and App Registration methods.

AKS access setup (optional)

Step 1: Azure Resource Manager (ARM) level access

Assign Azure Kubernetes Service Cluster User Role to the application.

In the Azure Portal, go to Subscriptions → select subscription → Access Control (IAM) → Add role assignment → select Azure Kubernetes Service Cluster User Role → assign to the application (either AWS DevOps Agent for Admin Consent, or your own Entra application for App Registration).

This covers all AKS clusters in the subscription. To scope to specific clusters, assign at the resource group or individual cluster level instead.

Step 2: Kubernetes API access

Choose one option based on your cluster's authentication configuration:

Option A: Azure Role-Based Access Control (RBAC) for Kubernetes (recommended)

This covers all AKS clusters in the subscription.

Option B: Azure Active Directory (Azure AD) + Kubernetes RBAC

Use this if your cluster already uses the default Azure AD authentication configuration and you prefer not to enable Azure RBAC. This requires per-cluster kubectl setup.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: devops-agent-reader
rules:
  - apiGroups: [""]
    resources: ["namespaces", "pods", "pods/log", "services", "events", "nodes"]
    verbs: ["get", "list"]
  - apiGroups: ["apps"]
    resources: ["deployments", "replicasets", "statefulsets", "daemonsets"]
    verbs: ["get", "list"]
  - apiGroups: ["metrics.k8s.io"]
    resources: ["pods", "nodes"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: devops-agent-reader-binding
subjects:
  - kind: User
    name: "<SERVICE_PRINCIPAL_OBJECT_ID>"
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: devops-agent-reader
  apiGroup: rbac.authorization.k8s.io

az aks get-credentials --resource-group <rg> --name <cluster-name>
kubectl apply -f devops-agent-reader.yaml

Least-privileged custom role (optional)

For tighter access control, you can create a custom Azure role scoped to only the resource providers AWS DevOps Agent uses, instead of the broad Reader role:

{
  "Name": "AWS DevOps Agent - Azure Reader",
  "Description": "Least-privilege read-only access for AWS DevOps Agent incident investigations.",
  "Actions": [
    "Microsoft.AlertsManagement/*/read",
    "Microsoft.Compute/*/read",
    "Microsoft.ContainerRegistry/*/read",
    "Microsoft.ContainerService/*/read",
    "Microsoft.ContainerService/managedClusters/commandResults/read",
    "Microsoft.DocumentDB/*/read",
    "Microsoft.Insights/*/read",
    "Microsoft.KeyVault/vaults/read",
    "Microsoft.ManagedIdentity/*/read",
    "Microsoft.Monitor/*/read",
    "Microsoft.Network/*/read",
    "Microsoft.OperationalInsights/*/read",
    "Microsoft.ResourceGraph/resources/read",
    "Microsoft.ResourceHealth/*/read",
    "Microsoft.Resources/*/read",
    "Microsoft.Sql/*/read",
    "Microsoft.Storage/*/read",
    "Microsoft.Web/*/read"
  ],
  "NotActions": [],
  "DataActions": [],
  "NotDataActions": [],
  "AssignableScopes": [
    "/subscriptions/{your-subscription-id}"
  ]
}

Associating a subscription with an Agent Space

After registering Azure at the account level, associate specific subscriptions with your Agent Spaces:

You can associate multiple subscriptions with the same Agent Space to give the agent visibility across your Azure environment.

Managing Azure Resources connections