Managed identities concept in Azure - Mini Project: Build & Apply

Using Managed Identities to Access Azure Storage

📖 Scenario: You are setting up an Azure virtual machine (VM) that needs to securely access an Azure Storage account without using passwords or keys.Managed identities allow the VM to authenticate to Azure services safely.

🎯 Goal: Build an Azure resource configuration that creates a VM with a system-assigned managed identity and grants it read access to a storage account.

📋 What You'll Learn

Create an Azure Storage account resource named storage_account.

Create an Azure Virtual Machine resource named vm with a system-assigned managed identity.

Create a role assignment that grants the VM's managed identity the Storage Blob Data Reader role on the storage account.

💡 Why This Matters

🌍 Real World

Managed identities help secure Azure resources by avoiding manual credential management. This project shows how to set up a VM that can access storage securely.

💼 Career

Understanding managed identities is essential for cloud engineers and architects to build secure and maintainable Azure infrastructure.

1

Create the Azure Storage Account resource

Create an Azure Storage account resource named storage_account with the SKU Standard_LRS and kind StorageV2.

Azure

# Your code here to create storage_account resource

Hint

Use resource "azurerm_storage_account" "storage_account" { ... } with the specified properties.

2

Create the Azure Virtual Machine with system-assigned managed identity

Add an Azure Virtual Machine resource named vm with a system-assigned managed identity enabled by setting identity { type = "SystemAssigned" }.

Azure

resource "azurerm_storage_account" "storage_account" {
  name                     = "examplestorageacct"
  resource_group_name      = "example-resources"
  location                 = "eastus"
  account_tier             = "Standard"
  account_replication_type = "LRS"
  kind                     = "StorageV2"
}

# Your code here to create vm resource with system-assigned identity

Hint

Use identity { type = "SystemAssigned" } inside the VM resource block.

3

Create the role assignment for the VM's managed identity

Create an azurerm_role_assignment resource named vm_storage_role that assigns the Storage Blob Data Reader role to the VM's managed identity on the storage account. Use principal_id = azurerm_linux_virtual_machine.vm.identity.principal_id and scope = azurerm_storage_account.storage_account.id.

Azure

resource "azurerm_storage_account" "storage_account" {
  name                     = "examplestorageacct"
  resource_group_name      = "example-resources"
  location                 = "eastus"
  account_tier             = "Standard"
  account_replication_type = "LRS"
  kind                     = "StorageV2"
}

resource "azurerm_linux_virtual_machine" "vm" {
  name                = "example-vm"
  resource_group_name = "example-resources"
  location            = "eastus"
  size                = "Standard_DS1_v2"
  admin_username      = "adminuser"
  network_interface_ids = ["/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-resources/providers/Microsoft.Network/networkInterfaces/example-nic"]
  admin_ssh_key {
    username   = "adminuser"
    public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC..."
  }

  identity {
    type = "SystemAssigned"
  }
}

# Your code here to create role assignment for vm's managed identity

Hint

Use azurerm_role_assignment with principal_id from the VM's managed identity and scope set to the storage account's ID.

4

Complete the configuration with resource group and network interface references

Add the resource_group_name variable set to "example-resources" and define a network interface resource named example-nic with the same resource group and location. Reference this network interface ID in the VM's network_interface_ids property.

Azure

resource "azurerm_storage_account" "storage_account" {
  name                     = "examplestorageacct"
  resource_group_name      = "example-resources"
  location                 = "eastus"
  account_tier             = "Standard"
  account_replication_type = "LRS"
  kind                     = "StorageV2"
}

resource "azurerm_network_interface" "example-nic" {
  # Your code here to create network interface
}

resource "azurerm_linux_virtual_machine" "vm" {
  name                = "example-vm"
  resource_group_name = "example-resources"
  location            = "eastus"
  size                = "Standard_DS1_v2"
  admin_username      = "adminuser"
  network_interface_ids = [azurerm_network_interface.example-nic.id]
  admin_ssh_key {
    username   = "adminuser"
    public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC..."
  }

  identity {
    type = "SystemAssigned"
  }
}

resource "azurerm_role_assignment" "vm_storage_role" {
  scope                = azurerm_storage_account.storage_account.id
  role_definition_name = "Storage Blob Data Reader"
  principal_id         = azurerm_linux_virtual_machine.vm.identity.principal_id
}

Hint

Define a resource group variable and create a network interface resource. Reference the NIC ID in the VM's network_interface_ids.

Practice

1. What is the main purpose of managed identities in Azure?

easy

A. Allow resources to access other services securely without passwords

B. Store user passwords for Azure services

C. Create virtual machines automatically

D. Manage network traffic between resources

Solution

1. Step 1: Understand managed identities purpose

   Managed identities provide a way for Azure resources to authenticate to other services without needing passwords.

2. Step 2: Compare options

   Only Allow resources to access other services securely without passwords correctly describes this purpose. The other options describe unrelated functions.

3. Final Answer:

   Allow resources to access other services securely without passwords -> Option A

4. Quick Check:

   Managed identities = secure access without passwords [OK]

Hint: Managed identities remove password use for resource access [OK]

Common Mistakes:

• Thinking managed identities store passwords
• Confusing managed identities with VM creation
• Assuming managed identities manage network traffic

2. Which syntax correctly enables a system-assigned managed identity in an Azure resource configuration?

easy

A. "managedIdentity": "system"

B. "identity": { "enabled": true }

C. "identity": { "type": "SystemAssigned" }

D. "identity": "system-assigned"

Solution

1. Step 1: Recall correct identity block syntax

   Azure resource config uses an "identity" block with a "type" property set to "SystemAssigned" to enable system-assigned managed identity.

2. Step 2: Validate options

   "identity": { "type": "SystemAssigned" } matches the correct JSON syntax. The other options do not follow Azure's expected configuration format.

3. Final Answer:

   "identity": { "type": "SystemAssigned" } -> Option C

4. Quick Check:

   Correct identity block syntax = "identity": { "type": "SystemAssigned" } [OK]

Hint: Use "identity": { "type": "SystemAssigned" } to enable system identity [OK]

Common Mistakes:

• Using incorrect property names like "enabled"
• Omitting the "type" key
• Using wrong string values like "system" or "system-assigned"

3. Given this Azure resource configuration snippet:

{
  "identity": { "type": "UserAssigned", "userAssignedIdentities": { "/subscriptions/123/resourceGroups/rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/identity1": {} } }
}

What does this configuration do?

medium

A. Enables a system-assigned managed identity for the resource

B. Assigns a user-assigned managed identity named 'identity1' to the resource

C. Disables all managed identities for the resource

D. Creates a new user-assigned identity named 'identity1'

Solution

1. Step 1: Analyze the identity type

   The "type" is "UserAssigned", meaning the resource uses an existing user-assigned identity.

2. Step 2: Check the userAssignedIdentities property

   The resource assigns the existing identity at the given resource ID path, named 'identity1'. It does not create a new identity.

3. Final Answer:

   Assigns a user-assigned managed identity named 'identity1' to the resource -> Option B

4. Quick Check:

   UserAssigned with identity path = Assigns a user-assigned managed identity named 'identity1' to the resource [OK]

Hint: UserAssigned type with identity path means assign existing identity [OK]

Common Mistakes:

• Confusing system-assigned with user-assigned identity
• Thinking the identity is created, not assigned
• Ignoring the userAssignedIdentities property

4. You wrote this Azure resource config to enable a system-assigned managed identity:

{
  "identity": { "type": "systemassigned" }
}

Why does this configuration fail to enable the identity?

medium

A. The resource group name is missing

B. The identity block is missing the "enabled" property

C. User-assigned identities require a different syntax

D. The type value is case-sensitive and must be "SystemAssigned"

Solution

1. Step 1: Check the type value case

   Azure expects "SystemAssigned" with capital S and A. "systemassigned" is invalid due to case sensitivity.

2. Step 2: Validate other options

   Stating that the identity block is missing the "enabled" property is incorrect because "enabled" is not required. User-assigned identities require a different syntax, but this config is for system-assigned. The resource group name is unrelated to this error.

3. Final Answer:

   The type value is case-sensitive and must be "SystemAssigned" -> Option D

4. Quick Check:

   Case-sensitive type value = The type value is case-sensitive and must be "SystemAssigned" [OK]

Hint: Check capitalization of "SystemAssigned" exactly [OK]

Common Mistakes:

• Ignoring case sensitivity in type value
• Adding unnecessary properties like "enabled"
• Confusing system-assigned with user-assigned syntax

5. You want two Azure virtual machines to share the same managed identity to access a database securely. Which approach should you use?

hard

A. Create a user-assigned managed identity and assign it to both VMs

B. Assign a system-assigned managed identity to each VM separately

C. Use a shared password stored in Azure Key Vault

D. Enable managed identity only on one VM and share its credentials manually

Solution

1. Step 1: Understand identity sharing options

   System-assigned identities are unique per resource and cannot be shared.

2. Step 2: Identify user-assigned identity use

   User-assigned managed identities can be created once and assigned to multiple resources, allowing sharing.

3. Step 3: Evaluate other options

   Using shared passwords or manual credential sharing is insecure and against best practices.

4. Final Answer:

   Create a user-assigned managed identity and assign it to both VMs -> Option A

5. Quick Check:

   User-assigned identity allows sharing = Create a user-assigned managed identity and assign it to both VMs [OK]

Hint: Use user-assigned identity to share across multiple resources [OK]

Common Mistakes:

• Trying to share system-assigned identities
• Using passwords instead of managed identities
• Manually sharing credentials insecurely