Azure Cost and Usage Integration
Prerequisites
These steps are specifically for the Azure Cost and Usage integration. This integration currently requires approval from SHI in advance.
To perform the following steps, the user executing them must have:
- Application Administrator role at the scope where the role assignment is being made (in this case, the root scope /) to assign roles to the service principal (Step 3)
- An Azure CLI environment; we recommend using the Cloud Shell available in the Azure Portal to run the az cli commands
Permissions Required
We request the following permissions to be assigned to our application:
Role | Scope | Purpose |
|---|---|---|
Root Tenant Scope | Cost Management Contributor at the Root Tenant Scope
Note: While Cost Management Contributor also has access to Create/Update/Delete Budgets, that is not the purpose of this application and those permissions will not be used. | |
Designated Storage Account | Storage Account Contributor for a single Storage Account created for Cost & Usage Data Exports A storage account specifically created for cost & usage exports will be managed by our application, including configuring the storage retention policy to keep data storage costs minimal. Currently we use hot storage for 7 days, cold storage for 30 days, then deletion. |
This storage account must be dedicated for our use, do NOT use this storage account for any other purpose, as our retention policies will apply to those files.
Step-by-Step Instructions
You will require access to both the Azure Portal and the Azure CLI to execute these commands.
1. Create a Storage Account
Create a Storage Account inside your root tenant - this will be used for the data exports. Copy the storage account name as you'll need it for a later step.
We require this to be a new storage account, as the roles required to manage the creation of data exports and create file lifecycle policy will give full access to this storage account.
2. Validate your Current Tenant
From the Azure Portal Shell (bash), run the following command to validate you're currently active under the tenant you intend to grant access for:
az account list --query "[?isDefault].{tenantId: tenantId, name: name}"Keep track of this tenantId for future steps, as well as providing this data back to us.
3. Create a Service Principal for Our Application
Run the following command to create a service principal for our application using its application ID:
az ad sp create --id 6b2205ef-191b-4e4a-b7dd-31a0059f8abeExplanation: This command creates a service principal associated with our application. A service principal is an identity used by applications or services to access Azure resources. By creating this, you establish an identity for our app in your Azure Active Directory (Azure AD).
- Application ID: 6b2205ef-191b-4e4a-b7dd-31a0059f8abe is the Application ID for Catalyst by SHI - Azure Cost and Usage
4. Grant the Service Principal access to your new Storage Account
SCOPE=`az storage account show --name <storage account name> --query "id" | xargs`
echo $SCOPEExample:
$ SCOPE=`az storage account show --name <storage account name> --query "id" | xargs`
$ echo $SCOPE
/subscriptions/XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mynewstorageaccountSave the output provided! We'll need that information in order to configure and retrieve cost and usage data. If you don't see that string, make sure your az command is surrounded by backticks (`) and not quotes.
Now run:
az role assignment create --assignee 6b2205ef-191b-4e4a-b7dd-31a0059f8abe --role 'Storage Account Contributor' --scope $SCOPEThis will assign the Storage Account Contributor role to that specific storage account and only that storage account.
5. Grant the Service Principal access to the Cost Management Contributor Role
az role assignment create --assignee 6b2205ef-191b-4e4a-b7dd-31a0059f8abe --role 'Cost Management Contributor' --scope /Cost Management Contributor: The purpose of this role is to allow us to create data exports for subscriptions. By providing this level of access, it reduces the amount of initial setup, and removes the need for ongoing maintenance per subscription - if you add a new subscription to your tenant, we will detect that subscription and start collecting Cost & Usage data for it.
6. Provide the "SCOPE" with storage account information back to your SHI Expert
Copy the value you saved above in step 4:
/subscriptions/XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mynewstorageaccount
And provide it back to your SHI Expert. There are no secret values or passwords in this string, so it's safe to pass via Email or other methods.