Azure subscriptions

Give learners access to Azure subscriptions.

This guide explains how to access an Azure subscription from Instruqt.

An Azure subscription is a logical container used to provision resources in Azure. It holds the details of all your resources like virtual machines (VMs), databases, and more. When you create an Azure resource like a VM, you identify the subscription it belongs to.

— Azure documentation

Before you begin

You must have already built a track to which you can add access to an Azure subscription.

Access Azure subscriptions

It is best to add the Instruqt Cloud Client container to your track to give a learner access to an Azure subscription. Because the Instruqt Cloud Client:

• Exposes links to the Azure portal for the resources configured in the config.yml file, with the credentials required to log in.

• Includes the az CLI, pre-configured with the required credentials.

The Azure portal and the az CLI make it easy for content developers and learners to access Azure subscription resources from the sandbox.

It takes the following steps to give learners access to an Azure subscription:

1. Add an Instruqt Cloud Client container to your track.

2. Add an Azure subscription to your track.

3. Add tabs to your challenges where you want to expose the Azure portal or az CLI.

Additionally, you can use:

• A set of environment variables that are available in the az CLI.

• Azure built-in roles.

Access to Resource Providers is restricted for maintaining security and protecting tracks from abuse cases that utilize providers irrelevant to the Instruqt tracks' scope.

A resource provider is a collection of REST operations that enables functionality for an Azure service.

— Azure documentation

Below are the Resource Providers that are allowed to be used in Azure subscriptions. If you need access to an additional provider, please contact support.

Microsoft.Advisor
Microsoft.Authorization
Microsoft.Automation
Microsoft.Billing
Microsoft.Blueprint
Microsoft.ChangeAnalysis
Microsoft.ClassicSubscription
Microsoft.Compute
Microsoft.ContainerInstance
Microsoft.ContainerRegistry
Microsoft.ContainerService
Microsoft.CostManagement
Microsoft.CustomProviders
Microsoft.Features
Microsoft.GuestConfiguration
microsoft.insights
Microsoft.KeyVault
Microsoft.ManagedIdentity
Microsoft.Management
Microsoft.MarketplaceOrdering
Microsoft.Network
Microsoft.OperationalInsights
Microsoft.OperationsManagement
Microsoft.PolicyInsights
Microsoft.Portal
Microsoft.ResourceGraph
Microsoft.ResourceHealth
Microsoft.ResourceNotifications
Microsoft.Resources
Microsoft.Security
Microsoft.SerialConsole
Microsoft.Solutions
Microsoft.Sql
Microsoft.Storage
microsoft.support
Microsoft.Web

Step 1: Add an Instruqt Cloud Client container to your track

🌐 Web UI

1. Click the track where you want to add an Azure subscription to.

2. In the Sandbox section, click Edit to open the Sandbox page.

3. Click + Add a host. ↳ The Add host page opens.

4. Pick the Container host type.

5. Enter/select these values:

   Field	Value
   Hostname	cloud-client
   Image type	Choose your own
   Image	gcr.io/instruqt/cloud-client

6. Click Show optional settings. Enter these values:

   Field	Value
   Ports	80
   Shell	/bin/bash

7. Click Save host to add the container.

💻 Instruqt CLI

1. Open the file config.yml in your code editor.

2. Copy and paste the following code under the containers property:

   - name: cloud-client
     image: gcr.io/instruqt/cloud-client
     ports: [80]
     shell: /bin/bash

Step 2: Add an Azure subscription to your track

🌐 Web UI

1. Click + Add a cloud account on the Sandbox page.

2. Select the Azure provider.

3. In the Name field, enter azuresubscription.

4. In the Services field, select the services that are going to be enabled.

5. In the Regions field, select the regions that are going to be enabled.

6. In the User Roles field, specify the desired roles for the end user.

7. In the Admin Roles field, specify the desired roles for the admin user.

8. Click Save to add the Azure subscription. ↳ On the Sandbox page, you will see the new Azure subscription.

9. Click Back to track to return to the Track dashboard page.

💻 Instruqt CLI

1. Copy and paste the following code into config.yml:

   azure_subscriptions:
   - name: azuresubscription
     services: []
     regions: []
     roles: []

   ↳ Your config.yml file should be similar to this now:

   version: "3"
   containers:
   - name: cloud-client
     image: gcr.io/instruqt/cloud-client
     ports: [80]
     shell: /bin/bash
   azure_subscriptions:
   - name: azuresubscription
     services: []
     regions: []
     roles: []

In the Roles field, only provide access to services that are strictly needed to prevent abuse. See Access role for more details.

Only enabled services and regions configured by the team administrator can be selected and/or specified. See more details in Cloud services and regions

When specifying Admin Roles, an additional admin user and application will be created with the designated roles.

For setting up the cloud account in lifecycle scripts, it is recommended to use an admin user with elevated privileges. This ensures the ability to perform operations requiring higher privileges than those assigned to the end user.

Note: Admin credentials are injected exclusively into lifecycle scripts, unlike end user credentials which are exposed as environment variables on virtual machines and containers.

Step 3: Add tabs to expose the Azure portal and az CLI

🌐 Web UI

1. In the Challenges section of the Track dashboard, click Add new followed by Assignment.

2. Enter/select these values:

   Field	Value
   Tab name	Azure subscription
   URL	azure-subscription
   Description	Learn about Azure

3. Click Save.

4. Click Tabs followed by Add new tab.

5. Select the Your applications tab type.

6. Enter/select these values to set the Azure portal:

   Field	Value
   Tab name	Azure Portal
   Select your host	cloud-client
   Path	/
   Port	80

7. Click Save to add the tab.

8. Click Add new tab again.

9. Select the Terminal tab type.

10. Enter/select these values to set the gcloud CLI:

    Field	Value
    Tab name	az CLI
    Host	cloud-client

11. Click Save to add the tab.

12. Click the track name to return to the Track dashboard.

13. Click Play track and test your Azure subscription.

💻 Instruqt CLI

1. Open a terminal and move to your track directory.

2. Enter the following command to create a new challenge:

   instruqt challenge create --title "AzureSubscription"

   ↳ Instruqt CLI created a directory for the challenge. And an assignment.md file inside the challenge directory.

3. Open the assignment.md file in your code editor.

4. Copy and paste the following code into assignment.md to set the Azure portal and az CLI:

   ---
   slug: azure-challenge
   type: challenge
   title: Azure subscription
   teaser: Learn to work with an Azure subscription
   tabs:
   - title: Azure Portal
     type: service
     hostname: cloud-client
     path: /
     port: 80
   - title: az CLI
     type: terminal
     hostname: cloud-client
   difficulty: basic
   timelimit: 600
   ---

   ⇨ You can add the assignment text of your liking in Markdown after line 17.

5. Save file assignment.md.

6. Push the track to the Instruqt platform:

   instruqt track push

7. Play and test the track:

   instruqt track open

   ↳ Your browser opens, showing the Track overview page. Click Start track to play the track.

Environment variables

Adding an Azure subscription to your track also sets a list of environment variables that you can use in commands and scripts:

Environment variable	Description
INSTRUQT_AZURE_SUBSCRIPTIONS	A comma-separated list of project names that can be used to fill ${NAME} in the variables below
INSTRUQT_AZURE_SUBSCRIPTION_${NAME}_SUBSCRIPTION_NAME	The subscription display name
INSTRUQT_AZURE_SUBSCRIPTION_${NAME}_SUBSCRIPTION_ID	The subscription ID
INSTRUQT_AZURE_SUBSCRIPTION_${NAME}_USERNAME	The username that can be used to sign into the Azure portal
INSTRUQT_AZURE_SUBSCRIPTION_${NAME}_PASSWORD	The password that can be used to sign into the Azure portal
INSTRUQT_AZURE_SUBSCRIPTION_${NAME}_SPN_ID	The application ID for the service principal
INSTRUQT_AZURE_SUBSCRIPTION_${NAME}_SPN_PASSWORD	The password for the service principal
INSTRUQT_AZURE_SUBSCRIPTION_${NAME}_TENANT_ID	The tenant ID for this subscription
INSTRUQT_AZURE_SUBSCRIPTION_${NAME}_ADMIN_USERNAME	The username that can be used to sign into the Azure portal as the admin user
INSTRUQT_AZURE_SUBSCRIPTION_${NAME}_ADMIN_PASSWORD	The password that can be used to sign into the Azure portal as the admin user
INSTRUQT_AZURE_SUBSCRIPTION_${NAME}_ADMIN_SPN_ID	The application ID for the admin service principal
INSTRUQT_AZURE_SUBSCRIPTION_${NAME}_ADMIN_SPN_PASSWORD	The password for the admin service principal

Example

This example shows the id of the Azure subscription from a terminal by using two environment variables. The value of the INSTRUQT_AZURE_SUBSCRIPTIONS environment variable is inserted in the INSTRUQT_AZURE_SUBSCRIPTION_${NAME}_SUBSCRIPTION_ID environment variable.

To follow along:

1. Start your Azure subscription track and start the first challenge.

2. Move over to the Cloud CLI terminal and enter the following command:

   eval echo "\${INSTRUQT_AZURE_SUBSCRIPTION_${INSTRUQT_AZURE_SUBSCRIPTIONS}_SUBSCRIPTION_ID}"

   ↳ The terminal shows the id of your Azure subscription.

Azure built-in roles

The roles option allows you to choose one or more Azure built-in roles to grant access to your Azure subscription. See Azure built-in roles that you can apply.

You might start with the role Virtual Machine Contributor which gives the learner the ability to spin up and configure Azure virtual machines:

🌐 Web UI

Update your Azure subscription by entering the following in the Assigned Roles field:

Virtual Machine Contributor

And clicking Add.

💻 Instruqt CLI

Edit your config.yml file to include this content:

azure_subscriptions:
- name: azuresubscription
  roles:
  - Virtual Machine Contributor

Great! Your learners can now access Azure subscriptions. But there is more. You can also give them access to:

• GCP projects

• AWS accounts