Azure subscriptions

Give learners access to Azure subscriptions.

Cloud account usage can lead to abuse without the appropriate security policies in place. Always be sure to implement the appropriate policies and restrictions before exposing tracks with cloud accounts to the public.

Costs associated with cloud accounts are in addition to your standard Instruqt billing. Therefore, you should take extra precautions when allowing users to access tracks that have cloud accounts.

This guide explains how to access an Azure subscription from Instruqt.

An Azure subscription is a logical container used to provision resources in Azure. It holds the details of all your resources like virtual machines (VMs), databases, and more. When you create an Azure resource like a VM, you identify the subscription it belongs to.
— Azure documentation

Before you begin

You must have already built a track to which you can add access to an Azure subscription.

Access Azure subscriptions

It is best to add the Instruqt Cloud Client container to your track to give a learner access to an Azure subscription. Because the Instruqt Cloud Client:

Exposes links to the Azure portal for the resources configured in the config.yml file, with the credentials required to log in.
Includes the az CLI, pre-configured with the required credentials.

The Azure portal and the az CLI make it easy for content developers and learners to access Azure subscription resources from the sandbox.

It takes the following steps to give learners access to an Azure subscription:

Add an Instruqt Cloud Client container to your track.
Add an Azure subscription to your track.
Add tabs to your challenges where you want to expose the Azure portal or az CLI.

Additionally, you can use:

A set of environment variables that are available in the az CLI.
Azure built-in roles.

Step 1: Add an Instruqt Cloud Client container to your track

More information can be found in the cloud client section.

Step 2: Add an Azure subscription to your track

Click + Add a cloud account on the Sandbox page.
Select the Azure provider.
In the Name field, enter azuresubscription.
In the Services field, select the services that are going to be enabled.
In the Regions field, select the regions that are going to be enabled.
In the User Roles field, specify the desired roles for the end user.
In the Admin Roles field, specify the desired roles for the admin user.
Click Save to add the Azure subscription. ↳ On the Sandbox page, you will see the new Azure subscription.
Click Back to track to return to the Track dashboard page.

Copy and paste the following code into config.yml:

azure_subscriptions:
- name: azuresubscription
  services: []
  regions: []
  roles: []

↳ Your config.yml file should be similar to this now:

version: "3"
containers:
- name: cloud-client
  image: gcr.io/instruqt/cloud-client
  ports: [80]
  shell: /bin/bash
azure_subscriptions:
- name: azuresubscription
  services: []
  regions: []
  roles: []

In the Roles field, only provide access to services that are strictly needed to prevent abuse. See Access role for more details.

Only enabled services and regions configured by the team administrator can be selected and/or specified. See more details in Cloud services and regions

When specifying Admin Roles, an additional admin user and application will be created with the designated roles.

For setting up the cloud account in lifecycle scripts, it is recommended to use an admin user with elevated privileges. This ensures the ability to perform operations requiring higher privileges than those assigned to the end user.

Note: Admin credentials are injected exclusively into lifecycle scripts, unlike end user credentials which are exposed as environment variables on virtual machines and containers.

Step 3: Add tabs to expose the Azure portal and `az` CLI

In the Challenges section of the Track dashboard, click Add new followed by Assignment.
Enter/select these values:
Field
Value
Tab name
Azure subscription
URL
azure-subscription
Description
Learn about Azure
Click Save.
Click Tabs followed by Add new tab.
Select the Your applications tab type.
Enter/select these values to set the Azure portal:
Field
Value
Tab name
Azure Portal
Select your host
cloud-client
Path
/
Port
80
Click Save to add the tab.
Click Add new tab again.
Select the Terminal tab type.
Enter/select these values to set the gcloud CLI:
Field
Value
Tab name
az CLI
Host
cloud-client
Click Save to add the tab.
Click the track name to return to the Track dashboard.
Click Play track and test your Azure subscription.

Open a terminal and move to your track directory.
Enter the following command to create a new challenge:
```
instruqt challenge create --title "AzureSubscription"
```
↳ Instruqt CLI created a directory for the challenge. And an assignment.md file inside the challenge directory.
Open the assignment.md file in your code editor.

Copy and paste the following code into assignment.md to set the Azure portal and az CLI:

---
slug: azure-challenge
type: challenge
title: Azure subscription
teaser: Learn to work with an Azure subscription
tabs:
- title: Azure Portal
  type: service
  hostname: cloud-client
  path: /
  port: 80
- title: az CLI
  type: terminal
  hostname: cloud-client
difficulty: basic
timelimit: 600
---

⇨ You can add the assignment text of your liking in Markdown after line 17.

Save file assignment.md.
Push the track to the Instruqt platform:
```
instruqt track push
```
Play and test the track:
```
instruqt track open
```
↳ Your browser opens, showing the Track overview page. Click Start track to play the track.

Great! Your learners can now access Azure subscriptions. But there is more. You can also give them access to:

PreviousSharing AMIs with AWS Accounts NextAzure Environment Variables

Last updated 7 months ago

Was this helpful?

Before you begin

Access Azure subscriptions

Step 1: Add an Instruqt Cloud Client container to your track

Step 2: Add an Azure subscription to your track

Step 3: Add tabs to expose the Azure portal and az CLI

Step 3: Add tabs to expose the Azure portal and `az` CLI