From Overview of Registered App, copy the Application\/Client Id and save it anywhere for later use<\/span>![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/12.png\")
<\/li>\n<\/ol>\nStep4:<\/b> Create New Client Secret in Registered Application and Save Value Id<\/b><\/h3>\n
To create a client secret associated with your app:<\/b><\/p>\n\n- In Azure, under the application, you have just created, select Certificates & Secrets<\/span>
![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/2-converted-2.png\")
<\/li>\n- Under these <\/span>Certificates & Secrets<\/b> \u2192 <\/span>Add new Client Secret<\/b> -> <\/span>Give Description<\/b> \u2192 <\/span>Select <\/b>
\nexpiration time \u2192 Copy Value somewhere else because it hides sometimes\u00a0<\/b>![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/14.png\")
<\/li>\n<\/ol>\nStep5: <\/b>Grant Reader permission to Registered App<\/b><\/h3>\n
\u00a0 \u00a0 \u00a0 Grant Reader permission to your Application:<\/span><\/p>\n\n- Go to <\/span>Subscriptions <\/b>\u2192 and open the <\/span>Subscription that you want Your app<\/b> ( Monitoring Webapp ) to monitor.
\n![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/subscriptions-1.png\")
\n<\/span><\/li>\n- Click on <\/span>Subscription <\/b>\u2192 Select <\/span>Access control (IAM)<\/b> \u2192 <\/span>Add role Assignment<\/b> \u2192 <\/span>Add Member <\/b>\u2192<\/span> Select your app and add and save<\/b>
![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/18.png\")
![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/19.png\")
<\/li>\n<\/ol>\nStep6:<\/b> Fetch the number of VM’s data in our Azure Account using Azure SDK with Keys<\/strong><\/h3>\nresources.py :<\/b><\/p>\nfrom azure.mgmt.compute import ComputeManagementClient\r\nfrom azure.common.credentials import ServicePrincipalCredentials\r\nimport os<\/span>\r\nSubscription_Id = os.environ[\u201csubscription_id\u201d]<\/span>\r\nTenant_Id = os.environ[\u201ctenant_id\u201d]<\/span>\r\nClient_Id = os.environ[\u201cclient_id\u201d]<\/span>\r\nSecret = os.environ[\u201csecret\u201d]<\/span>\r\n\r\ncredential = ServicePrincipalCredentials(<\/span>\r\n\u00a0 \u00a0 \u00a0 \u00a0 client_id=Client_Id,<\/span>\r\n\u00a0 \u00a0 \u00a0 \u00a0 secret=Secret,<\/span>\r\n\u00a0 \u00a0 \u00a0 \u00a0 tenant=Tenant_Id<\/span>\r\n\u00a0 \u00a0 \u00a0 \u00a0 )<\/span>\r\n\r\ncompute_client = ComputeManagementClient(credential, Subscription_Id)<\/span>\r\n\r\nvm_list = compute_client.virtual_machines.list('azure-poc')<\/span>\r\n# vm_list = compute_client.virtual_machines.list('resource_groupname')<\/span>\r\ni= <\/span>0<\/span>\r\nfor vm <\/span>in<\/span> vm_list:<\/span>\r\n\u00a0 \u00a0 array = vm.id.split(<\/span>\"\/\"<\/span>)<\/span>\r\n\u00a0 \u00a0 resource_group = array[<\/span>4<\/span>]<\/span>\r\n\u00a0 \u00a0 vm_name = array[-<\/span>1<\/span>]<\/span>\r\n\u00a0 \u00a0 statuses = compute_client.virtual_machines.instance_view(resource_group, vm_name).statuses<\/span>\r\n\u00a0 \u00a0 status = len(statuses) >= <\/span>2<\/span> and<\/span> statuses[<\/span>1<\/span>]<\/span>\r\n\r\n\u00a0 \u00a0 <\/span>if<\/span> status <\/span>and<\/span> status.code == 'PowerState\/running':<\/span>\r\n\u00a0 \u00a0 \u00a0 \u00a0 print(vm_name)<\/span><\/pre>\nOutput<\/span>:\u00a0<\/span><\/p>\n![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/22.png\")
Rotate Client Secrets Credentials:<\/b><\/p>\n
It will be required to update the application’s authentication credentials using the Azure Portal, once the client secret expires (<\/span>the<\/b> maximum expiration date available in Azure is 2 years<\/b>). <\/span>Go to <\/span>App Registration<\/b> \u2192 Select <\/span>Your App<\/b> \u2192 Go into <\/span>Client Secret<\/b> \u2014><\/span>Edit the Client Secret field with the new value <\/b>and confirm with <\/span>Save<\/b> Changes.<\/span><\/p>\n![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/21.png\")
<\/p>\n
Use Case Of Managed Identity:<\/b><\/h3>\n
Using a managed identity, you can authenticate to any service that supports Azure AD authentication without exposing credentials.<\/span><\/p>\nAzure Managed Identity\u00a0<\/span><\/p>\n\n- User Assigned Managed Identities\u00a0<\/span><\/li>\n
- System Assigned Managed Identities\u00a0<\/span><\/li>\n<\/ul>\n
![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/Screenshot-2022-07-18-161006.png\")
<\/p>\n
But as we can see, the system assigned managed not to work for us where you have to monitor thousands of services because we need to create thousands of managed identities for each azure resource to communicate with them.<\/span><\/p>\nSame, In the case of User assigned managed identity, we need to grant permission every time whenever newly resource group is created in our Azure Infra. So it is also not good, as we need to add every time newly created resource group. <\/span>It is clearly seen that there is no other way to do authentication Using Python SDK except App Registration.<\/span><\/p>\nCan we Use Azure Key Vault to store secrets, Instead of passing Direct Client Id and Client Secret Id in code:<\/b><\/p>\n
As we know, Azure Vault is the most secure way to handle such a situation in today\u2019s scenarios. But it is not free to use, you have to pay $0.03 for a 10k transaction in the standard pricing tier. So It is not beneficial in that scenario where you have to fetch the secret key from the vault to communicate with azure resources more frequently.<\/span><\/p>\nNo, We can\u2019t fetch the ClientId and Client SecretId directly from Key Vault because Key Vault Url is not a Global URL, before accessing it we need to authenticate Key Vault and for authentication, we are using the app Registration Secret.<\/span><\/p>\nConclusion<\/strong><\/h2>\nIf you want to communicate with more than one service using the same credential in the entire subscription, then go with Azure App Registration Authentication. If your code runs in any Azure service, go with Azure Managed Identities Approach. If you want to store those credentials in Keyvault, then you need to authenticate the key vault first and then use their credentials in code but when your client’s secret expires you need to create a new Key vault again and provide the reader permission again to it.<\/p>\n
<\/p>\n
<\/div>","protected":false},"excerpt":{"rendered":"
Need for Authentication: To communicate with Azure Resources we need to do authentication, suppose you have an application that monitors Azure resources. To fetch azure resources data from the azure account, we need a connection string or secrets to do Azure Authentication. Ather that, these all secrets are shared with the application developer who integrates […]<\/p>\n","protected":false},"author":1435,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":136},"categories":[4308,2348],"tags":[4990],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/55158"}],"collection":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/users\/1435"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/comments?post=55158"}],"version-history":[{"count":10,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/55158\/revisions"}],"predecessor-version":[{"id":55315,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/55158\/revisions\/55315"}],"wp:attachment":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/media?parent=55158"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/categories?post=55158"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/tags?post=55158"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/Flowchart1-2.png\")
<\/p>\n![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/1-1.png\")
<\/p>\n![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/2.png\")
<\/p>\n![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/4-1.png\")
<\/p>\n![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/5.png\")
<\/p>\n![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/6.png\")
<\/p>\n![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/7.png\")
<\/li>\n![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/1converted-1.png\")
<\/li>\n![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/9.png\")
<\/li>\n![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/10.png\")
![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2022\/07\/11.png\")
<\/li>\n<\/ol>\n