Edit

Quickstart: Deploy a service catalog template using the CLI

Azure Enclave is a cloud networking service that provides organizations with highly sensitive data the ability to quickly deploy and manage workloads across Commercial and air-gapped Azure clouds at scale. In this quickstart, you:

  • Deploy a service catalog template by using Azure CLI commands.

Note

This sample deployment is just for demo purposes and doesn't represent all the best practices for network, systems, or applications administration.

Before you begin

Prerequisites

Before you begin, review the prerequisites specified by the service catalog template you plan to deploy. Deploy any required prerequisite resources that aren't already available, and confirm that you have permission to use them.

Then gather the resource names, resource IDs, and other parameter values required by that template. The prerequisites, required parameters, and default values can vary by template and version. Don't assume that every template requires the resources used in the following example.

Deploy a template from the service catalog

You can find the service catalog templates in Azure Public in the inventory.xml inventory file.

Download a specific template by using the name you find in the inventory (for example, deploy-adminVM-1.0.1.json).

  1. List the available templates on the service catalog:

    # Download the XML file
$xmlUrl = "https://veservicecatalogprod.z22.web.core.windows.net/inventory.xml"
$xmlContent = Invoke-WebRequest -Uri $xmlUrl -UseBasicParsing

# Load the XML content
[xml]$xml = $xmlContent.Content

# Extract URLs from the XML file
$urls = $xml.SelectNodes("//EnumerationResults/Blobs/Blob/Url")

# List the URLs
$urls | ForEach-Object { $_.InnerText }

    The service catalog storage account varies by environment:

    • Azure: veservicecatalogprod.z22.web.core.windows.net
    • Azure Government: veservicecatalogfairfax.z2.web.core.usgovcloudapi.net
    • Azure Secret: veservicecatalogussec.z1.web.core.<AzureSecretDomain>
    • Azure Top Secret: veservicecatalogusnat.z2.web.core.<AzureTopSecretDomain>

  2. Download each template Continue the PowerShell script from the previous step. To download only one template, replace the filter with the template URL you selected.

    # download all templates
$urls | ForEach-Object {
    $url = $_.InnerText
    $fileName = Split-Path -Leaf $url
    Invoke-WebRequest -Uri $url -OutFile $fileName
}

  3. Open the template and determine which parameters you need to provide. In this example, use storageAccount/deploy-storage-account-1.0.0.json.

    Note which parameters are required and which parameters have default values.

    Create a params.json file to provide the parameter values:

    {
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "storageAccountName": {
            "value": ""
        },
        "virtualNetworkName": {
            "value": ""
        },
        "networkResourceGroupName": {
            "value": ""
        },
        "privateLinkSubnetName": {
            "value": ""
        },
        "privateDnsZoneResourceGroupName": {
            "value": ""
        },
        "keyVaultName": {
            "value": ""
        },
        "keyName": {
            "value": ""
        },
        "keyVaultResourceGroupName": {
            "value": ""
        },
        "userAssignedIdentityObject": {
            "value": {
                "name":"",
                "id":"",
                "location":"",
                "subscriptionName":""
            }
        }
    }
}

  4. Fetch the enclave resources to provide the following parameter values:

    • storageAccountName
    • virtualNetworkName
    • networkResourceGroupName
    • privateDnsZoneResourceGroupName
    • keyVaultName
    • keyVaultResourceGroupName
    • userAssignedIdentityObject.name
    • userAssignedIdentityObject.id
    • userAssignedIdentityObject.location
    • userAssignedIdentityObject.subscriptionName
    az rest --method get --uri "<enclave-resource-id>?api-version=2026-04-01"

    Use the response and the Azure resource properties to populate the values in params.json. For more API operations and schemas, see the Azure Enclave API reference and Azure Enclave API source and specs. You must also identify privateLinkSubnetName and keyName.

  5. List the subnets in the virtual network (privateLinkSubnetName)

    az network vnet subnet list --resource-group <resource-group-name> --vnet-name <vnet-name> --query "[].name"

  6. Get CMK Key Name (keyName)

    az keyvault key list --vault-name <keyvault-name> --query "[].name"

  7. Get the location of userAssignedIdentityObject (userAssignedIdentityObject.location)

    az resource show --ids <user-assigned-identity-resource-id> --query location

  8. Get the subscription name

    az account show --subscription <subscription-id> --query name

  9. Deploy the template

    az deployment group create --resource-group <resource-group-name> --template-file ./<template-downloaded-name> --parameters @./<parameter-file-name>

Validate the deployment

  1. Check the deployment status.

    az deployment group show --resource-group <resource-group-name> --name <deployment-name> --query properties.provisioningState

  2. Confirm that the resources created by the template are present.

    az resource list --resource-group <resource-group-name> --output table

Delete the deployment

If you don't plan on keeping these resources, delete only the resources created by this deployment to avoid Azure charges. Delete the resource group only when it's dedicated to this deployment and you confirmed that it contains no resources you need to keep.

Related content

  • Last updated on