Share via

How to run make REST calls to Azure Resource Manager (ARM) inside Github Workflow?

Siegfried Heintze 1,906 Reputation points
2023-08-30T17:29:29.1733333+00:00

I have a working powershell script inspired by https://techcommunity.microsoft.com/t5/azure-paas-blog/import-azure-function-app-to-azure-api-management/ba-p/2594810 and I would like to run it in a Github workflow.

  1. I assume I would use https://github.com/marketplace/actions/powershell-script. Is this what you would use?
  2. I see that Haily mixes azure cli with powershell commands. Is it possible to mix azure cli commands inside a github workflow? Can someone point me to an example? I suspect I'm going to have to convert that azure cli command to a powershell command.
  3. To set up an Github workflow, I believe I will have to create an azure managed identity using the az ad sp create-for-rback and store that as a github secret called AZURE_CREDENTIALS and grant it the ability to make REST calls to the ARM. How do I grant it the ability to make ARM REST calls? Can you show me an example of granting this ability and the powershell command to make the REST call to fetch the function keys? Is there a way to do this with powerhell cmdlets instead of a REST call?
  4. I also want to enhance Haily's script to fetch the function names from my azure function app and create GET operations for each function. I believe this only possible with a REST call to the ARM. How would I translate this azure cli code to use powershell inside a github workflow: $ops = az rest -m get --header "Accept=application/json" -u "https://management.azure.com/subscriptions/$subscription/resourceGroups/$rg/providers/Microsoft.Web/sites/$functionApp/functions?api-version=2015-08-01" | jq .value[].properties.name | tr -d '\r' | tr '\n' ' ' | tr -d '"'

Thanks

Siegfried

Azure Functions
Azure Functions
An Azure service that provides an event-driven serverless compute platform.
5,936 questions
Accepted answer
  1. Konstantinos Passadis 19,591 Reputation points MVP
    2023-09-03T16:30:38.63+00:00

    Hello @Siegfried Heintze !

    Allow me to try to answer one by one !

    1.Yes, you use the PowerShell Script Action to run PowerShell scripts directly in your GitHub workflow.

    2.You can use the Azure CLI directly in GitHub workflows. To run Azure CLI commands, first, you'd set up Azure login with a step like this, using the Azure Login action:

    - name: Login to Azure

    uses: azure/login@v1

    with:

    **creds: ${{ secrets.AZURE_CREDENTIALS }}**

    And here is an example :

    name: Azure Workflow

on:
  push:
    branches:
      - main

jobs:
  azure_operations:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v2

    - name: Azure Login
      uses: azure/login@v1
      with:
        creds: ${{ secrets.AZURE_CREDENTIALS }}

    # Run Azure CLI command
    - name: List Azure Resource Groups using Azure CLI
      run: az group list --output table

    # Run PowerShell command with Azure PowerShell Module
    - name: Get Azure VMs using PowerShell
      run: |
        Install-Module -Name Az -AllowClobber -Scope CurrentUser -Force
        Import-Module Az

        $rgs = az group list --query "[].name" --output tsv
        foreach ($rg in $rgs) {
          $vms = Get-AzVM -ResourceGroupName $rg
          $vms | ForEach-Object { Write-Output $_.Name }
        }

    3.Creating a Service Principal and storing it in GitHub Secrets is the right approach. Once you've created the Service Principal with az ad sp create-for-rbac, you'll have the necessary permissions to make calls to the Azure Resource Manager (ARM). The ROLE is the permission bound to the Principal , it could be any role available on Azure IAM , usually the Contributor is set , but best practices instruct us to use the least privilege approach !

    Additionally you can use Azure PowerShell to make REST calls with Invoke-RestMethod. 

    $uri = "https://management.azure.com/subscriptions/$subscription/resourceGroups/$rg/providers/Microsoft.Web/sites/$functionApp/functions/$functionName/listkeys?api-version=2015-08-01"
$functionKeys = Invoke-RestMethod -Method Post -Uri $uri -Headers @{ Authorization = "Bearer $accessToken" }

    Note: $accessToken should be the token you get after logging in to Azure with PowerShell.

    1. In PowerShell, you don't need jq since it has native support for JSON. Here's how you can translate the Azure CLI command:
    $uri = "https://management.azure.com/subscriptions/$subscription/resourceGroups/$rg/providers/Microsoft.Web/sites/$functionApp/functions?api-version=2015-08-01"
$functions = Invoke-RestMethod -Method Get -Uri $uri -Headers @{ Authorization = "Bearer $accessToken" }
$functionNames = $functions.value.properties.name

    I hope this helps!

    Kindly mark the answer as Accepted and Upvote in case it helped!

    Regards

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Siegfried Heintze 1,906 Reputation points
    2023-09-18T02:14:56.9333333+00:00

    Problem solved: https://github.com/orgs/community/discussions/67346

    Adding 

            enable-AzPSSession: true

    in the checkout action does the trick!

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.