When your Azure Resource Manager template (ARM template) is located in a storage account, you can restrict access to the template to avoid exposing it publicly. You access a secured template by creating a shared access signature (SAS) token for the template, and providing that token during deployment. This article explains how to use Azure PowerShell or Azure CLI to securely deploy an ARM template with a SAS token.
You will find information on how to protect and manage access to your private ARM templates with directions on how to do the following:
Create storage account with secured container
Upload template to storage account
Provide SAS token during deployment
Important
Instead of securing your private template with a SAS token, consider using template specs. With template specs, you can share your templates with other users in your organization and manage access to the templates through Azure RBAC.
Create storage account with secured container
The following script creates a storage account and container with public access turned off for template security.
To deploy a private template in a storage account, generate a SAS token and include it in the URI for the template. Set the expiry time to allow enough time to complete the deployment.
Important
The blob containing the private template is accessible to only the account owner. However, when you create a SAS token for the blob, the blob is accessible to anyone with that URI. If another user intercepts the URI, that user is able to access the template. A SAS token is a good way of limiting access to your templates, but you should not include sensitive data like passwords directly in the template.
# get the URI with the SAS token$templateuri = New-AzStorageBlobSASToken `
-Container templates `
-Blob azuredeploy.json `
-Permission r `
-ExpiryTime (Get-Date).AddHours(2.0) -FullUri# provide URI with SAS token during deploymentNew-AzResourceGroupDeployment `
-ResourceGroupName ExampleGroup `
-TemplateUri$templateuri
The following example works with the Bash environment in Cloud Shell. Other environments might require different syntax to create the expiration time for the SAS token.
Demonstrate the skills needed to implement security controls, maintain an organization’s security posture, and identify and remediate security vulnerabilities.