[{"_1":2,"_161":-5,"_162":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_140":141},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":-5,"_89":90,"_129":-5,"_130":11,"_131":21,"_132":11,"_133":-5,"_134":11,"_135":-5,"_136":137,"_138":91,"_139":-7},"canonicalUrl","https://hub.docker.com/r/ericmaino/azure-resource-scanner/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","ericmaino","reponame","azure-resource-scanner","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":21,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2018-08-30T23:30:20.49747Z","description","Azure Functions docker image ","is_private","last_updated","2018-09-07T05:41:57.136309Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",438,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Azure Resource Scanner\nWorkflow for discovering and documenting Azure Resources across multiple subscriptions with the intent to store, update tags, and/or perform other generic resource related operations.\n\nLogic is written in Python and is executed by Azure Functions.\n\n[![Deploy to Azure](http://azuredeploy.net/deploybutton.png)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fericmaino%2Fazure-resource-scanner%2Fmaster%2FDeployment%2Fdeploy.azure.json)\n[![Visualize](http://armviz.io/visualizebutton.png)](http://armviz.io/#/?load=https%3A%2F%2Fraw.githubusercontent.com%2Fericmaino%2Fazure-resource-scanner%2Fmaster%2FDeployment%2Fdeploy.azure.json)\n\n#### Setup Azure for Deployment\n\nUsing the Azure CLI, either from inside the Azure Portal using Cloud Shell, or locally. [Download Local CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest)\n\nIt is recommended you do this using the Azure Portal Cloud Shell, in PowerShell Mode ,if you are not using Cloud Shell then you must first sign in using ```az login```\n\n*Note: If you have more than one subscription you can select which to use with```az account set --subscription ```*\n\n##### 1. Create Resource Group\nAll resources must belong to a storage account:\n\n```az group create --name my-functions-group --location westus2```\n\n##### 2. Create Storage Account\nThis storage account is used by the Azure Function. In the following command, substitute a globally unique storage\naccount name where you see the `````` placeholder. The name must be between 3 and 24 characters\nand may only contain lowercase letters and numbers.\n\n```az storage account create --name --location westus2 --resource-group my-functions-group --sku Standard_LRS```\n\n\n##### 3. Create Linux App Service plan\nRunning the functions via docker container requires a Linux App Service.\n\n```\naz appservice plan create --name my-app-service --resource-group my-functions-group --sku S1 --is-linux\n```\n\n##### 4. Create the Azure Function and deploy the image\nThe function app executes the functions inside of the docker image.\n\nIn the following command, substitute a unique function app name where you see the placeholder \nand the storage account name for ``````. The `````` is used as the default DNS \ndomain for the function app, and so the name needs to be unique across all apps in Azure. \nAs before, `````` is your Docker account name.\n\n```\naz functionapp create --name --storage-account --resource-group my-functions-group --plan my-app-service --deployment-container-image-name /my-functions:v1\n```\n\n##### 5. Configure the storage accounts for the function app\nThe function app requires connection strings to connect to the Storage Account created earlier.\n\n```\nstorageConnectionString=$(az storage account show-connection-string --resource-group my-functions-group --name --query connectionString --output tsv)\n\naz functionapp config appsettings set --name --resource-group my-functions-group --settings AzureWebJobsDashboard=$storageConnectionString AzureWebJobsStorage=$storageConnectionString\n```\n\n##### 6. Create an SPN to search Azure with\nWe use a service principal name (SPN) to perform Azure calls inside of the Azure Function. SPN's have no \nprivileges by default and must be granted them for each subscription, resource group, or resource you \nwish for them to have access to.\n\nTo create the SPN, run the following command.\n```\naz ad sp create-for-rbac --name --password \n``` \nThis should return something like this:\n```\n{\n \"appId\": ,\n \"displayName\": ,\n \"name\": \"http://\",\n \"password\": ,\n \"tenant\": \n}\n```\nThis has also created a `Contributor` role assignment for the service principal in the current subscription. To remove that role assignment and assign the principal a `Reader` role instead:\n\n```bash\naz role assignment create --assignee --role Reader\n# Only need to delete Contributor access for account previously set in CLI\naz role assignment delete --assignee --role Contributor\n```\n\nIf you would like the Service Principal to have access to multiple subscriptions, perform the following commands with each subscription ID:\n\n```bash\naz account set --subscription \naz role assignment create --assignee --role Reader\n```\n\nRoles can also be added/removed from inside the Azure Portal from the `Access Control (IAM)`\nmenu on any subscription, resource group, or resource.\n\n##### 7. Add SPN login details to function app\nWe can allow the function app to login as the SPN by giving it the name, password, and tenant.\nA secure way of doing this is adding these properties to the application settings for the function app.\nThis will allow the function app to access the properties as environment variables on runtime.\n\nThis command will add the SPN login details to the application settings:\n```\naz functionapp config appsettings set --name --resource-group my-functions-group --settings ClientId= ClientSecret= ClientTenant=\n```\n\n##### 8. Verify Function Configuration\nThe function app should now be configured properly. You can verify the functions are loaded correctly by finding them in the Azure Portal and opening the function app resource. In order for the flow to begin, there must be a configuration file, which is explained below.\n\n##### 9. Generate Configuration File\nIn order for the Resource Scanner to run, a configuration file must be generated. This configuration file is stored in an Azure Blob Storage container, and then picked up by the task scheduling function to kick off the process. This process is run locally. Follow [these steps](/GenerateConfig.md) to generate the file, at which point you should be good to start scanning :)\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":21,"_83":11,"_84":11},"read","write","admin","user","storage_size",1355465355,"orgData","recentTags",[91],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_50":118,"_119":94,"_120":33,"_121":56,"_57":122,"_123":124,"_125":109,"_126":118,"_127":66,"_128":21},"content_type","creator",636397,"full_size",487757393,"id",34294058,"images",[101],{"_102":103,"_104":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":96,"_63":66,"_117":-5},"architecture","amd64","digest","sha256:ae247733822b7234cddcbcda37dc19eadd3fb8445555425c1fb927146dbcf145","features","","last_pulled","2026-09-25T01:09:48.513390439Z","last_pushed","2018-09-07T05:41:57Z","os","linux","os_features","os_version","size","variant","2018-09-07T05:41:56.816994Z","last_updater","last_updater_username","media_type","latest","repository",5955009,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":142,"_149":150,"_136":159,"_160":11},{"_40":143,"_42":144,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":145,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":146,"_79":21,"_80":148,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":147},[78],{"_82":21,"_83":11,"_84":11},"tags",{"_151":64,"_152":-5,"_153":-5,"_154":155},"count","next","previous","results",[156],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":157,"_50":118,"_119":94,"_120":33,"_121":56,"_57":122,"_123":124,"_125":109,"_126":118,"_127":66,"_128":21},[158],{"_102":103,"_104":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":96,"_63":66,"_117":-5},[],"canDeleteTags","actionData","errors"]

ericmaino/azure-resource-scanner

Tags for ericmaino/azure-resource-scanner