Azure Provider
Relevant source files
The following files were used as context for generating this wiki page:
The Azure Provider is a plugin for Cloud Custodian that enables management, security, and cost optimization of Azure cloud resources. It uses a rules engine where users define policies in YAML to filter specific resources and execute actions upon them. Sources: tools/c7n_azure/readme.md:1-5, README.md:14-18
Core Architecture and Resource Management
The provider interfaces with Azure Resource Manager (ARM) using various Azure Management SDKs. It maps YAML resource identifiers to specific Python implementation classes. Sources: tools/c7n_azure/pyproject.toml:9-85, tools/c7n_azure/c7n_azure/resources/resource_map.py:4-121
Resource Mapping Structure
The ResourceMap dictionary defines the link between the policy string (e.g., azure.vm) and the internal class handling that resource type.
This diagram illustrates how Cloud Custodian resolves a resource string from a policy file to a specific Python class. Sources: tools/c7n_azure/c7n_azure/resources/resource_map.py:4-121
Supported Resource Categories
| Category | Example Resources | Implementation Path |
|---|---|---|
| Compute | azure.vm, azure.vmss, azure.aks | c7n_azure.resources.vm, k8s_service |
| Storage | azure.storage, azure.storage-container | c7n_azure.resources.storage |
| Network | azure.vnet, azure.networkinterface, azure.publicip | c7n_azure.resources.vnet, network_interface |
| Identity | azure.roleassignment, azure.entraid-user | c7n_azure.resources.access_control, entraid_user |
| Databases | azure.cosmosdb, azure.sql-server, azure.mysql | c7n_azure.resources.cosmos_db, sqlserver |
| Sources: tools/c7n_azure/c7n_azure/resources/resource_map.py:4-121 |
Execution Modes
The Azure provider supports multiple execution environments depending on policy requirements and triggers. Sources: tools/ops/azure/container-host/devops-flow/README.md:15-16, tools/c7n_azure/c7n_azure/function_package.py:100-115
Serverless Execution (Azure Functions)
The FunctionPackage class manages the lifecycle of policies deployed as Azure Functions. It bundles the policy, authentication details, and dependencies into a ZIP archive for deployment. Sources: tools/c7n_azure/c7n_azure/function_package.py:46-50
- Timer Trigger: Executes policies on a defined schedule.
- Queue Trigger: Executes policies in response to events placed in an Azure Storage Queue.
Sources: tools/c7n_azure/c7n_azure/function_package.py:105-115
Container Hosting
For high-volume or long-running environments, policies run within containers.
- container-periodic: Runs policies at fixed intervals within a container instance.
- container-event: Triggers policy execution based on cloud events within the container host.
Sources: tools/ops/azure/container-host/devops-flow/README.md:15-16
This diagram shows the workflow for deploying policies to a container host via Azure DevOps and Blob Storage. Sources: tools/ops/azure/container-host/devops-flow/README.md:18-65
Authentication and Security
The provider supports multiple authentication mechanisms to interact with the Azure API. The FunctionPackage dynamically generates the auth.json file based on the configured identity type. Sources: tools/c7n_azure/c7n_azure/function_package.py:73-90
| Auth Type | Description | Environment Variable / Config |
|---|---|---|
| Embed | Uses a service principal embedded in the deployment. | AUTH_TYPE_EMBED |
| MSI | System Assigned Managed Service Identity. | AUTH_TYPE_MSI, AZURE_USE_MSI |
| UAI | User Assigned Managed Identity. | AUTH_TYPE_UAI, client_id |
| Sources: tools/c7n_azure/c7n_azure/function_package.py:20-22, 73-90 |
Policy Validation and Deployment
Cloud Custodian provides CLI tools to ensure policy correctness before deployment. Sources: README.md:112-120
- Validate: Run
custodian validate <policy.yml>to check for schema errors. - Dry Run: Run
custodian run --dryrun <policy.yml>to see which resources match without taking action. - Deploy: Run
custodian run <policy.yml>or use CI/CD to push to Azure Functions/Containers.
Sources: README.md:112-120, tools/ops/azure/container-host/devops-flow/README.md:38-45
CI/CD Workflow
Azure DevOps pipelines automate the validation and distribution of policies:
- Validation Pipeline: Filters changed files in a Pull Request and runs
custodian validateon each. Sources: tools/ops/azure/container-host/devops-flow/README.md:46-52 - Deployment Pipeline: Generates a SAS token and synchronizes policy files from a repository subfolder to a Blob Storage container. Sources: tools/ops/azure/container-host/devops-flow/README.md:65-75
Summary
The Azure Provider extends Cloud Custodian's rules engine to the Azure ecosystem by leveraging native ARM SDKs and serverless capabilities. By supporting various execution modes—from simple CLI "pull" operations to automated Azure Function triggers and persistent Container Hosts—it provides a flexible framework for maintaining real-time compliance and cost control across Azure subscriptions. Sources: tools/c7n_azure/readme.md, README.md