Richard Cheney richeney

Immutable Storage Accounts, Private Link and Private Link Service

Introduction

This is a POC for immutability in a legal hold situation. The assumption is that an Azure Storage Account will be used as a target for images, documents etc. that need to be provably unchanged for a required legal period.

Immutability policy scope

Immutability policies can be scoped to a blob version or to a container. How an object behaves under an immutability policy depends on the scope of the policy.

Using Terraform Cloud with Vault and OIDC

Requires jo

sudo apt update && sudo apt install jo -y

Create an example repo

Code Tunnels

https://www.azurecitadel.com/arc/servers/access_vms/#code-tunnels

Install & configure on VM

wget https://code.visualstudio.com/sha/download?build=stable\&os=cli-alpine-x64 -O /tmp/code.tar.gz
sudo tar -zxvf /tmp/code.tar.gz -C /usr/local/bin && rm /tmp/code.tar.gz
code tunnel --name $(hostname) --accept-server-license-terms

Initialise git repo, push into GitHub

Needs git and gh.

Quick bashrc function

Add to .bashrc

github() {

	#!/bin/bash

	subscriptionId=$(az account show --query id --output tsv)

	read -r -d '' policyRule <<'EOF'
	{
	"if": {
	"allOf": [
	{
	"field": "type",

	#!/bin/bash
	######################################################
	# Utility script to download latest Hashicorp
	# binaries and move into /usr/local/bin. Uses their
	# releases APIs.
	#
	# Requires sudo password unless sudoers is configured.
	#
	# Can be renamed to installLatestTerraform.sh or
	# installLatestPacker.sh. If not then specify

	" Vim color file
	" Maintainer: Richard Cheney (from delek.vim)
	" Last Change: 2018 Apr 09

	hi clear

	let g:colors_name = "cloudshell"

	" Normal should come first
	hi Normal guifg=Black guibg=White

	#!/bin/bash
	###################################################################################################
	## Loop through stdin of ARM resource compliant policy files
	## Example format is
	## https://github.com/richeney/azure-blueprints/blob/master/policies/auditemptytag.json
	## Requires az and jq
	## Can use unpathed URIs if you have exported URIBASE
	###################################################################################################

	error()

	#/bin/bash

	error()
	{
	[[ -n "$@" ]] && echo "ERROR: $@" >&2
	exit 1
	}

	urlencode() {
	# urlencode <string>

	#!/usr/bin/env bash
	################################################################
	# Search for certs downloaded by the Azure Key Vault Extension,
	# convert from PEM to DER format and update the CA certificates.
	#
	# Designed to be run as root from crontab.
	# Will be silent if no files are converted.
	################################################################

	error()