在CI服务器上使用Azure Powershell cmdlet

Question

I have some powershell scripts in my CI server to check the state of some WebJobs.

But I have few problems.

I'm using publish settings file, but it expires and my build starts to fail.

I don't want to use a Management Certificate that will expose all management features.

And I don't want to put my user credentials on the CI server that will also expose all management features.

There is any way to create a CI user or credential with restricted permissions?

Thanks!

Answer 1

Azure Functions provides a good solution to this problem. You can create a Service Principle account, with certificate login and then restrict that account to whatever actions you need it to allow (via RBAC)

You can then have an Azure PowerShell script running in Functions, that is called from a webhook from your CI engine. That way the only credentials that are stored on your CI are the webhook secret, and if your CI engine has a static IP you can verify that commands only come from that address, and drop anything else.