Skip to content

Commit 668ec46

Browse files
PatAltimorePatAltimore
committed
Add portal and bicep tabs
1 parent 3579c54 commit 668ec46

File tree

2 files changed

+215
-3
lines changed

2 files changed

+215
-3
lines changed

‎articles/iot-operations/manage-mqtt-broker/howto-configure-authorization.md

Lines changed: 215 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.subservice: azure-mqtt-broker
77
ms.topic: how-to
88
ms.custom:
99
- ignite-2023
10-
ms.date: 11/07/2024
10+
ms.date: 11/08/2024
1111

1212
#CustomerIntent: As an operator, I want to configure authorization so that I have secure MQTT broker communications.
1313
ms.service: azure-iot-operations
@@ -43,7 +43,7 @@ The following example shows how to create a *BrokerAuthorization* resource using
4343

4444
# [Bicep](#tab/bicep)
4545

46-
To edit the default endpoint, create a Bicep `.bicep` file with the following content. Update the settings as needed, and replace the placeholder values like `<AIO_INSTANCE_NAME>` with your own.
46+
To edit an authorization policy, create a Bicep `.bicep` file with the following content. Update the settings as needed, and replace the placeholder values like `<AIO_INSTANCE_NAME>` with your own.
4747

4848
```bicep
4949
param aioInstanceName string = '<AIO_INSTANCE_NAME>'
@@ -482,14 +482,59 @@ Since clients have access to the topic, you can specify keys and access levels u
482482

483483
The `stateStoreResources` section format consists of access level, a pattern indicator, and the pattern.
484484

485+
# [Portal](#tab/portal)
486+
487+
Include the `stateStoreResources` section in the rules for your authorization policy.
488+
489+
```json
490+
"stateStoreResources": [
491+
{
492+
"method": "", // Values: read, write, readwrite
493+
"keyType": "", //Values: string, pattern, binary. Default is pattern
494+
"keys": [
495+
// List of patterns to match
496+
]
497+
},
498+
]
499+
```
500+
501+
# [Bicep](#tab/bicep)
502+
503+
In Bicep, include the `stateStoreResources` section in your authorization policy.
504+
505+
```bicep
506+
stateStoreResources: [
507+
{
508+
method: '' // Values: read, write, readwrite
509+
keyType: '' //Values: string, pattern, binary. Default is pattern
510+
keys: [
511+
// List of patterns to match
512+
]
513+
}
514+
{
515+
method: 'ReadWrite'
516+
keyType: 'Binary'
517+
keys: [
518+
'xxxxxxxxxxxxxxxxxxxx'
519+
]
520+
}
521+
]
522+
```
523+
524+
# [Kubernetes](#tab/kubernetes)
525+
526+
In your custom resource definition, include the `stateStoreResources` section in your authorization policy.
527+
485528
``` yaml
486529
stateStoreResources:
487530
- method: # Values: read, write, readwrite
488531
keyType: # Values: string, pattern, binary. Default is pattern
489532
keys:
490-
- # List of patterns to match.
533+
- # List of patterns to match
491534
```
492535

536+
---
537+
493538
The `method` field specifies the access level.
494539
- Read access is specified with `read`, write access with `write`, and both with `readwrite`.
495540
- Access level is required.
@@ -514,6 +559,172 @@ The `keys` field specifies the keys to match. The keys can be specified as *Glob
514559

515560
Here's an example of how you might author your state store resources:
516561

562+
# [Portal](#tab/portal)
563+
564+
1. In the Azure portal, navigate to your IoT Operations instance.
565+
1. Under **Azure IoT Operations resources**, select **MQTT Broker**.
566+
1. Select the **Authorization** tab.
567+
1. Choose an existing authentication policy or create a new one by selecting **Create authorization policy**.
568+
1. In the **Rules** field, add a configuration similar to the following:
569+
570+
:::image type="content" source="media/howto-configure-authorization/state-store-resources.png" alt-text="Screenshot using the Azure portal to configure a broker policy with state store resources.":::
571+
572+
```json
573+
[
574+
{
575+
"brokerResources": [
576+
{
577+
"clientIds": [
578+
"{principal.attributes.building}*"
579+
],
580+
"method": "Connect"
581+
},
582+
{
583+
"method": "Publish",
584+
"topics": [
585+
"sensors/{principal.attributes.building}/{principal.clientId}/telemetry/*"
586+
]
587+
},
588+
{
589+
"method": "Subscribe",
590+
"topics": [
591+
"commands/{principal.attributes.organization}"
592+
]
593+
}
594+
],
595+
"principals": {
596+
"attributes": [
597+
{
598+
"building": "17",
599+
"organization": "contoso"
600+
}
601+
],
602+
"usernames": [
603+
"temperature-sensor",
604+
"humidity-sensor"
605+
]
606+
},
607+
"stateStoreResources": [
608+
{
609+
"method": "Read",
610+
"keyType": "Pattern",
611+
"keys": [
612+
"myreadkey",
613+
"myotherkey?",
614+
"mynumerickeysuffix[0-9]",
615+
"clients/{principal.clientId}/*"
616+
]
617+
},
618+
{
619+
"method": "ReadWrite",
620+
"keyType": "Binary",
621+
"keys": [
622+
"xxxxxxxxxxxxxxxxxxxx"
623+
]
624+
}
625+
]
626+
}
627+
]
628+
```
629+
630+
# [Bicep](#tab/bicep)
631+
632+
To edit an authorization policy, create a Bicep `.bicep` file with the following content. Update the settings as needed, and replace the placeholder values like `<AIO_INSTANCE_NAME>` with your own.
633+
634+
```bicep
635+
param aioInstanceName string = '<AIO_INSTANCE_NAME>'
636+
param customLocationName string = '<CUSTOM_LOCATION_NAME>'
637+
param policyName string = '<POLICY_NAME>'
638+
639+
resource aioInstance 'Microsoft.IoTOperations/instances@2024-11-01' existing = {
640+
name: aioInstanceName
641+
}
642+
643+
resource customLocation 'Microsoft.ExtendedLocation/customLocations@2021-08-31-preview' existing = {
644+
name: customLocationName
645+
}
646+
647+
resource defaultBroker 'Microsoft.IoTOperations/instances/brokers@2024-11-01' existing = {
648+
parent: aioInstance
649+
name: 'default'
650+
}
651+
652+
resource brokerAuthorization 'Microsoft.IoTOperations/instances/brokers/authorizations@2024-11-01' = {
653+
parent: defaultBroker
654+
name: policyName
655+
extendedLocation: {
656+
name: customLocation.id
657+
type: 'CustomLocation'
658+
}
659+
properties: {
660+
authorizationPolicies: {
661+
cache: 'Enabled'
662+
rules: [
663+
{
664+
principals: {
665+
usernames: [
666+
'temperature-sensor'
667+
'humidity-sensor'
668+
]
669+
attributes: [
670+
{
671+
city: 'seattle'
672+
organization: 'contoso'
673+
}
674+
]
675+
}
676+
brokerResources: [
677+
{
678+
method: 'Connect'
679+
}
680+
{
681+
method: 'Publish'
682+
topics: [
683+
'/telemetry/{principal.username}'
684+
'/telemetry/{principal.attributes.organization}'
685+
]
686+
}
687+
{
688+
method: 'Subscribe'
689+
topics: [
690+
'/commands/{principal.attributes.organization}'
691+
]
692+
}
693+
]
694+
stateStoreResources: [
695+
{
696+
method: 'Read'
697+
keyType: 'Pattern'
698+
keys: [
699+
'myreadkey'
700+
'myotherkey?'
701+
'mynumerickeysuffix[0-9]'
702+
'clients/{principal.clientId}/*'
703+
]
704+
}
705+
{
706+
method: 'ReadWrite'
707+
keyType: 'Binary'
708+
keys: [
709+
'xxxxxxxxxxxxxxxxxxxx'
710+
]
711+
}
712+
]
713+
}
714+
]
715+
}
716+
}
717+
}
718+
```
719+
720+
Deploy the Bicep file using Azure CLI.
721+
722+
```azurecli
723+
az deployment group create --resource-group <RESOURCE_GROUP> --template-file <FILE>.bicep
724+
```
725+
726+
# [Kubernetes](#tab/kubernetes)
727+
517728
``` yaml
518729
stateStoreResources:
519730
- method: Read # Read includes Get, Notify
@@ -528,6 +739,7 @@ stateStoreResources:
528739
keys:
529740
- "xxxxxxxxxxxxxxxxxxxx" # base-64 encoded binary key.
530741
```
742+
---
531743

532744
## Update authorization
533745

‎articles/iot-operations/manage-mqtt-broker/media/howto-configure-authorization/state-store-resources.png

38.3 KB
Loading

0 commit comments

Comments
 (0)