@@ -38,8 +38,7 @@ Assign permissions to the managed identities to allow them to stop and start a v
38
38
``` powershell
39
39
# Sign in to your Azure subscription
40
40
$sub = Get-AzSubscription -ErrorAction SilentlyContinue
41
- if(-not($sub))
42
- {
41
+ if(-not ($sub)) {
43
42
Connect-AzAccount
44
43
}
45
44
@@ -110,81 +109,71 @@ Create a runbook that will allow execution by either managed identity. The runbo
110
109
111
110
```powershell
112
111
Param(
113
- [string]$resourceGroup ,
114
- [string]$VMName,
115
- [string]$method ,
116
- [string]$UAMI
112
+ [string]$ResourceGroup ,
113
+ [string]$VMName,
114
+ [string]$Method ,
115
+ [string]$UAMI
117
116
)
118
-
117
+
119
118
$automationAccount = "xAutomationAccount"
120
119
121
120
# Ensures you do not inherit an AzContext in your runbook
122
- Disable-AzContextAutosave -Scope Process | Out-Null
123
-
121
+ $null = Disable-AzContextAutosave -Scope Process
122
+
124
123
# Connect using a Managed Service Identity
125
124
try {
126
- $AzureContext = (Connect-AzAccount -Identity).context
127
- }
128
- catch{
129
- Write-Output "There is no system-assigned user identity. Aborting.";
130
- exit
131
- }
132
-
125
+ $AzureConnection = (Connect-AzAccount -Identity).context
126
+ }
127
+ catch {
128
+ Write-Output "There is no system-assigned user identity. Aborting."
129
+ exit
130
+ }
131
+
133
132
# set and store context
134
- $AzureContext = Set-AzContext -SubscriptionName $AzureContext.Subscription `
135
- -DefaultProfile $AzureContext
133
+ $AzureContext = Set-AzContext -SubscriptionName $AzureConnection.Subscription -DefaultProfile $AzureConnection
136
134
137
- if ($method -eq "SA")
138
- {
139
- Write-Output "Using system-assigned managed identity"
140
- }
141
- elseif ($method -eq "UA")
142
- {
143
- Write-Output "Using user-assigned managed identity"
135
+ if ($Method -eq "SA") {
136
+ Write-Output "Using system-assigned managed identity"
137
+ }
138
+ elseif ($Method -eq "UA") {
139
+ Write-Output "Using user-assigned managed identity"
144
140
145
- # Connects using the Managed Service Identity of the named user-assigned managed identity
146
- $identity = Get-AzUserAssignedIdentity -ResourceGroupName $resourceGroup `
147
- -Name $UAMI -DefaultProfile $AzureContext
141
+ # Connects using the Managed Service Identity of the named user-assigned managed identity
142
+ $identity = Get-AzUserAssignedIdentity -ResourceGroupName $ResourceGroup -Name $UAMI -DefaultProfile $AzureContext
148
143
149
- # validates assignment only, not perms
150
- if ((Get-AzAutomationAccount -ResourceGroupName $resourceGroup `
151
- -Name $automationAccount `
152
- -DefaultProfile $AzureContext).Identity.UserAssignedIdentities.Values.PrincipalId.Contains($identity.PrincipalId))
153
- {
154
- $AzureContext = (Connect-AzAccount -Identity -AccountId $identity.ClientId).context
144
+ # validates assignment only, not perms
145
+ $AzAutomationAccount = Get-AzAutomationAccount -ResourceGroupName $ResourceGroup -Name $automationAccount -DefaultProfile $AzureContext
146
+ if ($AzAutomationAccount.Identity.UserAssignedIdentities.Values.PrincipalId.Contains($identity.PrincipalId)) {
147
+ $AzureConnection = (Connect-AzAccount -Identity -AccountId $identity.ClientId).context
155
148
156
- # set and store context
157
- $AzureContext = Set-AzContext -SubscriptionName $AzureContext.Subscription -DefaultProfile $AzureContext
158
- }
159
- else {
160
- Write-Output "Invalid or unassigned user-assigned managed identity"
161
- exit
162
- }
149
+ # set and store context
150
+ $AzureContext = Set-AzContext -SubscriptionName $AzureConnection.Subscription -DefaultProfile $AzureConnection
163
151
}
164
- else {
165
- Write-Output "Invalid method. Choose UA or SA. "
152
+ else {
153
+ Write-Output "Invalid or unassigned user-assigned managed identity "
166
154
exit
167
- }
155
+ }
156
+ }
157
+ else {
158
+ Write-Output "Invalid method. Choose UA or SA."
159
+ exit
160
+ }
168
161
169
162
# Get current state of VM
170
- $status = (Get-AzVM -ResourceGroupName $resourceGroup -Name $VMName `
171
- -Status -DefaultProfile $AzureContext).Statuses[1].Code
163
+ $status = (Get-AzVM -ResourceGroupName $ResourceGroup -Name $VMName -Status -DefaultProfile $AzureContext).Statuses[1].Code
172
164
173
165
Write-Output "`r`n Beginning VM status: $status `r`n"
174
166
175
167
# Start or stop VM based on current state
176
- if($status -eq "Powerstate/deallocated")
177
- {
178
- Start-AzVM -Name $VMName -ResourceGroupName $resourceGroup -DefaultProfile $AzureContext
179
- }
180
- elseif ($status -eq "Powerstate/running")
181
- {
182
- Stop-AzVM -Name $VMName -ResourceGroupName $resourceGroup -DefaultProfile $AzureContext -Force
183
- }
168
+ if ($status -eq "Powerstate/deallocated") {
169
+ Start-AzVM -Name $VMName -ResourceGroupName $ResourceGroup -DefaultProfile $AzureContext
170
+ }
171
+ elseif ($status -eq "Powerstate/running") {
172
+ Stop-AzVM -Name $VMName -ResourceGroupName $ResourceGroup -DefaultProfile $AzureContext -Force
173
+ }
184
174
185
175
# Get new state of VM
186
- $status = (Get-AzVM -ResourceGroupName $resourceGroup -Name $VMName -Status `
187
- -DefaultProfile $AzureContext).Statuses[1].Code
176
+ $status = (Get-AzVM -ResourceGroupName $ResourceGroup -Name $VMName -Status -DefaultProfile $AzureContext).Statuses[1].Code
188
177
189
178
Write-Output "`r`n Ending VM status: $status `r`n `r`n"
190
179
0 commit comments