Skip to content

Commit 8563d9d

Browse files
spelluruspelluru
committed
ARM template with system managed identity - capture
1 parent a95c3b5 commit 8563d9d

File tree

1 file changed

+264
-2
lines changed

1 file changed

+264
-2
lines changed

‎articles/event-hubs/event-hubs-capture-managed-identity.md

Lines changed: 264 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Use managed Identities to capture Azure Event Hubs events
33
description: This article explains how to use managed identities to capture events to a destination such as Azure Blob Storage and Azure Data Lake Storage.
44
ms.topic: article
5-
ms.date: 05/23/2023
5+
ms.date: 03/20/2024
66
---
77

88

@@ -14,7 +14,7 @@ The default authentication method is to use Shared Access Signature(SAS) to acce
1414

1515
:::image type="content" source="./media/event-hubs-capture-overview/event-hubs-capture-default.png" alt-text="Image showing capturing of Event Hubs data into Azure Storage or Azure Data Lake Storage using default SAS authentication mode":::
1616

17-
With this approach, you can capture data to destinations resources that are in the same subscription only.
17+
With this approach, you can capture data to destinations resources that are in the **same subscription** only.
1818

1919
## Use Managed Identity
2020
With [managed identity](../active-directory/managed-identities-azure-resources/overview.md), users can seamlessly capture data to a preferred destination by using Microsoft Entra ID based authentication and authorization.
@@ -33,6 +33,268 @@ Then you can select `System Assigned` managed identity option when enabling the
3333

3434
Then capture agent would use the identity of the namespace for authentication and authorization with the capture destination.
3535

36+
### Azure Resource Manager template
37+
Here's an example Azure Resource Manager template to configure capturing of data using a system-assigned managed identity.
38+
39+
```json
40+
{
41+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
42+
"contentVersion": "1.0.0.0",
43+
"parameters": {
44+
"namespaces_eventhubcapture_name": {
45+
"defaultValue": "eventhubcapturens",
46+
"type": "String"
47+
},
48+
"captureEnabled": {
49+
"defaultValue": true,
50+
"type": "Bool",
51+
"metadata": {
52+
"description": "Enable or disable the Capture feature for your event hub."
53+
}
54+
},
55+
"captureEncodingFormat": {
56+
"defaultValue": "Avro",
57+
"allowedValues": [
58+
"Avro"
59+
],
60+
"type": "String",
61+
"metadata": {
62+
"description": "The encoding format that Event Hubs Capture uses to serialize the event data when archiving to your storage."
63+
}
64+
},
65+
"captureTime": {
66+
"defaultValue": 300,
67+
"minValue": 60,
68+
"maxValue": 900,
69+
"type": "Int",
70+
"metadata": {
71+
"description": "the time window in seconds for the archival."
72+
}
73+
},
74+
"captureSize": {
75+
"defaultValue": 314572800,
76+
"minValue": 10485760,
77+
"maxValue": 524288000,
78+
"type": "Int",
79+
"metadata": {
80+
"description": "the size window in bytes for the capture."
81+
}
82+
},
83+
"blobContainerName": {
84+
"type": "String",
85+
"metadata": {
86+
"description": "Your existing storage container that you want the blobs archived in."
87+
}
88+
},
89+
"captureNameFormat": {
90+
"defaultValue": "{Namespace}/{EventHub}/{PartitionId}/{Year}/{Month}/{Day}/{Hour}/{Minute}/{Second}",
91+
"type": "String",
92+
"metadata": {
93+
"description": "A Capture Name Format must contain {Namespace}, {EventHub}, {PartitionId}, {Year}, {Month}, {Day}, {Hour}, {Minute} and {Second} fields. These can be arranged in any order with or without delimiters. E.g. Prod_{EventHub}/{Namespace}\\{PartitionId}_{Year}_{Month}/{Day}/{Hour}/{Minute}/{Second}"
94+
}
95+
},
96+
"existingStgSubId": {
97+
"type": "String",
98+
"metadata": {
99+
"description": "The ID of the Azure subscription that has your existing storage account."
100+
}
101+
},
102+
"existingStgAccRG": {
103+
"type": "String",
104+
"metadata": {
105+
"description": "The resource group that has the storage account."
106+
}
107+
},
108+
"existingStgAcctName": {
109+
"type": "String",
110+
"metadata": {
111+
"description": "The name of the storage account."
112+
}
113+
}
114+
},
115+
"variables":
116+
{
117+
"roleAssignmentId": "[guid(resourceId('Microsoft.EventHub/namespaces/',parameters('namespaces_eventhubcapture_name')))]",
118+
"storageBlobDataOwnerId": "[concat(subscription().Id, '/providers/Microsoft.Authorization/roleDefinitions/', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
119+
"ehId": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/', 'Microsoft.EventHub/namespaces/',parameters('namespaces_eventhubcapture_name')) ]",
120+
"existingStorageAcctResourceId" : "[concat('/subscriptions/', parameters('existingStgSubId'), '/resourceGroups/', parameters('existingStgAccRG'), '/providers/', 'Microsoft.Storage/storageAccounts/',parameters('existingStgAcctName')) ]"
121+
},
122+
"resources": [
123+
{
124+
"type": "Microsoft.EventHub/namespaces",
125+
"apiVersion": "2023-01-01-preview",
126+
"name": "[parameters('namespaces_eventhubcapture_name')]",
127+
"location": "eastus",
128+
"sku": {
129+
"name": "Standard",
130+
"tier": "Standard",
131+
"capacity": 1
132+
},
133+
"identity": {
134+
"type": "SystemAssigned"
135+
},
136+
"properties": {
137+
"minimumTlsVersion": "1.2",
138+
"publicNetworkAccess": "Enabled",
139+
"disableLocalAuth": false,
140+
"zoneRedundant": true,
141+
"isAutoInflateEnabled": false,
142+
"maximumThroughputUnits": 0,
143+
"kafkaEnabled": true
144+
}
145+
},
146+
{
147+
"type": "Microsoft.EventHub/namespaces/authorizationrules",
148+
"apiVersion": "2023-01-01-preview",
149+
"name": "[concat(parameters('namespaces_eventhubcapture_name'), '/RootManageSharedAccessKey')]",
150+
"location": "eastus",
151+
"dependsOn": [
152+
"[resourceId('Microsoft.EventHub/namespaces', parameters('namespaces_eventhubcapture_name'))]"
153+
],
154+
"properties": {
155+
"rights": [
156+
"Listen",
157+
"Manage",
158+
"Send"
159+
]
160+
}
161+
},
162+
{
163+
"type": "Microsoft.Resources/deployments",
164+
"apiVersion": "2022-09-01",
165+
"name": "nestedStgTemplate",
166+
"subscriptionId": "[parameters('existingStgSubId')]",
167+
"resourceGroup": "[parameters('existingStgAccRG')]",
168+
"properties": {
169+
"expressionEvaluationOptions": {
170+
"scope": "outer"
171+
},
172+
"mode": "Incremental",
173+
"template": {
174+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
175+
"contentVersion": "1.0.0.0",
176+
"resources": [
177+
{
178+
"type": "Microsoft.Authorization/roleAssignments",
179+
"name": "C0F7F914-0FF9-47B2-9960-1D64D97FF594",
180+
"apiVersion": "2018-01-01-preview",
181+
"scope": "[variables('existingStorageAcctResourceId')]",
182+
"properties": {
183+
"roleDefinitionId": "[variables('storageBlobDataOwnerId')]",
184+
"principalId": "[reference(variables('ehId'), '2021-11-01', 'Full').identity.principalId]"
185+
}
186+
}
187+
]
188+
}
189+
}
190+
},
191+
{
192+
"type": "Microsoft.EventHub/namespaces/eventhubs",
193+
"apiVersion": "2023-01-01-preview",
194+
"name": "[concat(parameters('namespaces_eventhubcapture_name'), '/capture')]",
195+
"location": "eastus",
196+
"dependsOn": [
197+
"[resourceId('Microsoft.EventHub/namespaces', parameters('namespaces_eventhubcapture_name'))]",
198+
"nestedStgTemplate"
199+
],
200+
"properties": {
201+
"retentionDescription": {
202+
"cleanupPolicy": "Delete",
203+
"retentionTimeInHours": 24
204+
},
205+
"messageRetentionInDays": 1,
206+
"partitionCount": 1,
207+
"status": "Active",
208+
"captureDescription": {
209+
"enabled": "[parameters('captureEnabled')]",
210+
"skipEmptyArchives": false,
211+
"encoding": "[parameters('captureEncodingFormat')]",
212+
"intervalInSeconds": "[parameters('captureTime')]",
213+
"sizeLimitInBytes": "[parameters('captureSize')]",
214+
"destination": {
215+
"name": "EventHubArchive.AzureBlockBlob",
216+
"properties": {
217+
"storageAccountResourceId": "[variables('existingStorageAcctResourceId')]",
218+
"blobContainer": "[parameters('blobContainerName')]",
219+
"archiveNameFormat": "[parameters('captureNameFormat')]"
220+
},
221+
"identity": {
222+
"type": "SystemAssigned"
223+
}
224+
}
225+
}
226+
}
227+
},
228+
{
229+
"type": "Microsoft.EventHub/namespaces/networkRuleSets",
230+
"apiVersion": "2023-01-01-preview",
231+
"name": "[concat(parameters('namespaces_eventhubcapture_name'), '/default')]",
232+
"location": "eastus",
233+
"dependsOn": [
234+
"[resourceId('Microsoft.EventHub/namespaces', parameters('namespaces_eventhubcapture_name'))]"
235+
],
236+
"properties": {
237+
"publicNetworkAccess": "Enabled",
238+
"defaultAction": "Allow",
239+
"virtualNetworkRules": [],
240+
"ipRules": []
241+
}
242+
},
243+
{
244+
"type": "Microsoft.EventHub/namespaces/eventhubs/consumergroups",
245+
"apiVersion": "2023-01-01-preview",
246+
"name": "[concat(parameters('namespaces_eventhubcapture_name'), '/capture/$Default')]",
247+
"location": "eastus",
248+
"dependsOn": [
249+
"[resourceId('Microsoft.EventHub/namespaces/eventhubs', parameters('namespaces_eventhubcapture_name'), 'capture')]",
250+
"[resourceId('Microsoft.EventHub/namespaces', parameters('namespaces_eventhubcapture_name'))]"
251+
],
252+
"properties": {}
253+
}
254+
]
255+
}
256+
```
257+
258+
**Parameters.json**:
259+
260+
```json
261+
{
262+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
263+
"contentVersion": "1.0.0.0",
264+
"parameters": {
265+
"namespaces_eventhubcapture_name": {
266+
"value": "NAMESPACENAME"
267+
},
268+
"captureEnabled": {
269+
"value": true
270+
},
271+
"captureEncodingFormat": {
272+
"value": "Avro"
273+
},
274+
"captureTime": {
275+
"value": 300
276+
},
277+
"captureSize": {
278+
"value": 314572800
279+
},
280+
"blobContainerName": {
281+
"value": "BLOBCONTAINERNAME"
282+
},
283+
"captureNameFormat": {
284+
"value": "{Namespace}/{EventHub}/{PartitionId}/{Year}/{Month}/{Day}/{Hour}/{Minute}/{Second}"
285+
},
286+
"existingStgSubId": {
287+
"value": "00000000-0000-0000-0000-00000000000000"
288+
},
289+
"existingStgAccRG": {
290+
"value": "STORAGERESOURCEGROUPNAME"
291+
},
292+
"existingStgAcctName": {
293+
"value": "STORAGEACCOUNTNAME"
294+
}
295+
}
296+
}
297+
```
36298

37299
### Use a user-assigned managed identity to capture events
38300
You can create a user-assigned managed identity and use it for authenticate and authorize with the capture destination of Event hubs. Once the managed identity is created, you can assign it to the Event Hubs namespace and make sure that the capture destination has the required role assignment enabled for the corresponding user assigned identity.

0 commit comments

Comments
 (0)