Skip to content

Commit dae63ba

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #269664 from spelluru/ehubidentity0320
ARM template with system managed identity - capture
2 parents 4267395 + 28e00fa commit dae63ba

File tree

1 file changed

+267
-5
lines changed

1 file changed

+267
-5
lines changed

‎articles/event-hubs/event-hubs-capture-managed-identity.md

Lines changed: 267 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Use managed Identities to capture Azure Event Hubs events
33
description: This article explains how to use managed identities to capture events to a destination such as Azure Blob Storage and Azure Data Lake Storage.
44
ms.topic: article
5-
ms.date: 05/23/2023
5+
ms.date: 03/20/2024
66
---
77

88

@@ -14,16 +14,16 @@ The default authentication method is to use Shared Access Signature(SAS) to acce
1414

1515
:::image type="content" source="./media/event-hubs-capture-overview/event-hubs-capture-default.png" alt-text="Image showing capturing of Event Hubs data into Azure Storage or Azure Data Lake Storage using default SAS authentication mode":::
1616

17-
With this approach, you can capture data to destinations resources that are in the same subscription only.
17+
With this approach, you can capture data to destinations resources that are in the **same subscription** only.
1818

19-
## Use Managed Identity
19+
## Use managed identity
2020
With [managed identity](../active-directory/managed-identities-azure-resources/overview.md), users can seamlessly capture data to a preferred destination by using Microsoft Entra ID based authentication and authorization.
2121

2222
:::image type="content" source="./media/event-hubs-capture-overview/event-hubs-capture-msi.png" alt-text="Image showing capturing of Event Hubs data into Azure Storage or Azure Data Lake Storage using Managed Identity":::
2323

2424
You can use system-assigned or user-assigned managed identities with Event Hubs Capture destinations.
2525

26-
### Use a system-assigned managed identity to capture events
26+
## Use a system-assigned managed identity to capture events
2727
System-assigned Managed Identity is automatically created and associated with an Azure resource, which is an Event Hubs namespace in this case.
2828

2929
To use system assigned identity, the capture destination must have the required role assignment enabled for the corresponding system assigned identity.
@@ -33,8 +33,270 @@ Then you can select `System Assigned` managed identity option when enabling the
3333

3434
Then capture agent would use the identity of the namespace for authentication and authorization with the capture destination.
3535

36+
### Azure Resource Manager template
37+
Here's an example Azure Resource Manager template to configure capturing of data using a system-assigned managed identity.
3638

37-
### Use a user-assigned managed identity to capture events
39+
```json
40+
{
41+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
42+
"contentVersion": "1.0.0.0",
43+
"parameters": {
44+
"namespaces_eventhubcapture_name": {
45+
"defaultValue": "eventhubcapturens",
46+
"type": "String"
47+
},
48+
"captureEnabled": {
49+
"defaultValue": true,
50+
"type": "Bool",
51+
"metadata": {
52+
"description": "Enable or disable the Capture feature for your event hub."
53+
}
54+
},
55+
"captureEncodingFormat": {
56+
"defaultValue": "Avro",
57+
"allowedValues": [
58+
"Avro"
59+
],
60+
"type": "String",
61+
"metadata": {
62+
"description": "The encoding format that Event Hubs Capture uses to serialize the event data when archiving to your storage."
63+
}
64+
},
65+
"captureTime": {
66+
"defaultValue": 300,
67+
"minValue": 60,
68+
"maxValue": 900,
69+
"type": "Int",
70+
"metadata": {
71+
"description": "the time window in seconds for the archival."
72+
}
73+
},
74+
"captureSize": {
75+
"defaultValue": 314572800,
76+
"minValue": 10485760,
77+
"maxValue": 524288000,
78+
"type": "Int",
79+
"metadata": {
80+
"description": "the size window in bytes for the capture."
81+
}
82+
},
83+
"blobContainerName": {
84+
"type": "String",
85+
"metadata": {
86+
"description": "Your existing storage container that you want the blobs archived in."
87+
}
88+
},
89+
"captureNameFormat": {
90+
"defaultValue": "{Namespace}/{EventHub}/{PartitionId}/{Year}/{Month}/{Day}/{Hour}/{Minute}/{Second}",
91+
"type": "String",
92+
"metadata": {
93+
"description": "A Capture Name Format must contain {Namespace}, {EventHub}, {PartitionId}, {Year}, {Month}, {Day}, {Hour}, {Minute} and {Second} fields. These can be arranged in any order with or without delimiters. E.g. Prod_{EventHub}/{Namespace}\\{PartitionId}_{Year}_{Month}/{Day}/{Hour}/{Minute}/{Second}"
94+
}
95+
},
96+
"existingStgSubId": {
97+
"type": "String",
98+
"metadata": {
99+
"description": "The ID of the Azure subscription that has your existing storage account."
100+
}
101+
},
102+
"existingStgAccRG": {
103+
"type": "String",
104+
"metadata": {
105+
"description": "The resource group that has the storage account."
106+
}
107+
},
108+
"existingStgAcctName": {
109+
"type": "String",
110+
"metadata": {
111+
"description": "The name of the storage account."
112+
}
113+
}
114+
},
115+
"variables":
116+
{
117+
"roleAssignmentId": "[guid(resourceId('Microsoft.EventHub/namespaces/',parameters('namespaces_eventhubcapture_name')))]",
118+
"storageBlobDataOwnerId": "[concat(subscription().Id, '/providers/Microsoft.Authorization/roleDefinitions/', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
119+
"ehId": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/', 'Microsoft.EventHub/namespaces/',parameters('namespaces_eventhubcapture_name')) ]",
120+
"existingStorageAcctResourceId" : "[concat('/subscriptions/', parameters('existingStgSubId'), '/resourceGroups/', parameters('existingStgAccRG'), '/providers/', 'Microsoft.Storage/storageAccounts/',parameters('existingStgAcctName')) ]"
121+
},
122+
"resources": [
123+
{
124+
"type": "Microsoft.EventHub/namespaces",
125+
"apiVersion": "2023-01-01-preview",
126+
"name": "[parameters('namespaces_eventhubcapture_name')]",
127+
"location": "eastus",
128+
"sku": {
129+
"name": "Standard",
130+
"tier": "Standard",
131+
"capacity": 1
132+
},
133+
"identity": {
134+
"type": "SystemAssigned"
135+
},
136+
"properties": {
137+
"minimumTlsVersion": "1.2",
138+
"publicNetworkAccess": "Enabled",
139+
"disableLocalAuth": false,
140+
"zoneRedundant": true,
141+
"isAutoInflateEnabled": false,
142+
"maximumThroughputUnits": 0,
143+
"kafkaEnabled": true
144+
}
145+
},
146+
{
147+
"type": "Microsoft.EventHub/namespaces/authorizationrules",
148+
"apiVersion": "2023-01-01-preview",
149+
"name": "[concat(parameters('namespaces_eventhubcapture_name'), '/RootManageSharedAccessKey')]",
150+
"location": "eastus",
151+
"dependsOn": [
152+
"[resourceId('Microsoft.EventHub/namespaces', parameters('namespaces_eventhubcapture_name'))]"
153+
],
154+
"properties": {
155+
"rights": [
156+
"Listen",
157+
"Manage",
158+
"Send"
159+
]
160+
}
161+
},
162+
{
163+
"type": "Microsoft.Resources/deployments",
164+
"apiVersion": "2022-09-01",
165+
"name": "nestedStgTemplate",
166+
"subscriptionId": "[parameters('existingStgSubId')]",
167+
"resourceGroup": "[parameters('existingStgAccRG')]",
168+
"properties": {
169+
"expressionEvaluationOptions": {
170+
"scope": "outer"
171+
},
172+
"mode": "Incremental",
173+
"template": {
174+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
175+
"contentVersion": "1.0.0.0",
176+
"resources": [
177+
{
178+
"type": "Microsoft.Authorization/roleAssignments",
179+
"name": "C0F7F914-0FF9-47B2-9960-1D64D97FF594",
180+
"apiVersion": "2018-01-01-preview",
181+
"scope": "[variables('existingStorageAcctResourceId')]",
182+
"properties": {
183+
"roleDefinitionId": "[variables('storageBlobDataOwnerId')]",
184+
"principalId": "[reference(variables('ehId'), '2021-11-01', 'Full').identity.principalId]"
185+
}
186+
}
187+
]
188+
}
189+
}
190+
},
191+
{
192+
"type": "Microsoft.EventHub/namespaces/eventhubs",
193+
"apiVersion": "2023-01-01-preview",
194+
"name": "[concat(parameters('namespaces_eventhubcapture_name'), '/capture')]",
195+
"location": "eastus",
196+
"dependsOn": [
197+
"[resourceId('Microsoft.EventHub/namespaces', parameters('namespaces_eventhubcapture_name'))]",
198+
"nestedStgTemplate"
199+
],
200+
"properties": {
201+
"retentionDescription": {
202+
"cleanupPolicy": "Delete",
203+
"retentionTimeInHours": 24
204+
},
205+
"messageRetentionInDays": 1,
206+
"partitionCount": 1,
207+
"status": "Active",
208+
"captureDescription": {
209+
"enabled": "[parameters('captureEnabled')]",
210+
"skipEmptyArchives": false,
211+
"encoding": "[parameters('captureEncodingFormat')]",
212+
"intervalInSeconds": "[parameters('captureTime')]",
213+
"sizeLimitInBytes": "[parameters('captureSize')]",
214+
"destination": {
215+
"name": "EventHubArchive.AzureBlockBlob",
216+
"properties": {
217+
"storageAccountResourceId": "[variables('existingStorageAcctResourceId')]",
218+
"blobContainer": "[parameters('blobContainerName')]",
219+
"archiveNameFormat": "[parameters('captureNameFormat')]"
220+
},
221+
"identity": {
222+
"type": "SystemAssigned"
223+
}
224+
}
225+
}
226+
}
227+
},
228+
{
229+
"type": "Microsoft.EventHub/namespaces/networkRuleSets",
230+
"apiVersion": "2023-01-01-preview",
231+
"name": "[concat(parameters('namespaces_eventhubcapture_name'), '/default')]",
232+
"location": "eastus",
233+
"dependsOn": [
234+
"[resourceId('Microsoft.EventHub/namespaces', parameters('namespaces_eventhubcapture_name'))]"
235+
],
236+
"properties": {
237+
"publicNetworkAccess": "Enabled",
238+
"defaultAction": "Allow",
239+
"virtualNetworkRules": [],
240+
"ipRules": []
241+
}
242+
},
243+
{
244+
"type": "Microsoft.EventHub/namespaces/eventhubs/consumergroups",
245+
"apiVersion": "2023-01-01-preview",
246+
"name": "[concat(parameters('namespaces_eventhubcapture_name'), '/capture/$Default')]",
247+
"location": "eastus",
248+
"dependsOn": [
249+
"[resourceId('Microsoft.EventHub/namespaces/eventhubs', parameters('namespaces_eventhubcapture_name'), 'capture')]",
250+
"[resourceId('Microsoft.EventHub/namespaces', parameters('namespaces_eventhubcapture_name'))]"
251+
],
252+
"properties": {}
253+
}
254+
]
255+
}
256+
```
257+
258+
**Parameters.json**:
259+
260+
```json
261+
{
262+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
263+
"contentVersion": "1.0.0.0",
264+
"parameters": {
265+
"namespaces_eventhubcapture_name": {
266+
"value": "NAMESPACENAME"
267+
},
268+
"captureEnabled": {
269+
"value": true
270+
},
271+
"captureEncodingFormat": {
272+
"value": "Avro"
273+
},
274+
"captureTime": {
275+
"value": 300
276+
},
277+
"captureSize": {
278+
"value": 314572800
279+
},
280+
"blobContainerName": {
281+
"value": "BLOBCONTAINERNAME"
282+
},
283+
"captureNameFormat": {
284+
"value": "{Namespace}/{EventHub}/{PartitionId}/{Year}/{Month}/{Day}/{Hour}/{Minute}/{Second}"
285+
},
286+
"existingStgSubId": {
287+
"value": "00000000-0000-0000-0000-00000000000000"
288+
},
289+
"existingStgAccRG": {
290+
"value": "STORAGERESOURCEGROUPNAME"
291+
},
292+
"existingStgAcctName": {
293+
"value": "STORAGEACCOUNTNAME"
294+
}
295+
}
296+
}
297+
```
298+
299+
## Use a user-assigned managed identity to capture events
38300
You can create a user-assigned managed identity and use it for authenticate and authorize with the capture destination of Event hubs. Once the managed identity is created, you can assign it to the Event Hubs namespace and make sure that the capture destination has the required role assignment enabled for the corresponding user assigned identity.
39301

40302
Then you can select `User Assigned` managed identity option when enabling the capture feature in an event hub and assign the required user assigned identity when enabling the capture feature.

0 commit comments

Comments
 (0)