Skip to content

README.md

Latest commit

 

History

History
174 lines (123 loc) · 7.96 KB

README.md

File metadata and controls

174 lines (123 loc) · 7.96 KB

Terraform Deployment

This directory contains Terraform modules and a deployment script for provisioning Azure services in LocalStack for Azure. Refer to the Azure Functions App with Managed Identity guide for details about the sample application.

Prerequisites

Before deploying this solution, ensure you have the following tools installed:

Installing azlocal CLI

The deploy.sh Bash script uses the azlocal CLI instead of the standard Azure CLI to work with LocalStack. Install it using:

pip install azlocal

For more information, see Get started with the az tool on LocalStack.

Architecture Overview

The main.tf Terraform module creates the following Azure resources:

  1. Azure Storage Account: Provides blob storage with input and output containers for storing text blobs processed by the function app.
  2. Azure App Service Plan: Defines the compute resources (CPU, memory, and scaling options) that host the Azure Functions app.
  3. Azure Functions App: Hosts the serverless application that processes text blobs. The function app uses managed identity to securely access the Azure Storage Account without requiring explicit credentials.
  4. Managed Identity: Provides secure, credential-free authentication between the Azure Functions app and storage account. Supports both system-assigned and user-assigned identity types.
  5. Role Assignment: Grants the Azure Functions app's managed identity the Storage Blob Data Contributor and Storage Queue Data Contributor roles, enabling read/write access to blob containers and queues for processing text data.

For more information on the sample application, see Azure Functions App with Managed Identity.

Provisioning Scripts

The deploy.sh script automates the deployment of all Azure resources and the sample application in a single step. Before running the script, customize the variable values based on your needs. In particular, use the MANAGED_IDENTITY_TYPE variable to specify the type of managed identity to provision: SystemAssigned or UserAssigned.

Note
You can use the azlocal CLI as a drop-in replacement for the az CLI to direct all commands to the LocalStack for Azure emulator. Alternatively, run azlocal start-interception to automatically intercept and redirect all az commands to LocalStack. Likewise, the tflocal is a local replacement for the standard terraform CLI, allowing you to run Terraform commands against LocalStack's Azure emulation environment. For more information, see Get started with the az tool on LocalStack.

The deploy.sh script executes the following steps:

  • Cleans up any previous Terraform state and plan files to ensure a fresh deployment
  • Initializes the Terraform working directory and downloads required plugins
  • Creates and validates a Terraform execution plan for the Azure infrastructure
  • Applies the Terraform plan to provision all necessary Azure resources
  • Extracts resource names and outputs from the Terraform deployment
  • Packages the code of the serverless application into a zip file for deployment
  • Deploys the zip package to the Azure Functions App using the LocalStack Azure CLI

Configuration

When using LocalStack for Azure, configure the metadata_host and subscription_id settings in the Azure Provider for Terraform to ensure proper connectivity:

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }

  # Set the hostname of the Azure Metadata Service (for example management.azure.com) 
  # used to obtain the Cloud Environment when using LocalStack's Azure emulator. 
  # This allows the provider to correctly identify the environment and avoid making calls to the real Azure endpoints. 
  metadata_host="localhost.localstack.cloud:4566"

  # Set the subscription ID to a dummy value when using LocalStack's Azure emulator.
  subscription_id = "00000000-0000-0000-0000-000000000000"
}

Deployment

You can set up the Azure emulator by utilizing LocalStack for Azure Docker image. Before starting, ensure you have a valid LOCALSTACK_AUTH_TOKEN to access the Azure emulator. Refer to the Auth Token guide to obtain your Auth Token and specify it in the LOCALSTACK_AUTH_TOKEN environment variable. The Azure Docker image is available on the LocalStack Docker Hub. To pull the Azure Docker image, execute the following command:

docker pull localstack/localstack-azure-alpha

Start the LocalStack Azure emulator using the localstack CLI, execute the following command:

# Set the authentication token
export LOCALSTACK_AUTH_TOKEN=<your_auth_token>

# Start the LocalStack Azure emulator
IMAGE_NAME=localstack/localstack-azure-alpha localstack start -d
localstack wait -t 60

# Route all Azure CLI calls to the LocalStack Azure emulator
azlocal start-interception

Navigate to the terraform folder:

cd samples/function-app-managed-identity/python/terraform

Make the script executable:

chmod +x deploy.sh

Run the deployment script:

./deploy.sh

Validation

After deployment, you can use the validate.sh script to verify that all resources were created and configured correctly:

#!/bin/bash

# Variables
# Check resource group
az group show \
  --name local-rg \
  --output table

# List resources
az resource list \
  --resource-group local-rg \
  --output table

# Check function app status
az functionapp show  \
  --name local-func-test \
  --resource-group local-rg \
  --output table

# Check storage account properties
az storage account show \
  --name localstoragetest \
  --resource-group local-rg \
  --output table

# List storage containers
az storage container list \
  --account-name localstoragetest \
  --output table \
  --only-show-errors

Cleanup

To destroy all created resources:

# Delete resource group and all contained resources
az group delete --name local-rg --yes --no-wait

# Verify deletion
az group list --output table

This will remove all Azure resources created by the CLI deployment script.

Related Documentation