How to deploy private ARM template with SAS token

  • Article

When your Azure Resource Manager template (ARM template) is located in a storage account, you can restrict access to the template to avoid exposing it publicly. You access a secured template by creating a shared access signature (SAS) token for the template, and providing that token during deployment. This article explains how to use Azure PowerShell or Azure CLI to securely deploy an ARM template with a SAS token.

You will find information on how to protect and manage access to your private ARM templates with directions on how to do the following:

  • Create storage account with secured container
  • Upload template to storage account
  • Provide SAS token during deployment

Important

Instead of securing your private template with a SAS token, consider using template specs. With template specs, you can share your templates with other users in your organization and manage access to the templates through Azure RBAC.

Create storage account with secured container

The following script creates a storage account and container with public access turned off for template security.

Connect-AzAccount -Environment AzureChinaCloud

New-AzResourceGroup `
  -Name ExampleGroup `
  -Location "China North"
New-AzStorageAccount `
  -ResourceGroupName ExampleGroup `
  -Name {your-unique-name} `
  -Type Standard_LRS `
  -Location "China North"
Set-AzCurrentStorageAccount `
  -ResourceGroupName ExampleGroup `
  -Name {your-unique-name}
New-AzStorageContainer `
  -Name templates `
  -Permission Off

Upload private template to storage account

Now, you're ready to upload your template to the storage account. Provide the path to the template you want to use.

Set-AzStorageBlobContent `
  -Container templates `
  -File c:\Templates\azuredeploy.json

Provide SAS token during deployment

To deploy a private template in a storage account, generate a SAS token and include it in the URI for the template. Set the expiry time to allow enough time to complete the deployment.

Important

The blob containing the private template is accessible to only the account owner. However, when you create a SAS token for the blob, the blob is accessible to anyone with that URI. If another user intercepts the URI, that user is able to access the template. A SAS token is a good way of limiting access to your templates, but you should not include sensitive data like passwords directly in the template.

# get the URI with the SAS token
$templateuri = New-AzStorageBlobSASToken `
  -Container templates `
  -Blob azuredeploy.json `
  -Permission r `
  -ExpiryTime (Get-Date).AddHours(2.0) -FullUri

# provide URI with SAS token during deployment
New-AzResourceGroupDeployment `
  -ResourceGroupName ExampleGroup `
  -TemplateUri $templateuri

For an example of using a SAS token with linked templates, see Using linked templates with Azure Resource Manager.

Next steps