Start and stop Azure VMs without access to Microsoft Azure

Imagine you want to provide specific users with the ability to start and stop VMs, but you do not want to provide access for them to the Azure portal. Then you can use Azure Automation with webhooks.

First create an Azure Automation account in the region of your choice. Make sure that the option “Create Azure Run As account” is enabled.

VMStartStopVMStartStop02

After the successful creation of the Automation account, go to the specific VMs the user will use and add tags to them. For example use a tag to specify the owner of the VM, so you can use it later in the runbook.

VMStartStop03

Now create the scripts for the VM start and the VM stop actions.

Start VM

$connectionName = "AzureRunAsConnection"
$servicePrincipalConnection=Get-AutomationConnection -Name $connectionName
$null=Add-AzureRmAccount -ServicePrincipal -TenantId $servicePrincipalConnection.TenantId -ApplicationId $servicePrincipalConnection.ApplicationId -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint
$VMs=Get-AzureRmResource|Where-Object{$_.Tags.Keys -eq "owner" -and $_.Tags.Values -eq "daneum"}
foreach($VM in $VMs) {
if ($VM.ResourceType -eq "Microsoft.Compute/virtualMachines") {
Start-AzureRmVM -ResourceGroupName $VM.ResourceGroupName -Name $VM.Name -Verbose
}
}

VMStartStop04

Stop VM

$connectionName = "AzureRunAsConnection"
$servicePrincipalConnection=Get-AutomationConnection -Name $connectionName
$null=Add-AzureRmAccount -ServicePrincipal -TenantId $servicePrincipalConnection.TenantId -ApplicationId $servicePrincipalConnection.ApplicationId -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint
$VMs=Get-AzureRmResource|Where-Object{$_.Tags.Keys -eq "owner" -and $_.Tags.Values -eq "daneum"}
foreach($VM in $VMs) {
if ($VM.ResourceType -eq "Microsoft.Compute/virtualMachines") {
Stop-AzureRmVM -ResourceGroupName $VM.ResourceGroupName -Name $VM.Name -Force -Verbose
}
}

Next step is to upload the scripts into the Automation account to create the runbooks.

VMStartStop05

Publish them and create a webhook for each of them.

VMStartStop06VMStartStop07

Set an appropriate expiration date and make sure you have copied the webhook URL. You will not have access to the URL after you hit OK. Otherwise you can create a new one.

Before you test the webhook call, you have to import the AzureRM.Tags module through the gallery. But you are not finished. You also have to update the modules AzureRM.Profile, AzureRM.Resources and AzureRM.Compute. So they have the same version as the newly imported module AzureRM.Tags. If you do not do that, your runbooks will not run.

VMStartStop00000VMStartStop0000VMStartStop000VMStartStop00

Finally you can create the PowerShell scripts for the user to call the webhooks with them.

Start VM

Invoke-WebRequest -Method Post -Uri https://s5events.azure-automation.net/webhooks?token=xxxxxxxx

Stop VM

Invoke-WebRequest -Method Post -Uri https://s5events.azure-automation.net/webhooks?token=yyyyyyyy

Important is the option -Method with the value Post, because Azure Automation webhooks can only be called with the Post method.

Now run the PowerShell script for the VM start to call the webhook.

VMStartStop08

You are now ready to provide the PowerShell scripts for the webhook calling to the user and the user does not need any access to the Azure subscription.

Facebooktwittergoogle_pluslinkedinmail

One thought on “Start and stop Azure VMs without access to Microsoft Azure

  1. Pingback: Virtualization – Tech Guide

Leave a Reply