azure
Core cloud services from Microsoft Azure.
total services: 268
total resources: 3741
See also:
[SHOW] [DESCRIBE] [REGISTRY]
Installation
To pull the latest version of the azure provider, run the following command:
REGISTRY PULL azure;
To view previous provider versions or to pull a specific provider version, see here.
Authentication
StackQL uses Azure application credentials obtained using the az login command from the Azure SDK. For more information, see here.
Authenticating using an Azure Service Principal
To authenticate using an Azure Service Principal, set the following environment variables: AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET, see creating-an-azure-service-principal.
Example Queries
Try the following queries using stackql shell, or run them from a script or CI pipeline with stackql exec.
Resource groups in a subscription
Name, location, provisioning state and tags for every resource group:
SELECT name, location, provisioning_state, tags
FROM azure.resource.resource_groups
WHERE subscription_id = '{{ subscription_id }}'
ORDER BY name;
Virtual machines by size and state
Every virtual machine in the subscription with its size, OS type, provisioning state and zones, read from the nested hardware_profile and storage_profile columns with json_extract:
SELECT name, location,
json_extract(hardware_profile, '$.vmSize') AS vm_size,
json_extract(storage_profile, '$.osDisk.osType') AS os_type,
provisioning_state, zones
FROM azure.compute.virtual_machines
WHERE subscription_id = '{{ subscription_id }}'
ORDER BY location, name;
Storage accounts
SKU, kind and the access settings that security reviews usually check, for every storage account:
SELECT name, location, kind,
json_extract(sku, '$.name') AS sku_name,
access_tier, minimum_tls_version,
allow_blob_public_access, public_network_access,
provisioning_state
FROM azure.storage.storage_accounts
WHERE subscription_id = '{{ subscription_id }}'
ORDER BY name;
Virtual networks and subnets
Address space and subnet count for every virtual network, then the subnets of one network with their prefixes and attached network security group:
SELECT name, location,
json_extract(address_space, '$.addressPrefixes') AS address_prefixes,
json_array_length(subnets) AS subnet_count,
enable_ddos_protection, provisioning_state
FROM azure.network.virtual_networks
WHERE subscription_id = '{{ subscription_id }}'
ORDER BY name;
SELECT name, address_prefix,
json_extract(network_security_group, '$.id') AS nsg_id,
provisioning_state
FROM azure.network.subnets
WHERE subscription_id = '{{ subscription_id }}'
AND resource_group_name = '{{ resource_group_name }}'
AND virtual_network_name = '{{ virtual_network_name }}';
Key vaults in a resource group
Soft delete, purge protection, RBAC authorization and public network access for each vault in a resource group (the resource group scope is the one that returns the vault properties):
SELECT name, location,
json_extract(sku, '$.name') AS sku_name,
enable_soft_delete, enable_purge_protection,
enable_rbac_authorization, public_network_access,
vault_uri
FROM azure.key_vault.vaults
WHERE subscription_id = '{{ subscription_id }}'
AND resource_group_name = '{{ resource_group_name }}';
AKS clusters
Kubernetes version, node pool count and power state for every managed cluster:
SELECT name, location,
kubernetes_version, current_kubernetes_version,
dns_prefix, node_resource_group,
json_array_length(agent_pool_profiles) AS node_pools,
json_extract(power_state, '$.code') AS power_state_code,
provisioning_state
FROM azure.container_service.managed_clusters
WHERE subscription_id = '{{ subscription_id }}';
Role assignments with role names
Which principal holds which role at which scope, joining each assignment to its role definition for the display name:
SELECT a.principal_id, a.principal_type, d.role_name, a.scope, a.created_on
FROM azure.authorization.role_assignments a
JOIN azure.authorization.role_definitions d
ON d.id = a.role_definition_id
WHERE a.subscription_id = '{{ subscription_id }}'
AND d.scope = 'subscriptions/{{ subscription_id }}'
ORDER BY d.role_name, a.principal_type;
Resources by tag
Resource count by type for everything tagged environment=prod, with the tag filter pushed to the API through the $filter parameter:
SELECT type, COUNT(*) AS resource_count
FROM azure.resource.resources
WHERE subscription_id = '{{ subscription_id }}'
AND $filter = 'tagName eq ''environment'' and tagValue eq ''prod'''
GROUP BY type
ORDER BY resource_count DESC;
Create and delete a resource group
Create a tagged resource group, then remove it (deleting a resource group also deletes everything inside it):
INSERT INTO azure.resource.resource_groups (resource_group_name, subscription_id, location, tags)
SELECT '{{ resource_group_name }}', '{{ subscription_id }}', 'eastus', '{"environment": "dev"}';
DELETE FROM azure.resource.resource_groups
WHERE resource_group_name = '{{ resource_group_name }}'
AND subscription_id = '{{ subscription_id }}';
Virtual machine lifecycle
start, restart and redeploy are EXEC methods on virtual_machines, keyed by resource group, VM name and subscription:
EXEC azure.compute.virtual_machines.start
@resource_group_name = '{{ resource_group_name }}',
@vm_name = '{{ vm_name }}',
@subscription_id = '{{ subscription_id }}';
Services
advisor
ai_agents
ai_anomaly_detector
ai_content_safety
ai_content_understanding
ai_discovery
ai_document_intelligence
ai_evaluation
ai_form_recognizer
ai_inference
ai_language
ai_personalizer
ai_projects
ai_text_analytics
ai_text_analytics_authoring
ai_transcription
ai_translation_document
ai_translation_text
ai_vision_face
ai_vision_image_analysis
ai_voice_live
alerts_management
api_center
api_management
app
app_configuration
app_configuration_dataplane
app_containers
app_network
application_insights
artifact_signing
attestation
authorization
automanage
automation
avs
azure_arc_data
bare_metal_infrastructure
batch
batch_dataplane
billing
billing_benefits
blueprints
bot_service
carbon_optimization
cdn
certificate_registration
change_analysis
chaos
cloud_health
cognitive_services
communication
communication_call_automation
communication_chat
communication_email
communication_identity
communication_job_router
communication_messages
communication_phone_numbers
communication_rooms
communication_sms
compute
compute_bulk_actions
compute_fleet
compute_limit
compute_recommender
compute_schedule
confidential_ledger
confidential_ledger_certificate
confidential_ledger_dataplane
connected_vmware
consumption
container_instance
container_orchestrator_runtime
container_registry
container_registry_dataplane
container_registry_tasks
container_service
container_service_fleet
container_service_safeguards
cosmosdb
cosmosdb_for_postgresql
cost_management
custom_providers
dashboard
data_box
data_box_edge
data_factory
data_migration
data_protection
data_share
data_tables
database_watcher
datalake_analytics
datalake_store
defender_easm
defender_easm_dataplane
dependency_map
desktop_virtualization
dev_test_labs
devcenter
developer_devcenter
developer_loadtesting
device_registry
device_update
devops_infrastructure
digital_twins
digital_twins_core
discovery
dns
dns_resolver
domain_registration
durable_task
edge_actions
edge_gateway
edge_zones
elastic_san
event_grid
event_grid_dataplane
event_hub
extended_location
fabric
file_shares
fluid_relay
front_door
guest_config
hardware_security_modules
hdinsight
horizon_db
hybrid_compute
hybrid_connectivity
hybrid_container_service
hybrid_kubernetes
impact_reporting
iot_device_provisioning
iot_hub
iot_hub_provisioning_services
iot_operations
key_vault
key_vault_administration
key_vault_certificates
key_vault_keys
key_vault_secrets
key_vault_security_domain
kubernetes_configuration
kusto
large_instance
load_testing
log_analytics
logic
machine_learning_compute
machine_learning_services
maintenance
managed_applications
managed_ops
managed_services
management_groups
maps
maps_geolocation
maps_render
maps_route
maps_search
maps_timezone
maps_weather
marketplace_ordering
messaging_webpubsubservice
migration_assessment
mongo_cluster
monitor
monitor_ingestion
monitor_opentelemetry_exporter
monitor_query
monitor_query_metrics
monitor_slis
monitor_workspaces
msi
mysql_flexible_servers
netapp
network
network_function
notification_hubs
online_experimentation
online_experimentation_dataplane
operations_management
peering
planetary_computer
planetary_computer_dataplane
playwright
playwright_testing
policy_insights
portal
postgresql_flexible_servers
power_bi_dedicated
power_bi_embedded
private_dns
purview
purview_administration
purview_catalog
purview_data_map
purview_scanning
purview_sharing
purview_workflow
quantum
quota
recovery_services
recovery_services_backup
recovery_services_backup_passive_stamp
recovery_services_data_replication
recovery_services_site_recovery
red_hat_openshift
redis
redis_enterprise
relationships
relay
reservations
resilience_management
resource
resource_connector
resource_graph
resource_health
resource_mover
schema_registry
scvmm
search
search_documents
secrets_store_extension
security
security_attestation
security_devops
security_insight
serial_console
service_bus
service_fabric
service_fabric_dataplane
service_fabric_managed_clusters
service_groups
service_linker
service_networking
signalr
site_manager
sql
sql_virtual_machine
standby_pool
storage
storage_actions
storage_blob
storage_cache
storage_discovery
storage_file_datalake
storage_file_share
storage_mover
storage_queue
storage_sync
stream_analytics
subscription
support
synapse
synapse_access_control
synapse_artifacts
synapse_managed_private_endpoints
synapse_monitoring
synapse_spark
traffic_manager
web
web_pubsub
workload_orchestration