Top / Microsoft Azure / Azure Container / Group

Azure Container Group

This page shows how to write Terraform and Azure Resource Manager for Container Group and write them securely.

terraform-logo

Review your .tf file for Azure best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).

azurerm_container_group (Terraform)

The Group in Container can be configured in Terraform with the resource name azurerm_container_group. The following sections describe 9 examples of how to use the resource and its parameters.

Example Usage from GitHub

main.tf#L36
resource "azurerm_container_group" "common-instances" {
  for_each = var.common_instance
  name                = each.value.name
  location            = azurerm_resource_group.rg_splunk.location
  resource_group_name = azurerm_resource_group.rg_splunk.name
  ip_address_type     = "public"
main.tf#L11
resource "azurerm_container_group" "tfcg_test" {
    name                        = "yogissvcgrp"
    location                    = azurerm_resource_group.tf_test.location
    resource_group_name         = azurerm_resource_group.tf_test.name
    ip_address_type             = "public"
    dns_name_label              = "yogisapis"
main.tf#L11
resource "azurerm_container_group" "tfcg_amazingrace"{
    name                        = "amazingracebill"
    location                    = azurerm_resource_group.tf_amazingrace.location
    resource_group_name         = azurerm_resource_group.tf_amazingrace.name

    ip_address_type             = "public"
api-aci.tf#L1
resource "azurerm_container_group" "weatherforecast-api" {
  name                = "weatherforecast-api"
  location            = var.LOCATION
  resource_group_name = var.RESOURCE_GROUP_NAME

  ip_address_type = "private"
containerinstance.tf#L11
resource "azurerm_container_group" "aci" {
  name                = "aci-sitetreinamentotf"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name

  ip_address_type = "public"
hide-n-seek.tf#L19
resource "azurerm_container_group" "hide_n_seek_containers" {
  name                = "HideNSeekContainer"
  location            = azurerm_resource_group.hide_n_seek.location
  resource_group_name = azurerm_resource_group.hide_n_seek.name
  # can be accessed via hidenseek.eastus.azurecontainer.io
  dns_name_label      = "hidenseek"
aci.tf#L6
resource "azurerm_container_group" "container_group1" {
  count               = var.container_group1_count
  name                = var.container_group1_name
  location            = azurerm_resource_group.container_rg.location
  resource_group_name = azurerm_resource_group.container_rg.name
  ip_address_type     = var.ip_address_type
main.tf#L20
resource "azurerm_container_group" "tfcg_test" {
  name                      = "weatherapi"
  location                  = azurerm_resource_group.tf_test.location
  resource_group_name       = azurerm_resource_group.tf_test.name

  ip_address_type     = "public"
main.tf#L19
resource "azurerm_container_group" "tfcg_test" {
name                   = "weatherapi"
location               = azurerm_resource_group.tf_test.location
resource_group_name    = azurerm_resource_group.tf_test.name

  ip_address_type     = "public"

Review your Terraform file for Azure best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).

Parameters

>> from Terraform Registry

Explanation in Terraform Registry

Manages as an Azure Container Group instance.

>> from Terraform Registry

Tips: Best Practices for The Other Azure Container Resources

In addition to the azurerm_kubernetes_cluster, Azure Container has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

risk-label

azurerm_kubernetes_cluster

Ensure to enable logging for AKS

It is better to enable AKS logging to Azure Monitoring. This provides useful information regarding access and usage.

Review your Azure Container settings

In addition to the above, there are other security points you should be aware of making sure that your .tf files are protected in Shisho Cloud.

Microsoft.ContainerInstance/containerGroups (Azure Resource Manager)

The containerGroups in Microsoft.ContainerInstance can be configured in Azure Resource Manager with the resource name Microsoft.ContainerInstance/containerGroups. The following sections describe how to use the resource and its parameters.

Example Usage from GitHub

template.json
{
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workbookDisplayName": {
      "type": "string",
template.json
{
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workbookDisplayName": {
      "type": "string",
template.json
{
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workbookDisplayName": {
      "type": "string",
dash.json
{
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workbookDisplayName": {
      "type": "string",

Parameters

  • apiVersion required - string
  • identity optional
      • type optional - string

        The type of identity used for the container group. The type 'SystemAssigned, UserAssigned' includes both an implicitly created identity and a set of user assigned identities. The type 'None' will remove any identities from the container group.

      • userAssignedIdentities optional - undefined

        The list of user identities associated with the container group. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.

  • location optional - string

    The resource location.

  • name required - string

    The name of the container group.

  • properties required
      • containers required array
          • name required - string

            The user-provided name of the container instance.

          • properties required
              • command optional - array

                The commands to execute within the container instance in exec form.

              • environmentVariables optional array
                  • name required - string

                    The name of the environment variable.

                  • secureValue optional - string

                    The value of the secure environment variable.

                  • value optional - string

                    The value of the environment variable.

              • image required - string

                The name of the image used to create the container instance.

              • livenessProbe optional
                  • exec optional
                      • command optional - array

                        The commands to execute within the container.

                  • failureThreshold optional - integer

                    The failure threshold.

                  • httpGet optional
                      • httpHeaders optional array
                          • name optional - string

                            The header name.

                          • value optional - string

                            The header value.

                      • path optional - string

                        The path to probe.

                      • port required - integer

                        The port number to probe.

                      • scheme optional - string

                        The scheme.

                  • initialDelaySeconds optional - integer

                    The initial delay seconds.

                  • periodSeconds optional - integer

                    The period seconds.

                  • successThreshold optional - integer

                    The success threshold.

                  • timeoutSeconds optional - integer

                    The timeout seconds.

              • ports optional array
                  • port required - integer

                    The port number exposed within the container group.

                  • protocol optional - string

                    The protocol associated with the port.

              • readinessProbe optional
                  • exec optional
                      • command optional - array

                        The commands to execute within the container.

                  • failureThreshold optional - integer

                    The failure threshold.

                  • httpGet optional
                      • httpHeaders optional array
                          • name optional - string

                            The header name.

                          • value optional - string

                            The header value.

                      • path optional - string

                        The path to probe.

                      • port required - integer

                        The port number to probe.

                      • scheme optional - string

                        The scheme.

                  • initialDelaySeconds optional - integer

                    The initial delay seconds.

                  • periodSeconds optional - integer

                    The period seconds.

                  • successThreshold optional - integer

                    The success threshold.

                  • timeoutSeconds optional - integer

                    The timeout seconds.

              • volumeMounts optional array
                  • mountPath required - string

                    The path within the container where the volume should be mounted. Must not contain colon (:).

                  • name required - string

                    The name of the volume mount.

                  • readOnly optional - boolean

                    The flag indicating whether the volume mount is read-only.

      • diagnostics optional
          • logAnalytics optional
              • logType optional - string

                The log type to be used.

              • metadata optional - string

                Metadata for log analytics.

              • workspaceId required - string

                The workspace id for log analytics

              • workspaceKey required - string

                The workspace key for log analytics

              • workspaceResourceId optional - string

                The workspace resource id for log analytics

      • dnsConfig optional
          • nameServers required - array

            The DNS servers for the container group.

          • options optional - string

            The DNS options for the container group.

          • searchDomains optional - string

            The DNS search domains for hostname lookup in the container group.

      • encryptionProperties optional
          • keyName required - string

            The encryption key name.

          • keyVersion required - string

            The encryption key version.

          • vaultBaseUrl required - string

            The keyvault base url.

      • imageRegistryCredentials optional array
          • identity optional - string

            The identity for the private registry.

          • identityUrl optional - string

            The identity URL for the private registry.

          • password optional - string

            The password for the private registry.

          • server required - string

            The Docker image registry server without a protocol such as "http" and "https".

          • username required - string

            The username for the private registry.

      • initContainers optional array
          • name required - string

            The name for the init container.

          • properties required
              • command optional - array

                The command to execute within the init container in exec form.

              • environmentVariables optional array
                  • name required - string

                    The name of the environment variable.

                  • secureValue optional - string

                    The value of the secure environment variable.

                  • value optional - string

                    The value of the environment variable.

              • image optional - string

                The image of the init container.

              • volumeMounts optional array
                  • mountPath required - string

                    The path within the container where the volume should be mounted. Must not contain colon (:).

                  • name required - string

                    The name of the volume mount.

                  • readOnly optional - boolean

                    The flag indicating whether the volume mount is read-only.

      • ipAddress optional
          • dnsNameLabel optional - string

            The Dns name label for the IP.

          • ip optional - string

            The IP exposed to the public internet.

          • ports required array
              • port required - integer

                The port number.

              • protocol optional - string

                The protocol associated with the port.

          • type required - string

            Specifies if the IP is exposed to the public internet or private VNET.

      • osType required - string

        The operating system type required by the containers in the container group.

      • restartPolicy optional - string

        Restart policy for all containers within the container group.

        • Always Always restart
        • OnFailure Restart on failure
        • Never Never restart .
      • sku optional - string

        The SKU for a container group.

      • subnetIds optional array
          • id required - string

            Resource ID of virtual network and subnet.

          • name optional - string

            Friendly name for the subnet.

      • volumes optional array
          • azureFile optional
              • readOnly optional - boolean

                The flag indicating whether the Azure File shared mounted as a volume is read-only.

              • shareName required - string

                The name of the Azure File share to be mounted as a volume.

              • storageAccountKey optional - string

                The storage account access key used to access the Azure File share.

              • storageAccountName required - string

                The name of the storage account that contains the Azure File share.

          • emptyDir optional - object

            The empty directory volume.

          • gitRepo optional
              • directory optional - string

                Target directory name. Must not contain or start with '..'. If '.' is supplied, the volume directory will be the git repository. Otherwise, if specified, the volume will contain the git repository in the subdirectory with the given name.

              • repository required - string

                Repository URL

              • revision optional - string

                Commit hash for the specified revision.

          • name required - string

            The name of the volume.

          • secret optional - string

            The secret volume.

  • tags optional - string

    The resource tags.

  • type required - string
  • zones optional - array

    The zones for the container group.

>> from Azure Resource Manager Documentation

The Other Related Azure Container Resources

Frequently asked questions

What is Azure Container Group?

Azure Container Group is a resource for Container of Microsoft Azure. Settings can be wrote in Terraform.

Where can I find the example code for the Azure Container Group?

For Terraform, the walsung/tf-splunk-az, upendra409/reset and binarythistle/Terraform-Multi-Cloud source code examples are useful. See the Terraform Example section for further details.

For Azure Resource Manager, the scautomation/Azure-Inventory-Workbook, ryanmrestivo/cloud-security-research-and-governance and VJchand-star/Azure source code examples are useful. See the Azure Resource Manager Example section for further details.

security-icon

Automate config file reviews on your commits

Fix issues in your infrastructure as code with auto-generated patches.

Table of Contents