Azure dynamic host catalogs

Boundary uses dynamic host catalogs to automatically discover Azure resources available through Azure Resource Manager (ARM) and add them as hosts.

Create a host catalog to connect with Azure

Boundary uses plugins to integrate with a variety of providers. To use a dynamic host catalog to integrate with Azure, you create a host catalog of the plugin type and set the plugin-name value to azure. You must also provide the specific fields needed for Boundary to authenticate with Azure.

Complete the following steps to create a dynamic host catalog for Azure:

Log in to Boundary.
Select the org, and then select the project you want to create a host catalog for.
Select Host Catalogs.
Select New Host Catalog.
Complete the following fields:
- Name: (Optional) An optional name for identification purposes. If you enter a name, it must be unique.
- Description: (Optional) An optional description of the host catalog for identification purposes.
- Type: (Required) Select Dynamic to create a dynamic host catalog.
- Provider: (Required) Select Azure to create a dynamic host catalog for your Azure resources.
- Tenant/Directory ID: (Required) The directory ID for your Azure Active Directory application.
- Subscription ID: (Required) The subscription ID for the subscription that has read access.
- Client/Application ID: (Required) The client or application ID of the Azure service principal that Boundary should use to authenticate and discover hosts.
- Client Secret Value: (Required) The client secret value that Azure generates for authentication.
- Disable credential rotation: When enabled, Boundary does not rotate the credentials with Azure automatically.
Select Save.

Log in to Boundary.
Use the following command to create a dynamic host catalog for Azure:
```
$ boundary host-catalogs create plugin \
  -scope-id $PROJECT_ID \
  -plugin-name azure \
  -attr disable_credential_rotation=true \
  -attr tenant_id=env://ARM_TENANT_ID \
  -attr subscription_id=env://ARM_SUBSCRIPTION_ID \
  -attr client_id=env://ARM_CLIENT_ID \
  -secret secret_value=env://ARM_CLIENT_SECRET
```
The scope-id and plugin-name fields are required when you create a dynamic host catalog.
The fields following the attr and secret flags are specific to Azure and are required by Boundary for authentication.
- disable_credential_rotation: When set to true, Boundary does not rotate the credentials automatically.
- tenant_id: The ARM Tenant(Directory) ID
- subscription_id: The ARM Subscription ID
- client_id: The ARM Client (Application) ID
- secret_value: The ARM Client Secret
Refer to the domain model documentation for additional fields that you can use when you create host catalogs.

Refer to the Boundary Terraform provider documentation to learn about the requirements for the following example attributes.

Apply the following Terraform policy:

resource "boundary_host_catalog_plugin" "azure_host_catalog" {
  name        = "Azure Catalog"
  description = "Azure Host Catalog"
  scope_id    = boundary_scope.project.id
  plugin_name = "azure"

  attributes_json = jsonencode({
    "tenant_id"       = "ARM_TENANT_ID",
    "subscription_id" = "ARM_SUBSCRIPTION_ID"
    "client_id"       = "ARM_CLIENT_ID"
    "disable_credential_rotation" = true })
  secrets_json = jsonencode({
    "secret_value" = "ARM_CLIENT_SECRET"})
}

The scope-id and plugin-name fields are required when you create a dynamic host catalog.

The fields following the attr and secret flags are specific to Azure and are required by Boundary for authentication.

disable_credential_rotation: When set to true, Boundary does not rotate the credentials automatically.
tenant_id: The ARM Tenant(Directory) ID
subscription_id: The ARM Subscription ID
client_id: The ARM Client (Application) ID
secret_value: The ARM Client Secret

Refer to the domain model documentation for additional fields that you can use when you create host catalogs.

Create a host set to connect with Azure

Host sets specify which Azure Resource Manager (ARM) filters should be used to identify the discovered hosts that should be added as members.

Complete the following steps to create a host set:

Log in to Boundary.
Select the org, and then select the project you want to create a host set for.
Select Host Catalogs.
Select the dynamic host catalog to which you want add a host set.
Click the Host Sets tab, and then click New.
Complete the following fields:
- Name: (Optional) An optional name for identification purposes. If you enter a name, it must be unique.
- Description: (Optional) An optional description of the host catalog for identification purposes.
Click Save.

Log in to Boundary.
Use the following command to create a host set:
```
$ boundary host-sets create plugin \
  -name database \
  -host-catalog-id $HOST_CATALOG_ID \
  -attr filter="tagName eq 'service-type' and tagValue eq 'database'"
```
The host-catalog-id value is a required field that specifies in which host catalog to create this host set.
The fields following the attr flag are specific to Azure.
The filter field represents the ARM filter used to select resources that should be a part of this host set. There are some limitations with the filtering syntax. Specifically, when you use tags, other types of filters (such as on resource type) are not allowed. As a result, it is generally useful to filter directly on tag names or values as in the following examples:
- tagName eq 'application'
- tagName eq 'application' and tagValue eq 'app2'
Refer to the domain model documentation for additional fields that you can use when you create host catalogs.

Refer to the Boundary Terraform provider documentation to learn about the requirements for the following example attributes.

Apply the following Terraform policy:

  resource "boundary_host_set_plugin" "azure_host_set" {
  name        = "Azure Set"
  description = "Azure Host Set"
  host_catalog_id  = boundary_scope.azure_host_catalog.id
  attributes_json = jsonencode({
    "filter" = "tagName eq 'service-type' and tagValue eq 'database'" })
}

The host-catalog-id value is a required field that specifies in which host catalog to create this host set.

The fields following the attr flag are specific to Azure.

The filter field represents the ARM filter used to select resources that should be a part of this host set. There are some limitations with the filtering syntax. Specifically, when you use tags, other types of filters (such as on resource type) are not allowed. As a result, it is generally useful to filter directly on tag names or values as in the following examples:

- `tagName eq 'application'`
- `tagName eq 'application' and tagValue eq 'app2'`

Refer to the domain model documentation for additional fields that you can use when you create host catalogs.