Skip to main content

Microsoft Azure

note
  1. An Upwind account with an associated client credentials.
  2. Admin access to the cloud provider's deployment tools, such as Microsoft Azure Run Command, Amazon Web Services (AWS) Systems Manager, or Google Cloud OS Patch Management.
info

There are two prerequisites for installing the Upwind Sensor on Microsoft Azure:

  1. The Microsoft Azure CLI must be installed on the machine you are using to install the Upwind Sensor.
  2. The Microsoft Azure CLI must be logged into an Azure account that has access to the VM(s) that you are installing the Upwind Sensor on.
note

By default the Sensor connects to the US region. If your Upwind tenant is in another region, add UPWIND_REGION=eu (or me) next to the client credentials in the Run Command scripts below.

Virtual Machines Scale Sets using Microsoft Azure Run Command​

The following script gets the IDs of all the instances in the scale set and then runs the Upwind installation command on each instance:

az vmss list-instances \
  --resource-group <resource_group_name> \
  --name <virtual_machine_scalesets_id> \
  --query "[].id" \
  --output tsv | \

az vmss run-command invoke \
  --command-id RunShellScript \
  --ids @- \
  --scripts 'curl -fsSL https://get.upwind.io/sensor.sh | \
      UPWIND_CLIENT_ID=<redacted> \
      UPWIND_CLIENT_SECRET=<redacted> \
      bash -s'

Virtual Machines using Microsoft Azure Run Command​

  1. Run the Upwind installation command using Microsoft Azure Run Command:
az vm run-command invoke \
  --resource-group <resource_group_name> \
  --name <virtual_machine_name> \
  --command-id RunShellScript \
  --scripts 'curl -fsSL https://get.upwind.io/sensor.sh | \
      UPWIND_CLIENT_ID=<redacted> \
      UPWIND_CLIENT_SECRET=<redacted> \
      bash -s'

Installation with Ansible​

For automated deployment, you can use Ansible to install the Upwind Sensor on your Azure VMs. Upwind does not ship a playbook, so create the files below in an Ansible project directory. Follow these steps:

  1. Prepare Ansible Environment: Ensure you have Ansible installed and configured on your system.

  2. Create the Ansible Role: Create roles/upwind/tasks/main.yaml with a task that runs the installer on each VM:

- name: 'Install sensor'
  shell: 'curl -fsSL https://get.upwind.io/sensor.sh | UPWIND_CLIENT_ID="{{ upwind_client_id }}" UPWIND_CLIENT_SECRET="{{ upwind_client_secret }}" UPWIND_REGION="{{ upwind_region | default("us") }}" bash -s'
  no_log: true

no_log: true keeps the client secret out of the Ansible output.

  1. Create the Ansible Playbook: Create upwind.yaml to specify the target hosts and roles:
---
- hosts: azurevms
  roles:
    - { role: upwind, become: yes }
  1. Set Up Hosts File: Create hosts/hosts to define your Azure VMs and credentials:
[all:vars]
ansible_user = <USER_NAME>
ansible_ssh_private_key_file = <PATH_TO_PEM>

[azurevms:vars]
upwind_client_id = <CLIENT_ID>
upwind_client_secret = <CLIENT_SECRET>

[azurevms]
<HOST_NAME> ansible_host=<IP>

If your Upwind tenant is in another region, add upwind_region = eu (or me) under [azurevms:vars].

To keep the credentials out of the hosts file, encrypt them with Ansible Vault or pass them with -e when you run the playbook.

  1. Run the Playbook:
ansible-playbook -i hosts/hosts upwind.yaml

Ensure you replace <USER_NAME>, <PATH_TO_PEM>, <CLIENT_ID>, <CLIENT_SECRET>, <HOST_NAME>, and <IP> with your specific Azure VM details and client credentials.

Troubleshooting​

Read the Troubleshooting guide for more information on how to troubleshoot the Upwind Sensor installation.