Cloud

Run the following script in your Azure console to manually grant flow log access for your tenant. Note that "csTenantId" is the tenant ID and that "subscriptionId" is the subscription ID for Illumio Cloud.

In summary, the script does the following:

#params for running the script
# to run the script use the command
# ./grant_flow.ps1 -serviceAccountKey <key> -serviceAccountToken <token> -csTenantId <cs_tenant_id> -subscriptionId <subscription_id> -storageAccount <storage_account1,storage_account2,...> -url <url>
# default url is https://cloud.illum.io
param(
    $serviceAccountKey = "",
    $serviceAccountToken = "",
    $csTenantId = "",
    $subscriptionId = "",
    [String[]]$storageAccounts,
    $url = "")
 
#check if the given inputs are valid
if ([string]::IsNullOrEmpty($serviceAccountKey) -or [string]::IsNullOrEmpty($serviceAccountToken)) {
    Write-Host "Service Account Token or Key cannot be empty" -ForegroundColor Red
    exit
}
 
if ([string]::IsNullOrEmpty($csTenantId)) {
    Write-Host "csTenantId cannot be empty" -ForegroundColor Red
    exit
}
 
if ([string]::IsNullOrEmpty($subscriptionId)) {
    Write-Host "subscriptionId cannot be empty" -ForegroundColor Red
    exit
}
 
 
if ($storageAccounts.Count -eq 0) {
    Write-Host "storage accounts list cannot be empty" -ForegroundColor Red
    exit
}
 
# Combine the key ID and token with a colon and base64 encode for the Authorization header
$authString = "$($serviceAccountKey):$($serviceAccountToken)"
$encodedAuthString = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes($authString))
 
 
# Construct the headers with the encoded Authorization header
$headers = @{
    "X-Tenant-Id"   = $csTenantId;
    "Content-Type"  = "application/json";
    "Authorization" = "Basic $encodedAuthString";
}
 
# Construct the request body with the storage accounts
# list of storage accounts which has flow logs and for which access has been granted.
# the storage account names must be the entire namespace as shown in cloudsecure flow logs page.
# Eg: /subscriptions/<subscription_id>/resourceGroups/<resource_group_name>/providers/Microsoft.Storage/storageAccounts/<storage_account_name>
 
$body = @{
    "type"            = "AzureFlow";
    "subscription_id" = $subscriptionId; # subscription in which the storage accounts are present
    "destinations"     = $storageAccounts;
} | ConvertTo-Json -Depth 10
 
# Send the POST request
$endPoint = "/api/v1/integrations/cloud_credentials"
 
if ([string]::IsNullOrEmpty($url) ) {
    Write-Host "url is empty hence using default url https://cloud.illum.io" -ForegroundColor Yellow
    $url = "https://cloud.illum.io"
}
 
$url = $url + $endPoint
 
Write-Host "making API call to $($url)"
 
$response = Invoke-WebRequest -Uri $url -Method Post -Headers $headers -Body $body
 
# Output the response
if ($(response.StatusCode -eq 200)) {
    Write-Host "API call to cloudsecure successful"
} else {
    Write-Host "Error making API call to cloudsecure. Status code: $(response.StatusCode)"
}