azure - custodian and c7n-org azure multi cloud bug fixes

[d-van]

This will resolve issues with using multi-cloud with azure for both custodian and c7n-org.

custodian will now pass in the correct credential scopes when specifying a different cloud.

c7n-org will now initialize the azure session properly and set the cloud endpoints.

For c7n-org requires users to add region: ${AzureCloudName} to the account yml file

ex:

subscriptions:
- name: subscription_name_here
  subscription_id: subscription_here
  region: AzureUSGovernment

Issue Link: #6613

[linux-foundation-easycla]

The committers are authorized under a signed CLA.

• ✅ d-van (65098bc, 53535af)

[d-van]

I originally added credential_scopes to the klass client in the legacy session client code, but it doesn't need it as legacy_credentials does it already.

Not sure how to test out the legacy cred workflow, so any insight on this would be greatly appreciated.

[logachev]

@d-van I believe we have very small amount of resources that use legacy, role-assignment should be the one iirc.. So if you can test some policy that leverages this resources, should be fine..

Also, can you please add some test for your change? Like initialize Azure with USGov region, create a client and ensure it uses proper creds?

[logachev]

Sorry for the delay on my side.

I think lack of provider initialization is a separate issue that we should address for all clouds.
In the meantime, I think Azure has an issue here: https://github.com/cloud-custodian/cloud-custodian/blob/master/tools/c7n_azure/c7n_azure/provider.py#L53

If options are provided, it should be using whatever is in the options rather than anything else.
So my guess is if you remove explicit initialization from c7n-org and update get_session_factory to use options.region if options.region else AZURE_PUBLIC_CLOUD - it should work now. Do you mind trying this?

[d-van]

@logachev that was it. I made the updates and it works for all cases (c7n commercial + gov and c7n-org commercial + gov)

Let me know if there is anything else I need to do! Thanks!

[d-van]

@logachev let us know if we can help out develop and test out anything relating to azure gov. When azure secret comes out, I think we will have resources to test the capabilities out.

[logachev]

@d-van Thanks! Do you mean Azure KeyVault Secret?

[kapilt]

i think that was in reference to another sovereign cloud endpoint

[d-van]

@kapilt @logachev yep! Whenever Azure Secret Region gets released we'll have to add those cloud endpoints to ensure users can use cloud custodian in the secret/top secret regions.

[d-van]

If I recall correctly, some/most of the endpoints may be classified so we may need to allow custom endpoint configurations. I guess we'll pick this back up whenever we have to cross the azure secret region bridge.