Azure IoT Hub - create policy with supplied keys - azure

Question

I'm looking for a way to create access policy in Azure IoT hub but I'd like to supply my own keys.
I can see there is a command in Azure CLI:
az iot hub policy create --hub-name
--name
--permissions
[--resource-group]
[--subscription]
but it does not allow to provide my own keys.
I couldn't find anything interesting on PowerShell as well - seems like there is no command for creating shared access policy at all using PowerShell.
There is a way to use ARM template (seems like it is possible to provide primary and secondary key (https://learn.microsoft.com/en-us/azure/templates/microsoft.devices/iothubs?tabs=json#iothubproperties):
...
"properties": {
"allowedFqdnList": [ "string" ],
"authorizationPolicies": [
{
"keyName": "string",
"primaryKey": "string",
"rights": "string",
"secondaryKey": "string"
}
],
...
but it brings some hassle in terms how to provide the keys and I'm looking for something simple and preety much one-timer.

Answer 1

You can use the below sample arm template which create a basic iot hub & a shared access policy with our own keys. You need to create two files parameters.json & template.json.
template.json file contains the code which resources are going to deploy.
parameters.json file contains the value of those parameters that you have used in the template.json.
Template.json file:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"IotHubs_IotHub_connectionString": {
"type": "SecureString"
},
"IotHubs_IotHub_containerName": {
"type": "SecureString"
},
"IotHubs_IotHub_name": {
"defaultValue": "vedodIotHub",
"type": "String"
},
"IotHubs_Key_Name" : {
"defaultValue" : "newkeyname",
"type": "string"
},
"IotHubs_Key_Primary_value" : {
"type": "string"
},
"IotHubs_Key_Secondary_value":{
"type": "string"
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.Devices/IotHubs",
"apiVersion": "2021-07-02",
"name": "[parameters('IotHubs_IotHub_name')]",
"location": "eastus",
"sku": {
"name": "S1",
"tier": "Standard",
"capacity": 2
},
"identity": {
"type": "None"
},
"properties": {
"ipFilterRules": [],
"authorizationPolicies": [
{
"keyName": "[parameters('IotHubs_Key_Name')]",
"primaryKey": "[parameters('IotHubs_Key_Primary_value')]",
"secondaryKey" : "[parameters('IotHubs_Key_Secondary_value')]",
"rights": "RegistryRead, RegistryWrite, DeviceConnect"
}
],
"eventHubEndpoints": {
"events": {
"retentionTimeInDays": 1,
"partitionCount": 4
}
},
"routing": {
"endpoints": {
"serviceBusQueues": [],
"serviceBusTopics": [],
"eventHubs": [],
"storageContainers": []
},
"routes": [],
"fallbackRoute": {
"name": "$fallback",
"source": "DeviceMessages",
"condition": "true",
"endpointNames": [
"events"
],
"isEnabled": true
}
},
"storageEndpoints": {
"$default": {
"sasTtlAsIso8601": "PT1H",
"connectionString": "[parameters('IotHubs_IotHub_connectionString')]",
"containerName": "[parameters('IotHubs_IotHub_containerName')]"
}
},
"messagingEndpoints": {
"fileNotifications": {
"lockDurationAsIso8601": "PT1M",
"ttlAsIso8601": "PT1H",
"maxDeliveryCount": 10
}
},
"enableFileUploadNotifications": false,
"cloudToDevice": {
"maxDeliveryCount": 10,
"defaultTtlAsIso8601": "PT1H",
"feedback": {
"lockDurationAsIso8601": "PT1M",
"ttlAsIso8601": "PT1H",
"maxDeliveryCount": 10
}
},
"features": "None"
}
}
]
}
parameters.json file :
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"IotHubs_IotHub_connectionString": {
"value": ""
},
"IotHubs_IotHub_containerName": {
"value": ""
},
"IotHubs_IotHub_name": {
"value": "<IotHubName>"
},
"IotHubs_Key_Name":{
"value" : "<sharedaccesspolicyKeyName>"
},
"IotHubs_Key_Primary_value": {
"value" : "<accesspolicyPrimaryKeyValue>"
},
"IotHubs_Key_Secondary_value":{
"value" : "<accesspolicySecondaryKeyValue>"
}
}
}
Using the below Powershell cmdlets to deploy the create a Iot hub & passing the above template.json & parameters.json file as parameters :
New-AzResourceGroupDeployment -ResourceGroupName <resourcegroupName> -TemplateFile '<pathfortemplate.jsonfile>' -TemplateParameterFile '<Pathforparameters.jsonfile>'
Here is the sample output screenshot for reference: