feat: Add Microsoft Azure integration by Tamiru-Alemnew · Pull Request #3074 · superplanehq/superplane

Tamiru-Alemnew · 2026-02-12T13:21:35Z

Implements #2921

Summary

This PR adds the Microsoft Azure integration to SuperPlane, including one trigger (onVirtualMachineCreated) and one action (createVirtualMachine).
It uses Azure Workload Identity Federation (OIDC) for authentication, supports implicit NIC creation from a subnet, and returns rich connection details (Public IP, Private IP, Admin Username) after VM creation.

Backend Implementation

Added a new Azure integration under pkg/integrations/azure and registered it in the main server.
Implemented OIDC-based auth using azidentity.NewClientAssertionCredential and AZURE_FEDERATED_TOKEN_FILE, with a seamless fallback to az login for local development (no client secrets are stored).
Implemented the createVirtualMachine action:
- Supports core VM options: Resource Group, Region, VM Name, Image, Size.
- Supports disk configuration (e.g. Premium_LRS, StandardSSD_LRS).
- Implements implicit NIC creation: users provide a Virtual Network and Subnet, and the integration automatically creates the NIC (and optional Public IP, Standard SKU) and attaches it.
- Supports Cloud-init / Custom Data, Base64-encoding it before sending to Azure.
- Uses Azure SDK LROs (BeginCreateOrUpdate + PollUntilDone) to wait for the VM to be ready.
- After creation, looks up the primary NIC and (optionally) Public IP to return vmId, privateIp, publicIp, and adminUsername.
Implemented the onVirtualMachineCreated trigger:
- Listens to Azure Event Grid Microsoft.Resources.ResourceWriteSuccess events.
- Handles the Event Grid subscription validation handshake (Microsoft.EventGrid.SubscriptionValidationEvent).
- Normalizes the incoming event into the trigger payload used by workflows.
Refactored magic strings into constants for resource providers, SKUs, and IP allocation methods, and cleaned up comments / dead code.

Frontend Implementation

Added Azure mappers under web_src/src/pages/workflowv2/mappers/azure to wire the createVirtualMachine action and onVirtualMachineCreated trigger into the workflow builder.
Implemented dynamic dropdowns for:
- Resource Groups
- VM Sizes (per region)
- Virtual Networks (per resource group)
- Subnets (per virtual network)
Updated integration display name mapping so "azure" renders as Azure in the UI.
Added an Azure icon and wired it into the integration and building-block sidebars.

Docs

Implemented integration docs in pkg/integrations/azure/README.md and generated the user-facing doc docs/components/Microsoft Azure.mdx via make gen.components.docs.
Documented:
- Dual-mode authentication (Production OIDC via federated credential, Local Dev via az login).
- How to configure the onVirtualMachineCreated trigger using Azure Event Grid.
- How to use the createVirtualMachine action, including:
  - Required basics (RG, Region, Image, Size).
  - Networking via implicit NIC creation from a VNet + Subnet.
  - Advanced options (disk types, Public IP, Cloud-init).
- Prerequisites (App Registration, Federated Credential, required RBAC roles such as Contributor on the target Resource Group).
- Common troubleshooting steps for OIDC issuer / token issues and local tunnel URLs.

Tests

Added / updated unit tests in pkg/integrations/azure to cover:
- Request validation (including implicit NIC creation rules).
- VM creation behavior and rich output mapping.
- Event Grid webhook handling and subscription validation.
Ensured make test and linting pass locally.

Notes

The createVirtualMachine action currently targets the Azure Compute + Network APIs via the official Go SDK; support for additional advanced VM options can be added in future PRs if needed.
Local development assumes a publicly reachable base URL (e.g. via localhost.run) so Azure can reach the webhook endpoints.

Demo

Short demo video: https://www.loom.com/share/bdffb3bdd0894b4f9eb4e737d7e783ef
- Shows configuring Azure auth, setting up the Event Grid subscription, and:
  - Triggering a workflow with onVirtualMachineCreated.
  - Creating a VM with createVirtualMachine .

Signed-off-by: Tamiru Alemnew <tamirualemnew33@gmail.com>

pkg/integrations/azure/trigger_on_vm_created.go

pkg/integrations/azure/webhook_events.go

…ctions - Add webhook secret verification in HandleWebhook - Refactor trigger to use helper functions from webhook_events.go - Fix Go formatting issues - Note: Event Grid validation response body limitation documented (framework limitation) Signed-off-by: Tamiru Alemnew <tamirualemnew33@gmail.com>

cursor · 2026-02-13T06:08:44Z

pkg/integrations/azure/trigger_on_vm_created.go

+			// For now, if a SAS token is present, we'll allow it (this is a basic implementation)
+			ctx.Logger.Debug("Azure Event Grid SAS token found in header")
+			return nil
+		}


SAS token header bypasses webhook secret authentication

High Severity

When a webhook secret is configured, the authenticateWebhook method allows any request that includes an aeg-sas-token header, regardless of the header's value. An attacker can bypass the secret check entirely by sending any arbitrary value in that header. The SAS token is never validated — the code just checks for its presence and returns nil.

cursor · 2026-02-13T06:08:44Z

pkg/integrations/azure/trigger_on_vm_created.go

+		// Check for custom secret header
+		secretHeader := ctx.Headers.Get("X-Webhook-Secret")
+		if secretHeader != "" {
+			if secretHeader != string(secret) {


Webhook secret compared without constant-time equality

Medium Severity

The webhook secret comparisons use plain != string comparison instead of crypto/subtle.ConstantTimeCompare, making them vulnerable to timing side-channel attacks. Other integrations in this codebase (gitlab, render, slack) consistently use constant-time comparison for secret validation.

Additional Locations (1)

pkg/integrations/azure/trigger_on_vm_created.go#L344-L345

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-02-13T06:25:23Z

pkg/integrations/azure/trigger_on_vm_created.go

+	if config.ResourceGroup != "" && resourceGroup != config.ResourceGroup {
+		ctx.Logger.Debugf("Skipping VM event for resource group %s (filter: %s)", resourceGroup, config.ResourceGroup)
+		return nil
+	}


Case-sensitive resource group comparison breaks Azure filtering

Medium Severity

The resource group filter uses a case-sensitive comparison (resourceGroup != config.ResourceGroup), but Azure resource group names are case-insensitive. Azure ARM may return different casing in resource IDs than what the user originally specified, causing valid events to be silently filtered out. This comparison needs strings.EqualFold instead.

shiroyasha · 2026-02-13T13:48:31Z

@Tamiru-Alemnew hey, great start!

I see that you included the SDK into the application. Is this necessary?
We didn't use the SDK for AWS afaik. They are quite bit packages to have just for one integration.

Looping in @lucaspin as well.

Tamiru-Alemnew · 2026-02-13T14:12:51Z

@Tamiru-Alemnew hey, great start!

I see that you included the SDK into the application. Is this necessary? We didn't use the SDK for AWS afaik. They are quite bit packages to have just for one integration.

Looping in @lucaspin as well.

Hi @shiroyasha @lucaspin,

Great question

I was intentional about pulling in the Azure SDK modules (azidentity, armcompute, armnetwork) rather than writing raw HTTP clients.

While it's true we keep the AWS integration lightweight (mostly using the SDK Core + Signer), Azure presents three specific challenges that make the official SDK the safer choice here:

1. Authentication Complexity (OIDC to ARM)
For Azure, we are using Workload Identity Federation. The environment provides an OIDC token via AZURE_FEDERATED_TOKEN_FILE, and the Azure SDK’s azidentity module securely exchanges that assertion for an ARM access token.

Re-implementing this handshake manually—including securely reading the token file, performing the token exchange, caching, and automatic refreshing—would be significant custom code and a potential security risk. The SDK handles this standard flow out of the box.

2. Long-Running Operations (LROs)
Provisioning a VM in Azure is an asynchronous ARM operation. It returns a 201 Created and an Azure-AsyncOperation header that must be polled.

Without SDK: We would have to write a custom poller with backoff logic to track the operation status.
With SDK: We get BeginCreateOrUpdate, which includes a native, robust poller (PollUntilDone). This guarantees our "Create VM" action doesn't hang or return prematurely.

3. Complex Typed Resources
Azure ARM payloads (for VirtualMachine, NetworkInterface, PublicIP) are deeply nested and versioned (e.g., 2023-03-01). The SDK provides strongly typed structs that catch configuration errors at compile time. This is critical for keeping the "Create VM" action stable as we map the complex User Inputs (Subnets, Disks, Cloud-init) to the API.

Mitigation
To minimize bloat, I have scoped the imports strictly to the modules we need (azidentity and specific arm* packages), rather than importing the entire Azure SDK bundle.

I believe this approach strikes the right balance between binary size and maintainability for the initial integration.

Signed-off-by: Tamiru Alemnew <tamirualemnew33@gmail.com>

Tamiru-Alemnew added 9 commits February 12, 2026 15:50

feat(azure): add Azure integration backend

0d3273f

Signed-off-by: Tamiru Alemnew <tamirualemnew33@gmail.com>

feat(server): register Azure integration

cf722f6

Signed-off-by: Tamiru Alemnew <tamirualemnew33@gmail.com>

feat(azure-ui): add workflow mappers for Azure

d2fb097

Signed-off-by: Tamiru Alemnew <tamirualemnew33@gmail.com>

feat(docs): generate Microsoft Azure component docs

dce6e6c

Signed-off-by: Tamiru Alemnew <tamirualemnew33@gmail.com>

feat(icons): add Azure integration logo

3ed0c95

Signed-off-by: Tamiru Alemnew <tamirualemnew33@gmail.com>

feat(ui): wire Azure logo into integration sidebar

252e815

Signed-off-by: Tamiru Alemnew <tamirualemnew33@gmail.com>

feat(ui): show Azure logo in building blocks

c561945

Signed-off-by: Tamiru Alemnew <tamirualemnew33@gmail.com>

chore(ui): normalize Azure integration display name

8fb3824

Signed-off-by: Tamiru Alemnew <tamirualemnew33@gmail.com>

Merge branch 'main' into feat/azure-integration

58c1b53

cursor bot reviewed Feb 12, 2026

View reviewed changes

pkg/integrations/azure/trigger_on_vm_created.go Show resolved Hide resolved

pkg/integrations/azure/trigger_on_vm_created.go Show resolved Hide resolved

pkg/integrations/azure/webhook_events.go Show resolved Hide resolved

AleksandarCole added pr:stage-1/3 Needs to pass basic review. wfh labels Feb 12, 2026

Tamiru-Alemnew force-pushed the feat/azure-integration branch from e6232d9 to 6d15ed4 Compare February 13, 2026 06:08

cursor bot reviewed Feb 13, 2026

View reviewed changes

Merge branch 'main' into feat/azure-integration

70b8729

cursor bot reviewed Feb 13, 2026

View reviewed changes

AleksandarCole added pr:stage-2/3 Needs to pass functional review and removed pr:stage-1/3 Needs to pass basic review. labels Feb 13, 2026

AleksandarCole requested a review from shiroyasha February 13, 2026 13:08

AleksandarCole assigned shiroyasha Feb 13, 2026

fix(azure): format mapper file

df75717

Signed-off-by: Tamiru Alemnew <tamirualemnew33@gmail.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Add Microsoft Azure integration#3074

feat: Add Microsoft Azure integration#3074
Tamiru-Alemnew wants to merge 12 commits intosuperplanehq:mainfrom
Tamiru-Alemnew:feat/azure-integration

Tamiru-Alemnew commented Feb 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor bot Feb 13, 2026

Uh oh!

cursor bot Feb 13, 2026

Uh oh!

cursor bot left a comment

Uh oh!

cursor bot Feb 13, 2026

Uh oh!

shiroyasha commented Feb 13, 2026

Uh oh!

Tamiru-Alemnew commented Feb 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Tamiru-Alemnew commented Feb 12, 2026

Summary

Backend Implementation

Frontend Implementation

Docs

Tests

Notes

Demo

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor bot Feb 13, 2026

Choose a reason for hiding this comment

SAS token header bypasses webhook secret authentication

Uh oh!

cursor bot Feb 13, 2026

Choose a reason for hiding this comment

Webhook secret compared without constant-time equality

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Feb 13, 2026

Choose a reason for hiding this comment

Case-sensitive resource group comparison breaks Azure filtering

Uh oh!

shiroyasha commented Feb 13, 2026

Uh oh!

Tamiru-Alemnew commented Feb 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants