Creating VHD Azure blob SAS URL from Azure Managed Image

Let’s say we have a generalized Azure Managed Image in our Azure subscription and we need to generate Azure blob Shared Access Signature (SAS) URL to the VHD representing that image.

One of the scenarios where this is useful is during publishing a VM offer in Azure Marketplace. Currently, as of August 2020, Partner Center UI requires the publisher to provide SAS URL for the OS and Data disks

Image for post
Image for post

Although it is possible to generate SAS URLs from Azure Managed Disks by using “az disk grant-access”, it is not currently possible to generate SAS URL from a managed image (i.e. there is no “az image grant-access” type of command).

In addition, even with “az disk grant-access” we would not get SAS URL that is required for publishing a VM offer in Azure Marketplace (refer to this doc).

The high-level steps to accomplish what we need are as follows:

  1. Create Azure Shared Image Gallery image version from the managed image
  2. Create Azure Managed Disk from the Shared Image Gallery (SIG) image version we created
  3. Generate temporary SAS URL to the Azure Managed Disk
  4. Use AzCopy to copy the SAS URL of the managed disk to our own Azure storage account container as a VHD
  5. Generate SAS from the VHD in our storage account

Below are more details and sample Azure CLI commands which can be executed locally or via Azure Cloud Shell directly in the browser.

Create Azure Shared Image Gallery from Managed Image

We first create an Azure Shared Image Gallery and image definition.

Next, we create an image version in our gallery from our managed image. This command may take a few minutes to execute. Also, we need to make sure to use the proper target regions for the image version including the ones where our storage account will be located. In the example below, the image version is replicated to the eastus region.

We should now have the following Azure Shared Image Gallery resources in our resource group:

Image for post
Image for post

The resource ID of the image version is something like this:

Create Azure Managed Disk from Shared Image Gallery

We now can use “az disk create” with gallery-image-reference parameter to create a managed disk directly from our image.

Image for post
Image for post

NOTE: If our image consists of multiple disks (e.g. OS plus data disks), we need to create multiple managed disks by using the gallery-image-reference-lun to create individual disks for the OS and each of the data disks.

Generate SAS URL for the Managed Disk

We use “az disk grant-access” to export the newly created managed disk via a temporary (e.g. 10 hours) SAS URL.

We get back a SAS URL that looks like this:

AzCopy Managed Disk to Our Azure Blob Storage Container

If we don’t yet have a specific storage account we will use for storing the VHD, we create a simple Azure Blob storage account and container.

Create writable SAS URL for our destination container.

We now can use AzCopy command to copy the managed disk using its SAS URL to the container we created. For the destination, we make sure to name the blob with .vhd extension.

We now have the blob in our storage container.

Image for post
Image for post

Generate SAS for VHD in our Storage Account

Following the documentation for Azure Marketplace VM Offer, we generate read+list SAS URL for the VHD in our storage account making sure to specify start date of at least one day before current date and expiry date at least three weeks after current date.

Finally, we append the resultant SAS token it to the URL of our VHD blob name as follows and use it in the VM Offer page in the Partner Center.

Image for post
Image for post

Thank you!

Please leave feedback and questions below or on Twitter https://twitter.com/ArsenVlad

Written by

Principal Engineer / Architect, FastTrack for Azure at Microsoft

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store