ollionorg/automated-azure-sandbox-setup

Purpose and Entry Points

This repository automates temporary Azure sandbox access: GitHub Actions provision a per-user Resource Group with Contributor access, then revoke access and delete it at expiry. The operational entry points are the provisioning and cleanup workflows: .github/workflows/azure-provision.yml and .github/workflows/azure-nuke.yml.

GitHub Actions Orchestration

The workflows run on a configured self-hosted GitHub runner and authenticate through an Azure app/service principal plus repository secrets. Provisioning accepts a requested user, duration, and target subscription; cleanup is separately callable and is also triggered by scheduled Azure Automation work. Slack failure notification settings are separated into .github/config/azure_provisioning_slack.yaml and .github/config/azure_nuke_slack.yaml.

Paths:

• .github/workflows/azure-provision.yml

• .github/workflows/azure-nuke.yml

• .github/workflows/README.md

Azure Provisioning Boundary

Azure is the primary control plane. The configured service principal needs subscription Contributor access plus a custom role that permits the automation/runbook operations needed for timed cleanup. Each sandbox is isolated by Resource Group, with temporary Contributor RBAC assigned to the approved user. Federated GitHub OIDC credential configuration is templated by files/credential_sample.json; custom Azure RBAC permissions are defined by files/custom_role.json.

Paths:

• files/credential_sample.json

• files/custom_role.json

• README.md

Identity Validation and Authorization

Before granting Azure access, the automation validates the requester against Google Workspace and Azure AD/Microsoft Graph. Python performs domain/user validation; shell scripting obtains or uses Google Workspace authentication context. Google service-account credentials are supplied as the CREDENTIALS_FILE secret rather than intended as a repository-managed plaintext credential.

Paths:

• azure/google-workspace-validate-users.py

• azure/google-workspace-user.sh

• azure/requirements.txt

Timed Deprovisioning

Provisioning creates Azure Automation runbooks/schedules that later invoke GitHub cleanup. The PowerShell scheduler stage establishes or schedules the delayed cleanup job; the trigger stage calls GitHub Actions to execute the nuke workflow. This is the key asynchronous boundary: GitHub provisions now, Azure Automation retains responsibility for invoking teardown later.

Paths:

• azure/scheduler.ps1

• azure/github_trigger.ps1

• .github/workflows/azure-nuke.yml

Runtime and Infrastructure Dependencies

Execution requires a self-hosted GitHub Actions runner on an Azure VM, Azure CLI, PowerShell, Python dependencies, and Azure Automation with a system-assigned managed identity and private webhook connectivity. External services are Azure Resource Manager/RBAC, Microsoft Graph/Azure AD, Google Workspace Admin APIs, GitHub Actions/API (PAT for triggering cleanup), and Slack webhooks for failure alerts.

Paths:

• azure/install_prerequisites.sh

• azure/requirements.txt

• .github/config/azure_nuke_slack.yaml

Credentials and Trust Model

GitHub secrets hold Azure client/tenant/subscription IDs, Microsoft Graph secret, Google service-account credential material, GitHub PAT, and Slack webhook. The Azure app is assigned broad subscription capabilities, while Azure Automation receives Automation Contributor permissions. This makes secret handling, runner isolation, least-privilege role scoping, and secure private access to Automation webhooks architecturally critical.