[K9VULN-12480] feat: Azure Agentless Scanner - Cloud Shell wizard scaffolding & preflight (Step 1) by mohamed-challal · Pull Request #152 · DataDog/integrations-management

mohamed-challal · 2026-03-13T14:21:58Z

What does this PR do?

Adds the initial scaffolding for an Azure Cloud Shell wizard that will deploy the Agentless Scanner infrastructure via Terraform, mirroring the existing GCP implementation in gcp/agentless/.
This PR implements Step 1 (Preflight Checks) end-to-end, with the remaining 5 steps stubbed out for follow-up PRs.

Why?

The current Azure agentless setup relies on ARM templates and per-subscription manual configuration. This Cloud Shell wizard will provide a streamlined, end-to-end setup experience (target: P95 < 5 minutes) with:

Cross-subscription deployment from a single command
Multi-region scanner support
Real-time progress reporting to the Datadog UI via the workflow status API
Key Vault–based API key storage (upcoming steps)

What's included

File	Purpose
`config.py`	Parses env vars (`DD_API_KEY`, `DD_SITE`, `SCANNER_SUBSCRIPTION`, `SCANNER_LOCATIONS`, `SUBSCRIPTIONS_TO_SCAN`, etc.) into a typed `Config` dataclass with validation
`errors.py`	Azure-specific exception hierarchy (`SetupError` → `AzureAuthenticationError`, `AzureAccessError`, `ResourceProviderError`, `KeyVaultError`, `TerraformError`, etc.)
`shell.py`	Shell utilities: `run_command()`, `az_cli()` with JSON parsing, `az_cli_checked()`
`requests.py`	HTTP client with retry/backoff for Datadog API calls (stdlib only, no external deps)
`console_reporter.py`	Console output formatting with step progress and unicode indicators
`reporter.py`	Composite reporter: console + Datadog workflow status API (`/api/unstable/integration/azure/workflow/azure-agentless-setup`)
`preflight.py`	Step 1 fully implemented: Azure CLI auth, set subscription, validate locations, parallel subscription access checks, check & register resource providers
`main.py`	Entry point with `deploy` command. Step 1 wired, steps 2–6 are TODO stubs
`build.sh`	Builds `.pyz` zipapp (same pattern as GCP)
`test_config.py`	15 unit tests for config parsing (valid inputs, derived properties, error cases)

Deploy steps overview

Step	Status	Description
1. Preflight checks	✅ This PR	Auth, subscription access, location validation, resource provider registration
2. Create state storage	🔜 Next PR	Storage Account + Key Vault in a dedicated state resource group
3. Store API key	🔜 Next PR	Store DD API key in Key Vault
4. Generate Terraform config	🔜 Next PR	Write `main.tf` + `terraform.tfvars`
5. Terraform init	🔜 Next PR	`terraform init` with Azure Storage backend
6. Deploy infrastructure	🔜 Next PR	`terraform apply`

How to test

# Build
cd azure && bash agentless/build.sh

# Run in Azure Cloud Shell (or locally with az cli)
DD_API_KEY="<key>" DD_APP_KEY="<key>" DD_SITE="datadoghq.com" \
WORKFLOW_ID="<uuid>" \
SCANNER_SUBSCRIPTION="subscription uuid" \
SCANNER_LOCATIONS="eastus" \
SUBSCRIPTIONS_TO_SCAN="comma separated uuid" \
python3 agentless/dist/azure_agentless_setup.pyz deploy

# Unit tests
cd azure && python -m pytest agentless/tests/ -v

… agentless setup

gpalmz · 2026-03-13T14:43:55Z

codex review

mohamed-challal · 2026-03-13T14:49:34Z

@codex review

chatgpt-codex-connector · 2026-03-13T14:49:44Z

To use Codex here, create a Codex account and connect to github.

mohamed-challal · 2026-03-13T14:52:09Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7051ef8d6b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

gpalmz

Thanks for doing this! I think there are quite a few opportunities to consolidate with existing utils, and would definitely recommend doing so. Pointed out a couple specific ones, but there are probably others too. I'd recommend having claude read through the repo with this in mind and see what it can do.

…scaffolding

…all modules

…nly subscription access

…azure setup flows

…hared

mohamed-challal · 2026-03-16T12:53:45Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ed87ff76c1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

gpalmz · 2026-03-16T18:36:18Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ed87ff76c1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

gpalmz

LGTM under the assumption that there will be a second pass for code consolidation. Thanks!

gpalmz · 2026-03-16T19:09:11Z

+def sigint_handler(signum, frame) -> None:
+    """Handle Ctrl+C gracefully."""
+    print("\n\n⚠️  Setup interrupted by user (Ctrl+C)")
+    print("   Partial resources may have been created.")
+    print("   To clean up, run: terraform destroy")
+    sys.exit(130)
+
+
+def session_timeout_handler() -> None:
+    """Handle session timeout."""
+    print("\n\n⚠️  Session expired after 30 minutes.")
+    print("   If you still wish to complete the setup, re-run the command.")
+    print("   Terraform state is persisted, so it will continue where it left off.")
+    os._exit(1)
+
+
+def start_session_timer() -> threading.Timer:
+    """Start a background timer for session timeout."""
+    timer = threading.Timer(SESSION_TIMEOUT_MINUTES * 60, session_timeout_handler)
+    timer.daemon = True
+    timer.start()
+    return timer
+
+
+def print_session_warning() -> None:
+    """Print Cloud Shell session timeout warning."""
+    print()
+    print(f"⚠️  Note: This session will timeout after {SESSION_TIMEOUT_MINUTES} minutes.")
+    print("   If your session expires, generate a new workflow ID from the Datadog UI")
+    print("   and re-run the command. Terraform state is persisted, so it will")
+    print("   continue where it left off.")
+
+
+def validate_credentials_and_workflow(config, reporter: Reporter) -> None:
+    """Validate Datadog credentials and workflow ID before starting setup.
+
+    Exits the process if validation fails.
+    """
+    try:
+        validate_datadog_api_key(reporter, config.api_key, config.site)
+        validate_datadog_app_key(reporter, config.api_key, config.app_key, config.site)
+    except DatadogCredentialsError as e:
+        reporter.error(e.message)
+        if e.detail:
+            print(f"   {e.detail}")
+        sys.exit(1)
+
+    if not reporter.is_valid_workflow_id():
+        print(
+            f"Workflow ID {config.workflow_id} has already been used. "
+            "Please start a new workflow from the Datadog UI."
+        )
+        sys.exit(1)
+
+    reporter.handle_login_step()


Noting for later: lots of potential for consolidation with these

yes, I will consolidate this in the next PR

mohamed-challal · 2026-03-17T14:20:42Z

Thanks a lot for the deep review and all the feedback!
I have tested azure_quickstart and azure_agentless on my dogfood org, everything looks good, I will merge this PR.

mohamed-challal added 4 commits March 13, 2026 12:20

feat(agentless-azure): implement preflight step for azure cloud shell…

8d76c92

… agentless setup

test(agentless-azure): add unit tests

e9ed941

build(agentless-azure): add build script

18018c8

build(agentless-gcp): build agentless dist script

7051ef8

mohamed-challal self-assigned this Mar 13, 2026

mohamed-challal requested a review from a team as a code owner March 13, 2026 14:21

mohamed-challal requested a review from mshvartsberg March 13, 2026 14:22

chatgpt-codex-connector Bot reviewed Mar 13, 2026

View reviewed changes

Comment thread azure/agentless/src/azure_agentless_setup/main.py

Comment thread azure/agentless/src/azure_agentless_setup/main.py

mohamed-challal requested a review from diogocp March 13, 2026 15:49

mohamed-challal changed the title ~~feat: Azure Agentless Scanner - Cloud Shell wizard scaffolding & preflight (Step 1)~~ [K9VULN-12480] feat: Azure Agentless Scanner - Cloud Shell wizard scaffolding & preflight (Step 1) Mar 13, 2026

gpalmz reviewed Mar 13, 2026

View reviewed changes

Comment thread azure/agentless/src/azure_agentless_setup/preflight.py

Comment thread azure/agentless/src/azure_agentless_setup/shell.py Outdated

Comment thread azure/agentless/src/azure_agentless_setup/console_reporter.py

mohamed-challal added 9 commits March 16, 2026 11:21

refactor(agentless-azure): reuse execute_cmd from shared lib

eb60b42

Merge branch 'main' into mohamed.challal/agentless-azure-cloud-shell-…

92e49d3

…scaffolding

refactor(agentless-azure): move dd_request to shared and reuse it in …

6de5da4

…all modules

add(agentless-azure): check actual RBAC permissions instead of read-o…

54f1eee

…nly subscription access

refactor(agentless-azure): reuse shared errors

36e5e88

refactor(agentless-azure): share datadog keys validation between all …

b0066c4

…azure setup flows

refactor(agentless-azure): move check_login and set_subscription to s…

ed99566

…hared

refactor(agentless-azure): move get_available_regions to shared

4555927

build(azure): re-build dist scripts

ed87ff7

chatgpt-codex-connector Bot reviewed Mar 16, 2026

View reviewed changes

Comment thread azure/agentless/src/azure_agentless_setup/preflight.py

Comment thread azure/agentless/src/azure_agentless_setup/main.py

mohamed-challal requested a review from gpalmz March 16, 2026 13:06

diogocp approved these changes Mar 16, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Mar 16, 2026

View reviewed changes

Comment thread azure/agentless/src/azure_agentless_setup/preflight.py

Comment thread azure/agentless/src/azure_agentless_setup/preflight.py

gpalmz approved these changes Mar 16, 2026

View reviewed changes

mohamed-challal merged commit 4d55ac3 into main Mar 17, 2026
1 check passed

mohamed-challal deleted the mohamed.challal/agentless-azure-cloud-shell-scaffolding branch March 17, 2026 14:21

mohamed-challal mentioned this pull request Mar 23, 2026

[K9VULN-12535] feat(agentless-azure): implement cloud shell deploy flow (Step 2) #154

Merged

Conversation

mohamed-challal commented Mar 13, 2026

What does this PR do?

Why?

Related

What's included

Deploy steps overview

How to test

Uh oh!

gpalmz commented Mar 13, 2026 • edited by mohamed-challal Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mohamed-challal commented Mar 13, 2026

Uh oh!

chatgpt-codex-connector Bot commented Mar 13, 2026

Uh oh!

mohamed-challal commented Mar 13, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

gpalmz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mohamed-challal commented Mar 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

gpalmz commented Mar 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

gpalmz left a comment

Choose a reason for hiding this comment

Uh oh!

gpalmz Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

mohamed-challal Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

mohamed-challal commented Mar 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gpalmz commented Mar 13, 2026 •

edited by mohamed-challal

Loading