Introduction
Two weeks ago, I published a blog post about the product Turbot Pipes in the Cloud (SaaS). I hinted that something similar with potentially less functionality could also be possible locally on your own machine or server, especially if you’re not a big fan of SaaS solutions or need to adhere to company policies.
Today, I’m going to show you how you can set up a similar setup with Powerpipe on your own computer, allowing you to, for example, check your tenant against CIS controls.
Prerequisites
The following prerequisites must be met in order to follow the tutorial:
Operating system
- macOS
- Linux
- Windows with WSL 2.0 and Ubuntu 20.04.1 LTS
Database
- Postgres
- MySQL
- SQLite
- DuckDB
Microsoft Azure
- Tenant access
- App Registration
Installing Powerpipe
I’m installing Powerpipe on my macOS. You can find instructions on how to install it on other operating systems like Linux or Windows with WSL 2.0 here: Install Powerpipe
- Install Powerpipe with macOS package manager Homebrew
brew install turbot/tap/powerpipe - Check installed version
powerpipe -v - Initialize Powerpipe and make it ready to use
powerpipe mod init
Powerpipe Server starting
Since Powerpipe currently supports five different databases, there are accordingly four possible ways Powerpipe can be started as a server with the respective database.
Steampipe integrated database (Recommended)
brew install turbot/tap/steampipe -> For macOS
steampipe service start
Postgres
powerpipe server postgres://myusername:[email protected]:9193/steampipe
MySQL
powerpipe server –database ‘mysql://root:my_pass@tcp(localhost)/mysql’
SQLite
powerpipe server –database ‘sqlite:./my_sqlite_db.db’
DuckDB
powerpipe server –database ‘duckdb:./my_ducks.db’
Once the Powerpipe server has successfully started, the URL http://localhost:9033 can be opened in the browser. Initially, this will look very empty without any dashboards.
How to install Azure CIS dashboard ?
In order for the Azure Compliance dashboard to be fully utilized in your local Powerpipe as in Turbot Pipes, a few additional installations are needed, such as Steampipe and Azure Compliance dashboard.
- Install Steampipe with macOS package manager Homebrew
brew install turbot/tap/steampipe - Install Azure plugins for Steampipe
steampipe plugin install azure - Install mod/dashboard
powerpipe mod install github.com/turbot/steampipe-mod-azure-compliance - You can store the Azure App Registration credentials for the connection at the following location: -> ~/.steampipe/config/azure.spc
tenant_id = “00000000-0000-0000-0000-000000000000”
subscription_id = “00000000-0000-0000-0000-000000000000”
client_id = “00000000-0000-0000-0000-000000000000”
client_secret = “~dummy@3password” - Restart the Powerpipe server according to the description above.
- Open the Powerpipe Dashboard in the browser at http://localhost:9033
Conclusion
Personally, I find Powerpipe in combination with Steampipe a good alternative to the SaaS solution Turbot Pipes. Depending on the use case, it can make sense to switch to the self-hosted solution, for example, for compliance reasons, if data is not allowed to leave certain data centers or locations.
Powerpipe/Steampipe offers many more dashboards, but they would go beyond the scope of this blog article. Feel free to check out the Powerpipe Hub, where you’ll find a wide variety of existing dashboards.