AWS Builder Center

Builder Center

Cross-Cloud Integration with Azure (Part 5)

Cross-Cloud Integration with Azure (Part 5)

In this part, we will: Create a free Azure account and launch an Azure VM Set up Azure Monitor with a CPU alert on the VM Create an Azure Service Principal so the DevOps Agent can read your Azure environment Connect Azure as a Capability Provider in the Agent Space Verify the agent can see and describe your Azure resources Run a cross-cloud investigation that spans both AWS and Azure

Series: Setting Up AWS DevOps Agent from Scratch (7 articles)

  1. 1
    What is AWS DevOps Agent? A Beginner’s Guide to Autonomous Incident Response — PART 1
  2. …
  3. 5
    Cross-Cloud Integration with Azure (Part 5) This article
  4. 6
    Custom Skills with MCP Servers (Part 6)

Fawaz c p

The Goal: One Agent, Two Clouds
Most organisations treat AWS and Azure as separate observability silos — different dashboards, different on-call tools, different alert channels. When an incident spans both clouds, engineers waste time manually correlating events across systems.
The AWS DevOps Agent solves this through Capability Providers. By registering Azure as a provider, the agent gains read access to your Azure subscription and can include Azure resources in its topology map, answer questions about Azure workloads, and correlate Azure events during investigations alongside AWS signals.
1
2
3
4
5
6
7
8
AWS Account Azure Subscription
───────────────── ──────────────────────
EC2, CloudWatch ←──────→ Azure VM, Azure Monitor
Security Groups Virtual Networks
VPCs Resource Groups
↑ ↑
└──────── DevOps Agent ────────┘
(unified topology map)

Step 1: Create a Free Azure Account

If you already have an Azure subscription, skip to Step 2.
1. Go to [azure.microsoft.com/free](https://azure.microsoft.com/free ).
2. Click Start free and sign in with a Microsoft account (or create one).
3. Complete the identity verification and billing setup.
The Azure free account includes $200 credit for 30 days— more than enough to run a small VM for this demo. When you’re done, you can stop and delete the VM to avoid any charges.

Step 2: Launch an Azure Virtual Machine

2.1 — Create the VM

  1. In the Azure portal, search for Virtual machines and click **Create → Azure virtual machine.
  2. Configure the basics:
1
2
3
4
5
6
7
8
9
| Setting | Value |
|---|---|
| **Subscription** | Your free subscription |
| **Resource group** | Create new: `devops-agent-demo-rg` |
| **Virtual machine name** | `devops-agent-azure-vm` |
| **Region** | East US (or your closest region) |
| **Image** | Ubuntu Server 24.04 LTS |
| **Size** | Standard_B1s (1 vCPU, 1 GiB RAM — free tier eligible) |
| **Authentication type** | SSH public key |
3. Under Inbound port rules, allow SSH (22).
4. Click Review + create → Create.
5. Wait for the deployment to complete.
Press enter or click to view image in full size

2.2 — Tag the VM

Like the AWS EC2 instance in Part 3, tags give the agent useful context when answering questions.
  1. Open the VM → click Tags in the left menu.
  2. Add the following tags and click Apply:
1
2
3
4
| Key | Value |
|---------------|---------------------|
| `Application` | `devops-agent-demo` |
| `Environment` | `dev` |

Step 3: Set Up Azure Monitor Alert

We’ll create a CPU alert on the VM — mirroring the CloudWatch alarm we set up on the AWS side in Part 3.

3.1 — Enable Metrics

Azure Monitor collects metrics automatically for Azure VMs. No agent installation is needed for basic CPU metrics.
  1. In the Azure portal, open your VM `devops-agent-azure-vm`.
  2. In the left menu, click Monitoring → Metrics.
  3. Confirm you can see Percentage CPU in the metrics chart — this confirms Azure Monitor is collecting data.
Press enter or click to view image in full size

3.2 — Create a CPU Alert Rule

  1. In the VM left menu, click Monitoring → Alerts → Create → Alert rule.
  2. Under Condition, click Add condition:
  • Signal name: Percentage CPU
  • Threshold: Static
  • Operator: Greater than
  • Threshold value: 80
  • Aggregation type: Average
  • Check every: 1 minute
  • Lookback period: 5 minutes
3. Under Actions, skip action groups for now (the DevOps Agent will pick up the alert state directly via the Azure integration).
4. Under Alert rule details:
— Alert rule name: `devops-agent-azure-cpu-alert`
— Severity: Sev 2
5. Click Review + create → Create.
Press enter or click to view image in full size

Step 4: Enable AWS Outbound Identity Federation

Before the DevOps Agent can authenticate to Azure, you need to enable Outbound Identity Federation in IAM. This generates a Token Issuer URL — the OIDC endpoint that Azure will use to verify tokens issued by AWS. No client secret is involved.
  1. Open the AWS IAM Console.
  2. In the left nav, click Account settings.
  3. Find the Outbound Identity Federation section and click Enable.
  4. Once enabled, the page shows a Token Issuer URL — copy this value. You will need it in Step 5.a
Press enter or click to view image in full size

Step 5: Create an Azure App Registration with Federated Credential

The DevOps Agent authenticates to Azure using Workload Identity Federation — a trust relationship between AWS’s OIDC endpoint and your Azure App Registration. There is no client secret to create, rotate, or store.

5.1 — Register an App in Microsoft Entra ID

  1. In the Azure portal, search for Microsoft Entra ID (formerly Azure Active Directory).
  2. In the left menu, click App registrations → New registration.
  3. Configure:
    — Name: `devops-agent-integration`
    — Supported account types: Accounts in this organizational directory only
  4. Click Register.
After registration, you’ll land on the app’s overview page. Copy and save the following— you’ll need them when connecting to the DevOps Agent:
1
2
3
4
| Value | Where to find it |
|-------------------------|-------------------|
| Application (client) ID | App overview page |
| Directory (tenant) ID | App overview page |
Press enter or click to view image in full size

5.2 — Add a Federated Credential

Instead of a client secret, we configure Azure to trust OIDC tokens issued by AWS.
1. In the app’s left menu, click Certificates & secrets → Federated credentials → Add credential.
2. For Federated credential scenario, select Other issuer.
3. Fill in the following fields:
1
2
3
4
5
6
| Field | Value |
|------------------------|-----------------------------------------|
| **Issuer** | The Token Issuer URL you copied from IAM Account settings in Step 4 |
| **Subject identifier** | The IAM role ARN shown in the DevOps Agent wizard's Part 1 — copy it from there (format: `arn:aws:iam::<account-id>:role/service-role/DevOpsAgentRole-AzureWIT-<suffix>`) |
| **Audience** | `api://AzureADTokenExchange` |
| **Name** | `devops-agent-federation` |
Where to find the Subject identifier: In the DevOps Agent wizard (Step 1 — Prerequisites), scroll down to the IAM role ARN (subject identifier) section. The wizard auto-generates this role ARN for your account. Copy the exact value shown
 
4. Click Add.
Press enter or click to view image in full size

5.3— Grant Reader Access on the Subscription

The service principal now has read-only access to everything in your Azure subscription.
Press enter or click to view image in full size
  1. In the Azure portal, search for Subscriptions and open your subscription.
  2. In the left menu, click Access control (IAM) → Add → Add role assignment.
  3. Under Role, search for and select Reader.
  4. Click Next → Members → Select members.
  5. Search for `devops-agent-integration` and select it.
  6. Click Review + assign → Assign.
The app registration now has read-only access to all resources in your Azure subscription.
Press enter or click to view image in full size

Step 6: Connect Azure in the DevOps Agent

Now we register the Azure integration in the Agent Space.

6.1 — Open the Capability Providers Section

  1. In the AWS Management Console, navigate to AWS DevOps Agent → Agent Spaces and open your Agent Space.
  2. Click the Capabilities tab.
  3. Scroll down to the Capability providers section.
  4. Find Azure Cloud and click Add.
Press enter or click to view image in full size

6.2 — Complete the Prerequisites (Step 1)

Step 1 of the wizard shows two sections:
Set up Outbound Identity Federation — a checklist of the steps we completed in Steps 4 and 5. Confirm all steps are done.
IAM role — choose how the wizard creates the IAM role that the DevOps Agent will assume when calling Azure:
- Create a new role (recommended) — the wizard automatically creates an IAM role with the correct trust policy. The IAM role ARN is shown at the bottom as the subject identifier you used in the Azure federated credential.
- Use an existing role / Enter a role ARN — only needed if you already have a role configured for web identity federation.
Leave Create a new role selected and click Next.

6.3 — Enter the Configuration (Step 2)

The wizard’s Configuration page asks for three fields:
1
2
3
4
5
6
| Field | Value |
|-------------------|---|
| **Registration name** | A friendly name, e.g. `devops-agent-azure` |
| **Tenant ID** | Directory (tenant) ID from your Entra ID app |
| **Client ID** | Application (client) ID from your Entra ID app |
| **Token audiences** | Leave as `api://AzureADTokenExchange` (pre-filled) |
Enter the values and click Next.
Press enter or click to view image in full size

6.4 — Review and Submit (Step 3)

Review the details and click Submit. The wizard validates the federation trust by requesting a token from AWS’s OIDC endpoint and presenting it to Azure.
On success you’ll see: ”Azure identity registered successfully”
The wizard then immediately continues to the next step.
Press enter or click to view image in full size
Then — enter the Subscription ID in the DevOps Agent wizard
Once associated, Azure Cloud will appear under Capability providers. The Status column may initially show ` — ` — this is normal. The agent starts scanning your Azure subscription in the background and the status updates within a few minutes. You don’t need to wait for it before proceeding.
Press enter or click to view image in full size

Step 7: Verify the Agent Can See Azure Resources

7.1 — Ask the Agent About Your Azure VM

  1. Open the DevOps Agent web app via Operator access.
  2. Click + New chat.
  3. Type:
1
What Azure resources do you have access to?
The agent will query your Azure subscription and return a summary of discovered resources — including `devops-agent-azure-vm`, the resource group `devops-agent-demo-rg`, virtual network, and any other resources in the subscription.
1
2
3
4
You can also try:
- *"What virtual machines are running in Azure?"*
- *"Give me a health summary across both AWS and Azure."*
- *"Compare my EC2 instance and my Azure VM configuration."*
Press enter or click to view image in full size

7.2 — Check the Topology Graph

  1. In the web app left sidebar, click Topology.
  2. The graph now includes both AWS and Azure nodes.
Look for the Azure VM node alongside your EC2 instance and its connected AWS resources (security groups, subnet, VPC, CloudWatch alarm). The agent represents resources from both clouds in a single unified graph.
Press enter or click to view image in full size
> **[SCREENSHOT]** — Topology graph showing AWS resources (EC2, VPC, CloudWatch alarm) alongside Azure resources (VM, resource group, virtual network).

Step 8: Run a Cross-Cloud Investigation

Now let’s confirm the agent can investigate across clouds — not just list resources.

8.1 — Start a Manual Investigation

  1. In the web app, click Incident Response in the left sidebar.
  2. Click Start investigation.
  3. In the description field, enter:
1
High CPU utilisation detected on the Azure VM devops-agent-azure-vm. Investigate the affected resources and assess whether there is any relationship to AWS workloads.
Click into the investigation to follow it in real time. You’ll see the agent:
1. Identify the Azure VM as the primary affected resource
2. Traverse Azure topology — VM → virtual network → resource group → subscription
3. Cross-reference the AWS side — checking whether any AWS resources depend on or connect to the Azure workload
4. Correlate monitoring signals — checking Azure Monitor alert state and CloudWatch alarms simultaneously
5. Generate findings — root cause assessment and remediation suggestions spanning both clouds
Press enter or click to view image in full size

8.3 — Review the Cross-Cloud Results

Once the investigation completes:
  • Affected resources will include both Azure and AWS resources if any relationship was found
  • Remediation suggestions will be cloud-aware — the agent knows which cloud each resource belongs to and which actions are appropriate
  • Topology will be updated with any new relationships discovered during the investigation
Press enter or click to view image in full size

What We Accomplished

In this part, we:
  • Created a free Azure account and launched an Ubuntu VM (`devops-agent-azure-vm`)
  • Set up Azure Monitor with a CPU alert mirroring the CloudWatch alarm from Part 3
  • Enabled AWS Outbound Identity Federation in IAM and noted the Token Issuer URL
  • Created an Azure App Registration and configured a Federated Credential — Issuer (Token Issuer URL), Subject (the `DevOpsAgentRole-AzureWIT` ARN from the wizard), Audience (`api://AzureADTokenExchange`) — no client secret required
  • Registered the Azure identity in the DevOps Agent wizard (Tenant ID + Client ID) and associated the Azure subscription with the Reader role assigned to the `AWS DevOps Agent` service principal
  • Verified the agent can discover and describe Azure resources via chat
  • Explored the unified Topology graph showing both AWS and Azure nodes
  • Ran a cross-cloud investigation and saw the agent reason across both environments
The DevOps Agent now has a single, unified view of infrastructure spanning two clouds — with one topology map, one investigation interface, and one place to review findings.

What’s Next — Part 6

In Part 6 — Custom Skills with MCP Servers, we’ll extend the agent with your own tools:
  • Understand what MCP (Model Context Protocol) Servers are and how the agent uses them
  • Connect a custom MCP Server as a Capability Provider in the Agent Space
  • Define a custom skill that gives the agent access to data or actions it doesn’t have by default
  • See the agent use the custom skill during an investigation
Full article URL: https://medium.com/@fawazcp/setting-up-aws-devops-agent-from-scratch-cross-cloud-integration-with-azure-part-5-032115a7a300?sharedUserId=fawazcp
If you found this helpful, follow along for Part 6. Questions or issues? Drop them in the comments below.
# agentic-ai# agents# devops# devops-pro

Series: Setting Up AWS DevOps Agent from Scratch (7 articles)

  1. 1
    What is AWS DevOps Agent? A Beginner’s Guide to Autonomous Incident Response — PART 1
  2. …
  3. 5
    Cross-Cloud Integration with Azure (Part 5) This article
  4. 6
    Custom Skills with MCP Servers (Part 6)
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article