AZURE-PROXY-AGENT(8)

📦 version 1.0.30, in ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 AZURE-PROXY-AGENT(8) 💖

okay bestie, sit down, hydrate, and let me tell you about azure-proxy-agent — it's a section 8 manual page (that's "User Commands" territory, admin girlies only) and it is literally the bouncer for your VM's metadata. ✨

🌸 NAME 🌸

azure-proxy-agent — securing Azure Instance Metadata Service (IMDS) endpoints on guest VMs, no cap 🔥

🦋 SYNOPSIS 🦋

azure-proxy-agent [ -c | --config file ] [ -h | --help ]

that's it. that's the whole vibe. two flags. she's lowkey minimalist. 💅

👑 DESCRIPTION 👑

so here's the tea, bestie. azure-proxy-agent makes the Azure Instance Metadata Service (IMDS) and the Azure Wireserver endpoints — think 169.254.169.254 and 168.63.129.16 — way more secure on Azure IaaS virtual machines. 🫶

she rolls up with strong authentication and authorization measures to shut down the classic little attacks, like confused deputy (you know her — SSRF's messy cousin 😭) and sandbox escapes that go after metadata services. not on her watch. 💀

how does she do it? the agent intercepts HTTP requests to these endpoints using eBPF, which lets her verify in-guest process identities. iconic behaviour, honestly. 🧚

and the glow-up? she flips the whole model from default-open to default-closed 🔒. that means the guest proxy agent makes sure only authorized processes — specifically the ones defined by a trusted delegate established at provisioning — can touch that sensitive metadata. everybody else? blocked. periodt.

oh and all requests must include an HMAC-based signature generated with a long-lived secret negotiated during setup. so it's a secure, point-to-point trust relationship. very exclusive. very VIP. very much not for random processes. 💅✨

✨ OPTIONS ✨

  • -c, --config file — points her at a different config file if you're feeling spicy. by default tho, the agent reads its settings from /etc/azure/proxy-agent.json 📁
  • -h, --help — prints a lil brief help message and dips. short, sweet, slay. 🎀

💜 AUTHOR 💜

Microsoft Azure 🫡

© Microsoft Corporation. Licensed under the MIT License. 🍓

and that's the whole page, bestie — written by Microsoft Azure, dated January 2025, living in the AZURE PROXY AGENT(8) section of the manual like the queen she is. go forth and protect those metadata endpoints. 💖🦋✨

📦 where this page comes from