Documentation / Advanced Configurations

Azure Template

Azure ARM Template Scanner

If your governance policy requires every Azure resource to come from an approved ARM template, Prancer can launch the pentest scanner (Azure Container Instances) from a template you keep in Git rather than provisioning it directly.

Before you start

  • An Azure DevOps or GitHub repository (private or public).
  • A Personal Access Token (PAT) for the repository with permission to clone.
  • An ARM template (template.json) for an Azure Container Instance, with these placeholders parameterised:
  • containerGroupName, containerName
  • image (e.g. prancer/prancer-pac:latest or myregistry.azurecr.io/prancer-pac:latest)
  • environment variables and CPU/memory requests
  • Permissions to deploy ARM templates in the target subscription and resource group.
Tip: Use a custom Azure Container Registry image only if your policy forbids public Docker Hub pulls — the public image is updated continuously by Prancer.

1. Create the PAC application

Scaffold the app via the PAC Wizard (Azure).

2. Upload the Git connector

Register your repo with PAC file on Git.

3. Reference the template in the PAC config

In PAC Management, edit the PAC config and point the Azure scanner block at your template.

Scanner:
  Cloud:
    Platform:
      Azure:
        ContainerInstance:
          AfterRun: delete
          Connector: <git-connector-name>
          TemplateFile: /arm/aci-template.json
          ParamsFile:   /arm/aci-params.json
          NewContainerInstance:
            External:
              SubscriptionId: <subscription-id>
              ResourceGp: <resource-group>
              Region: eastus2
              ContainerGroupName: prancer-scanner-group
              ContainerName: prancer-pentest-instance

| Field | Description |

| --- | --- |

| Connector * | Git connector that holds the ARM template. |

| TemplateFile * | Path to the ARM template in the repo. |

| ParamsFile | Optional ARM parameters file. |

| AfterRun | delete (recommended) or keep. |

Warning: Make sure the service principal/PAT used by Prancer has Contributor rights on the target resource group, otherwise ARM deployment will fail with AuthorizationFailed.

Next steps