Hybrid VPC — Azure Blob Storage

​

Prerequisites

• Azure subscription with permissions to create Storage accounts and role assignments
• Terraform 1.2+ with the AzureRM provider (for automated setup)
• Values from Reducto (provided during onboarding):
  • Reducto’s Azure AD application ID (for cross-tenant access)
  • Organization ID for configuration

​

Architecture

​

Setup

git clone https://github.com/reductoai-collab/reducto-hybrid-infra.git
cd reducto-hybrid-infra/examples/azure

name_prefix       = "reducto"
location          = "eastus"
resource_group_name = "reducto-hybrid-rg"

# Provided by Reducto during onboarding
reducto_service_principal_object_id = "<object-id-from-reducto>"

tags = {
  Environment = "production"
  Project     = "reducto-hybrid"
}

terraform init
terraform plan
terraform apply

terraform output integration_values

​

Components provisioned

​

Integration Values

​

Data Lifecycle

{
  "rules": [
    {
      "name": "auto-expire",
      "type": "Lifecycle",
      "definition": {
        "actions": {
          "baseBlob": {
            "delete": {
              "daysAfterModificationGreaterThan": 1
            }
          }
        },
        "filters": {
          "blobTypes": ["blockBlob"]
        }
      }
    }
  ]
}

​

Security

• Cross-tenant access: Reducto’s service principal is granted only Storage Blob Data Contributor on the specific container
• No shared keys required: RBAC-based access is more secure than shared key authentication
• Network restrictions: Optionally restrict access to specific IP ranges or virtual networks
• Automatic cleanup: Lifecycle management policies ensure no long-term data persistence