azku

[!WARNING] This is an early alpha release. Commands, options and output may change between versions without notice. Commands that change things in Azure (config set, config restart, logs console-capture, firewall allow|revoke) act with your own permissions: check what they do with --help first.

Heroku-style CLI for apps hosted in Azure: App Services, Function Apps, Container Apps and Static Web Apps. It talks to the Azure REST APIs directly, so the az CLI is not needed.

npx @codevco/azku login
npx @codevco/azku list

Or install it once: npm install -g @codevco/azku, then run azku. Needs Node.js 22.18 or later.

Commands

| Command | What it does | | --------------------------------------------- | ----------------------------------------------------------------------- | | azku login / logout / whoami | Log in to Azure in the browser (--device-code without one) | | azku tenant | Your tenant, its subscriptions and your other tenants | | azku list / azku list rg | Apps, or resource groups with their resource and app counts | | azku list subscriptions | The subscriptions in your tenant, with their app counts | | azku info -a <app> / azku info --rg <rg> | Details of an app or of a resource group | | azku config -a <app> [--secrets] | An app's environment variables, optionally with secret values | | azku config get <NAME> -a <app> | One environment variable | | azku config set <KEY=value>... -a <app> | Set environment variables (restarts the app or makes a new revision) | | azku config restart -a <app> | Restart the app, e.g. after changing a secret it uses | | azku logs -a <app> [--tail] | Recent console output, optionally streamed | | azku logs console-capture [enable\|disable] | Whether an App Service captures its console output | | azku logs insights -a <app> [--request] | Application Insights traces, or the requests the app served | | azku firewall [list] | Every PostgreSQL and Azure SQL server, and whether your IP may reach it | | azku firewall allow --server <name> | Let your public IP through a database server's firewall | | azku firewall revoke [--server <name>] | Remove your rules from that server, or from every server | | azku db list [--postgres\|--sql] | The databases on every PostgreSQL and Azure SQL server | | azku db url --db <name> | Connection URL for local tools, signed in as you with Entra |

azku <command> --help shows every option, with examples.

Configuration

Without configuration, login signs in to your account's home tenant and the other commands search every subscription you can read. To pin a tenant and a subscription, create azku.config.json in your project (it is found in the current directory or any parent), or ~/.config/azku/config.json for all projects:

{
  "azure": {
    "tenant": "contoso.onmicrosoft.com",
    "subscription": "Production"
  }
}

subscription is a name or an id; --subscription and --all override it per command.

azku login --tenant <id or domain> saves the tenant in ~/.config/azku/config.json, so later logins use it without --tenant. A setting in a project's azku.config.json wins over the one in ~/.config/azku/config.json.

Permissions

azku signs in with the Azure CLI's public client and acts with your own Azure permissions: reading apps needs Reader, changing settings needs Contributor (or Website Contributor), and --secrets needs Key Vault Secrets User on the vaults an app references. Credentials are stored in ~/.config/azku/credentials.json, readable only by you.