Powerpipe

Go to Marketplace in the Azure Portal, search for Powerpipe, select the SecureAnyCloud publisher entry, and choose Create.

On the Networking tab, attach a network security group that allows inbound TCP 22 from your management IP range and TCP 80 from your trusted client networks. A per-VM Basic Auth password protects the dashboard on port 80, but you should still restrict the source ranges. Also add TLS (port 443) before connecting Powerpipe to real data, as described in Step 8.

Choose Review + create, wait for validation, then choose Create. Deployment takes around two minutes.

RG="powerpipe-prod" LOCATION="eastus" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:powerpipe-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" \
  --name powerpipe-01 \
  --image sac1647283583153:powerpipe-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
# Allow SSH (22) and the authenticated dashboard (80) from your trusted ranges az vm open-port --resource-group "$RG" --name powerpipe-01 --port 22 --priority 1001 az vm open-port --resource-group "$RG" --name powerpipe-01 --port 80 --priority 1002

If you need a different URN, replace <publisher>:<offer>:<sku> with the one shown on the Marketplace listing's Usage Information tab.

ssh azureuser@<vm-public-ip>

Use the private key that matches the public key you supplied at deploy time. The login user for this image is azureuser.

Confirm that the Powerpipe server and the nginx proxy are running, and check the listening sockets. Powerpipe binds to 127.0.0.1:9033 only, so it is reachable off the VM solely through the authenticated nginx proxy on port 80.

powerpipe --version systemctl is-active powerpipe nginx
sudo ss -ltn | grep -E ':80 |:9033'

Expected output:

Powerpipe v1.5.3 active active LISTEN 0 4096 127.0.0.1:9033 0.0.0.0:* LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 511 [::]:80 [::]:*

On the first boot of your virtual machine, powerpipe-firstboot.service generates a unique Basic Auth password and writes it to a root-only file. Retrieve it with:

sudo cat /root/powerpipe-credentials.txt

The file reports the dashboard URL, the user name (admin) and the generated password:

powerpipe.url=http://<vm-public-ip>/ powerpipe.dashboard.user=admin powerpipe.dashboard.pass=<generated-per-vm>

The dashboard proxy rejects requests with no credentials or a wrong password, and accepts the per-VM password:

curl -s -o /dev/null -w 'no credentials -> HTTP %{http_code}\n' http://127.0.0.1/
PASS=$(sudo grep '^powerpipe.dashboard.pass=' /root/powerpipe-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'wrong password -> HTTP %{http_code}\n' -u 'admin:definitely-wrong' http://127.0.0.1/
curl -s -o /dev/null -w 'per-VM password -> HTTP %{http_code}\n' -u "admin:$PASS" http://127.0.0.1/

Expected output:

no credentials -> HTTP 401 wrong password -> HTTP 401 per-VM password -> HTTP 200

In a browser, go to http://<vm-public-ip>/ and sign in with the user admin and the password from Step 5. Powerpipe lists the bundled dashboards and benchmarks, then renders them on demand.

The Sample Security Posture dashboard renders real content from the local SQLite backend. It shows summary cards, a bar chart of resources by type, a donut chart of encryption coverage, and a full resource inventory table:

The Sample Compliance Benchmark grades the sample resources against three controls and shows real pass/fail results:

The bundled mod lives at /var/lib/powerpipe/mod (owned by the powerpipe service account). You can run its benchmark and ad-hoc queries from the command line. The commands run as the powerpipe user against the mod's default SQLite backend:

sudo -u powerpipe env HOME=/var/lib/powerpipe \
  POWERPIPE_INSTALL_DIR=/var/lib/powerpipe/.powerpipe \
  POWERPIPE_MOD_LOCATION=/var/lib/powerpipe/mod \
  bash -c 'cd /var/lib/powerpipe/mod && powerpipe query run \
  "select resource_type as type, count(*) as total from resources group by resource_type order by total desc" \
  --output table'

Expected output:

+----------------+-------+ | type | total | +----------------+-------+ | iam_user | 4 | | compute_vm | 4 | | volume | 3 | | storage_bucket | 3 | | database | 3 | | load_balancer | 2 | | key_vault | 1 | +----------------+-------+

Run the bundled benchmark directly to see the same grading that the dashboard shows:

sudo -u powerpipe env HOME=/var/lib/powerpipe \
  POWERPIPE_INSTALL_DIR=/var/lib/powerpipe/.powerpipe \
  POWERPIPE_MOD_LOCATION=/var/lib/powerpipe/mod \
  bash -c 'cd /var/lib/powerpipe/mod && powerpipe benchmark run sac_sample.benchmark.sample_compliance' || true
# Note: powerpipe benchmark run exits non-zero when any control is in alarm — that is expected
# and simply reflects that the sample data contains resources that fail the sample controls.

The query engine returns the aggregated rows that the dashboards visualize.

The dashboard is served over plain HTTP on port 80 with Basic Auth. Before connecting Powerpipe to real data, terminate TLS in front of it. You can use the SecureAnyCloud nginx-ssl-certbot-ubuntu-24-04 image as a companion reverse proxy, or add a Let's Encrypt certificate to the bundled nginx:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Point your DNS A record at the VM's public IP first, and open port 443 in the network security group. Certbot updates the bundled nginx vhost in place and preserves the Basic Auth configuration.

To rotate the Basic Auth password, update the htpasswd file and reload nginx:

sudo htpasswd /etc/nginx/.powerpipe.htpasswd admin
sudo systemctl reload nginx

htpasswd prompts you for the new password. To add another user, use sudo htpasswd /etc/nginx/.powerpipe.htpasswd <username>.

The bundled mod points Powerpipe at a local SQLite file, so it renders content out of the box. To use your own data, choose one of two common options.

A. Repoint the sample mod at your own backend. Edit the mod's database argument to a Postgres, SQLite, DuckDB or MySQL connection string, then restart Powerpipe:

# Edit /var/lib/powerpipe/mod/mod.pp and set the mod's `database` argument, e.g.: # database = "postgres://user:pass@host:5432/db" sudo systemctl restart powerpipe

SQLite backends use the sqlite://<absolute-path> form, DuckDB uses duckdb://<absolute-path>, and Postgres and MySQL use standard connection URLs. See the Powerpipe database documentation for the full syntax, including how to use a running Steampipe instance as the backend.

B. Install official Turbot mods. Turbot publishes a large library of open source compliance and insight mods (AWS, Azure, GCP, Kubernetes and more). Install one into a mod workspace and run it against your backend:

sudo -u powerpipe -H bash -c \
  'cd /var/lib/powerpipe/mod && powerpipe mod install github.com/turbot/steampipe-mod-azure-compliance'
sudo systemctl restart powerpipe

These compliance mods query cloud data through Steampipe, so point Powerpipe at a Steampipe backend (or another SQL source populated with your data). The SecureAnyCloud sample mod remains available as a self-contained reference.

# Status and logs systemctl status powerpipe --no-pager sudo journalctl -u powerpipe -n 100 --no-pager
# Restart after changing the mod or backend
sudo systemctl restart powerpipe
# The nginx proxy (Basic Auth + TLS termination)
systemctl status nginx --no-pager sudo systemctl reload nginx

Powerpipe runs as the non-root powerpipe system user with WorkingDirectory=/var/lib/powerpipe/mod. The unit is gated on a first-boot marker, so it does not start until powerpipe-firstboot.service has created the per-VM credential.

http://<vm-public-ip>/ returns 401 for every password. The htpasswd was not created, or you are using the wrong password. Re-read sudo cat /root/powerpipe-credentials.txt, or re-create it with sudo htpasswd /etc/nginx/.powerpipe.htpasswd admin && sudo systemctl reload nginx.

The dashboard page loads but shows no data. Check the backend connection in /var/lib/powerpipe/mod/mod.pp and the Powerpipe logs with sudo journalctl -u powerpipe -n 100. For the bundled sample, the SQLite file must exist at /var/lib/powerpipe/mod/data/sac.db.

powerpipe.service is inactive. Confirm the first-boot marker exists: ls -l /var/lib/sac/data/powerpipe-firstboot.done. If missing, run sudo systemctl start powerpipe-firstboot.service, then sudo systemctl start powerpipe.

could not evaluate backend ... unknown backend. The SQLite or DuckDB connection string needs the sqlite:// or duckdb:// scheme followed by an absolute path. A bare path is rejected.

• Restrict inbound port 80/443 to trusted source ranges in the network security group. Do not expose the dashboard to the whole internet.
• Add TLS (Step 8) before connecting Powerpipe to any real or sensitive data.
• Rotate the Basic Auth password (Step 9) after first login and on a schedule.
• Keep the Powerpipe server bound to loopback (the default). Always reach it through the authenticated proxy, and never open port 9033 in the network security group.
• Apply OS security updates regularly. The image ships with unattended-upgrades enabled.

Powerpipe is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). The full license text is shipped at /usr/local/share/powerpipe/LICENSE. Powerpipe is a trademark of Turbot HQ, Inc. SecureAnyCloud is not affiliated with or endorsed by Turbot.

SecureAnyCloud provides 24/7 technical support for this image by email (sales@secureanycloud.com) and live chat. Support covers:

• Deployment
• Retrieving and rotating the dashboard password
• Adding TLS and a custom domain
• Connecting your own Steampipe/Postgres/SQLite/DuckDB/MySQL backend
• Installing official Turbot mods
• Authoring custom dashboards and benchmarks
• Upgrades and patch management
• Troubleshooting

Critical issues receive a one hour average response time.

Deploy on Azure

Launch Powerpipe on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com