-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: added workload identity federation
- Loading branch information
Myroslav Levchyk
authored and
Myroslav Levchyk
committed
Apr 5, 2024
1 parent
f183ae3
commit 3c87942
Showing
5 changed files
with
201 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| locals { | ||
| key_vault_policy_config_mapped = { for object in var.key_vault_policy_config : object.key_vault_name => object } | ||
| } | ||
|
|
||
| data "azuredevops_project" "this" { | ||
| name = var.ado_project_name | ||
| } | ||
|
|
||
| resource "azurerm_user_assigned_identity" "this" { | ||
| name = var.user_assigned_identity_name | ||
| resource_group_name = var.resource_group | ||
| location = var.location | ||
| } | ||
|
|
||
| resource "azuredevops_serviceendpoint_azurerm" "this" { | ||
| count = var.ado_workload_identity_federation_enabled ? 1 : 0 | ||
|
|
||
| project_id = data.azuredevops_project.this.project_id | ||
| service_endpoint_name = coalesce(var.custom_serviceendpoint_name, "federated-(${var.subscription_id})-${var.user_assigned_identity_name}") | ||
| description = "Managed by Terraform" | ||
| service_endpoint_authentication_scheme = "WorkloadIdentityFederation" | ||
| credentials { | ||
| serviceprincipalid = azurerm_user_assigned_identity.this.client_id | ||
| } | ||
| azurerm_spn_tenantid = var.tenant_id | ||
| azurerm_subscription_id = var.subscription_id | ||
| azurerm_subscription_name = "Example Subscription Name" | ||
| } | ||
|
|
||
| resource "azurerm_federated_identity_credential" "this" { | ||
| count = var.ado_workload_identity_federation_enabled ? 1 : 0 | ||
|
|
||
| name = coalesce(var.custom_federated_identity_credential_name, "federated-${var.user_assigned_identity_name}") | ||
| resource_group_name = var.resource_group | ||
| parent_id = azurerm_user_assigned_identity.this.id | ||
| audience = ["api://AzureADTokenExchange"] | ||
| issuer = azuredevops_serviceendpoint_azurerm.this[0].workload_identity_federation_issuer | ||
| subject = azuredevops_serviceendpoint_azurerm.this[0].workload_identity_federation_subject | ||
| } | ||
|
|
||
|
|
||
| resource "azurerm_role_assignment" "this" { | ||
| count = alltrue([var.ado_workload_identity_federation_enabled, var.role_assignments_allowed]) ? 1 : 0 | ||
|
|
||
| principal_id = azurerm_user_assigned_identity.this.principal_id | ||
| scope = var.role_assignment_scope | ||
| role_definition_name = "Reader" | ||
| } | ||
|
|
||
| resource "azurerm_key_vault_access_policy" "assigned_identity" { | ||
| for_each = var.ado_workload_identity_federation_enabled ? local.key_vault_policy_config_mapped : {} | ||
|
|
||
| object_id = azurerm_user_assigned_identity.this.principal_id | ||
| key_vault_id = each.value.key_vault_id | ||
| tenant_id = each.value.tenant_id | ||
| key_permissions = each.value.key_permissions | ||
| secret_permissions = each.value.secret_permissions | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| output "azurerm_user_assigned_identity_name" { | ||
| description = "Built name of single User Assigned Identity" | ||
| value = try(azurerm_user_assigned_identity.this.name, null) | ||
| } | ||
|
|
||
| output "user_assigned_identity_principal_id" { | ||
| description = "Built principal id of single User Assigned Identity" | ||
| value = try(azurerm_user_assigned_identity.this.principal_id, null) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| variable "location" { | ||
| type = string | ||
| description = "Azure Region" | ||
| } | ||
|
|
||
| variable "resource_group" { | ||
| description = "The name of the resource group" | ||
| type = string | ||
| } | ||
|
|
||
| variable "ado_workload_identity_federation_enabled" { | ||
| description = "Workload Identity Federation enable" | ||
| default = true | ||
| } | ||
|
|
||
| variable "role_assignments_allowed" { | ||
| description = "This variable determines whether Service Principal used by Terraform can assign Roles to Azure resources" | ||
| default = true | ||
| } | ||
|
|
||
| variable "user_assigned_identity_name" { | ||
| type = string | ||
| description = "Specifies the name of the User Assigned Identity" | ||
| } | ||
|
|
||
| variable "custom_serviceendpoint_name" { | ||
| type = string | ||
| description = "Specifies the name of the ADO Service Connection" | ||
| default = "" | ||
| } | ||
|
|
||
| variable "custom_federated_identity_credential_name" { | ||
| type = string | ||
| description = "Specifies the name of the Federated Identity Credential" | ||
| default = "" | ||
| } | ||
|
|
||
| variable "ado_project_name" { | ||
| type = string | ||
| description = "ADO Project Name" | ||
| } | ||
|
|
||
| variable "role_assignment_scope" { | ||
| type = string | ||
| description = "ADO Service Connection target Subscription Id" | ||
| } | ||
|
|
||
| variable "subscription_id" { | ||
| type = string | ||
| description = "ADO Service Connection target Subscription Id" | ||
| } | ||
|
|
||
| variable "tenant_id" { | ||
| type = string | ||
| description = "ADO Service Connection target Tenant Id" | ||
| } | ||
|
|
||
| variable "key_vault_policy_config" { | ||
| description = "List of object with parameters to create Key Vault Access Policy" | ||
| type = list(object({ | ||
| key_vault_name = string | ||
| key_vault_id = string | ||
| tenant_id = string | ||
| key_permissions = optional(list(string), ["Get", "List", "Encrypt", "Decrypt"]) | ||
| secret_permissions = optional(list(string), ["Get", "List"]) | ||
| })) | ||
| default = [] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| terraform { | ||
| required_version = ">= 1.0.0" | ||
|
|
||
| required_providers { | ||
| azurerm = { | ||
| source = "hashicorp/azurerm" | ||
| version = ">= 3.40.0" | ||
| } | ||
| azuredevops = { | ||
| source = "microsoft/azuredevops" | ||
| version = "=0.11.0" | ||
| } | ||
| } | ||
| } |