-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add KeyVault Access to Sample Application (#39)
* Enabled capability for dev-sample to access keyvault secret values.
- Loading branch information
1 parent
9e8285b
commit 1d86e5f
Showing
17 changed files
with
286 additions
and
262 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| // param operatorIdentityName string | ||
| param identityprincipalId string | ||
|
|
||
| @description('The name of the Azure Key Vault') | ||
| param kvName string | ||
|
|
||
| // resource userIdentity 'Microsoft.Authorization/roleAssignments@2022-04-01' existing = { | ||
| // name: operatorIdentityName | ||
| // } | ||
|
|
||
| // var managedIdentityOperator = resourceId('Microsoft.Authorization/roleDefinitions', 'f1a07417-d97a-45cb-824c-7a7467783830') | ||
| // resource identityOperatorRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = { | ||
| // scope: userIdentity | ||
| // name: guid(userIdentity.id, identityprincipalId, managedIdentityOperator) | ||
| // properties: { | ||
| // roleDefinitionId: managedIdentityOperator | ||
| // principalType: 'ServicePrincipal' | ||
| // principalId: identityprincipalId | ||
| // } | ||
| // } | ||
|
|
||
| resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = { | ||
| name: kvName | ||
| } | ||
|
|
||
| var keyVaultSecretsUser = resourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6') | ||
| resource kvRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = { | ||
| scope: keyVault | ||
| name: guid(identityprincipalId, keyVault.id) | ||
| properties: { | ||
| roleDefinitionId: keyVaultSecretsUser | ||
| principalType: 'ServicePrincipal' | ||
| principalId: identityprincipalId | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| metadata name = 'User Assigned Identity Federated Identity Credential' | ||
| metadata description = 'This module deploys a User Assigned Identity Federated Identity Credential.' | ||
| metadata owner = 'Azure/module-maintainers' | ||
|
|
||
| @description('Conditional. The name of the parent user assigned identity. Required if the template is used in a standalone deployment.') | ||
| param userAssignedIdentityName string | ||
|
|
||
| @description('Required. The name of the secret.') | ||
| param name string | ||
|
|
||
| @description('Required. The list of audiences that can appear in the issued token. Should be set to api://AzureADTokenExchange for Azure AD. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Azure AD in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your IdP to serve as the audience of this token.') | ||
| param audiences array | ||
|
|
||
| @description('Required. The URL of the issuer to be trusted. Must match the issuer claim of the external token being exchanged.') | ||
| param issuer string | ||
|
|
||
| @description('Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format, as each IdP uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Azure AD.') | ||
| param subject string | ||
|
|
||
| resource userAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing = { | ||
| name: userAssignedIdentityName | ||
| } | ||
|
|
||
| resource federatedIdentityCredential 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials@2023-01-31' = { | ||
| name: name | ||
| parent: userAssignedIdentity | ||
| properties: { | ||
| audiences: audiences | ||
| issuer: issuer | ||
| subject: subject | ||
| } | ||
| } | ||
|
|
||
| @description('The name of the federated identity credential.') | ||
| output name string = federatedIdentityCredential.name | ||
|
|
||
| @description('The resource ID of the federated identity credential.') | ||
| output resourceId string = federatedIdentityCredential.id | ||
|
|
||
| @description('The name of the resource group the federated identity credential was created in.') | ||
| output resourceGroupName string = resourceGroup().name |
Oops, something went wrong.