ned1313 / terraform-azuread-github_oidc Goto Github PK

Motivation:

Suppose the SP created here is running Terraform to create a static web app (SWA). Further suppose that SWA requires custom authentication to be configured as described here. The TL;DR of how this is done is:

1. Creating a new App Registration
2. Save the Application (client) ID for the Microsoft Entra app registration.
3. Save the client secret for the Microsoft Entra app registration.
4. Configure two parameters in SWA's Application Settings AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
5. Reference these settings in staticwebapp.config.json of the SWA
6. Enjoy authentication via AD for users of the SWA

A sample terraform script to accomplish 1-4 above is as follows:

# Create SP 
resource "azuread_application_registration" "my_static_frontend" {
  display_name = "My Static Frontend"
  description  = "My cool application"
}

# Create password
resource "azuread_application_password" "my_static_frontend" {
  application_id = azuread_application_registration.my_static_frontend.id
}

# create the SWA
resource "azurerm_static_site" "my_static_frontend" {
  name                = "stapp-my-frontend-${local.name_suffix}"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location

  app_settings = {
    "AZURE_CLIENT_ID"           = azuread_application_registration.my_static_frontend.client_id
    "AZURE_CLIENT_SECRET"       = azuread_application_password.my_static_frontend.value
  }
  tags = local.common_tags
}

This script fails because the OIDC SP has insufficient permissions to create the application. It needs Microsoft Graph's Application.ReadWrite.OwnedBy. Note that Application.ReadWrite.All would do but we prefer this in keeping with the principle of using the least required privilege.

Update the following variable names and types to list(string):

• environment_name -> environment_names
• ref_branch -> ref_branches
• ref_tag -> ref_tags

This is to support using the same service principal for multiple branches, environments, or tags.

Output Without Description, Severity: INFO, Results: 4
Description: All outputs should contain a valid description.
Platform: Terraform
Learn more about this vulnerability: https://docs.kics.io/latest/queries/terraform-queries/common/59312e8a-a64e-41e7-a252-618533dd1ea8

Hi, I tried setting entity_type to "pull-request" but I encountered an error:

Error: : AADSTS70021: No matching federated identity record found for presented assertion. Assertion Issuer: 'https://token.actions.githubusercontent.com/'. Assertion Subject: 'repo:algodx-ab/infrastructure:pull_request'. Assertion Audience: 'api://AzureADTokenExchange'. https://docs.microsoft.com/en-us/azure/active-directory/develop/workload-identity-federation

However, setting the entity_type to "pull_request" fixed the problem to me. It appears that Azure AD expects the string to be snake cased, as shown at 11:30 in your tutorial: https://youtu.be/10ljwwJ3V30?t=690

To support multiple federated identity credentials, the name and description needs to be updated. It should also be a little shorter and more accurate.

Seeing this issue

Warning: Argument is deprecated
│ 
│   with module.oidc_sp["nonprd"].azuread_application_federated_identity_credential.oidc,
│   on .terraform/modules/oidc_sp/main.tf line 13, in resource "azuread_application_federated_identity_credential" "oidc":
│   13:   application_object_id = azuread_application.oidc.object_id
│ 
│ The `application_object_id` property has been replaced with the `application_id` property and will be removed in version 3.0 of the AzureAD
│ provider
│ 
│ (and 3 more similar warnings elsewhere)

Add an optional argument to create a PR federated identity credential along with the branch, tag, or environment based-credential. If the credential type is PR, then ignore the create_pr_identity field.

Use the new testing framework in Terraform 1.6 to test the following options:

• PR only
• Single branch
• Multiple branch
• Multiple branch and PR
• Single env
• Multiple env
• Multiple env and PR
• Single tag
• Multiple tags
• Multiple tags and PR