Skip to content

Commit e59a5e3

Browse files
ahmadabdallaahmadabdalla
authored
[Modules] Updated Managed Identity API Version and Added Federated Identity Credential (#3941)
1 parent c7c0842 commit e59a5e3

9 files changed

Lines changed: 503 additions & 7 deletions

File tree

‎modules/managed-identity/user-assigned-identity/.test/common/main.test.bicep‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,16 @@ module testDeployment '../../main.bicep' = {
5050
enableDefaultTelemetry: enableDefaultTelemetry
5151
name: '${namePrefix}${serviceShort}001'
5252
lock: 'CanNotDelete'
53+
federatedIdentityCredentials: [
54+
{
55+
name: 'test-fed-cred-${serviceShort}-001'
56+
audiences: [
57+
'api://AzureADTokenExchange'
58+
]
59+
issuer: 'https://contoso.com/${subscription().tenantId}/${guid(deployment().name)}/'
60+
subject: 'system:serviceaccount:default:workload-identity-sa'
61+
}
62+
]
5363
roleAssignments: [
5464
{
5565
roleDefinitionIdOrName: 'Reader'

‎modules/managed-identity/user-assigned-identity/.test/min/main.test.bicep‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
targetScope = 'subscription'
2+
3+
// ========== //
4+
// Parameters //
5+
// ========== //
6+
7+
@description('Optional. The name of the resource group to deploy for testing purposes.')
8+
@maxLength(90)
9+
param resourceGroupName string = 'ms.managedidentity.userassignedidentities-${serviceShort}-rg'
10+
11+
@description('Optional. The location to deploy resources to.')
12+
param location string = deployment().location
13+
14+
@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
15+
param serviceShort string = 'miuaimin'
16+
17+
@description('Optional. Enable telemetry via a Globally Unique Identifier (GUID).')
18+
param enableDefaultTelemetry bool = true
19+
20+
// ============ //
21+
// Dependencies //
22+
// ============ //
23+
24+
// General resources
25+
// =================
26+
resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
27+
name: resourceGroupName
28+
location: location
29+
}
30+
31+
// ============== //
32+
// Test Execution //
33+
// ============== //
34+
35+
module testDeployment '../../main.bicep' = {
36+
scope: resourceGroup
37+
name: '${uniqueString(deployment().name, location)}-test-${serviceShort}'
38+
params: {
39+
enableDefaultTelemetry: enableDefaultTelemetry
40+
}
41+
}

‎modules/managed-identity/user-assigned-identity/README.md‎

Lines changed: 62 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,8 @@ This module deploys a User Assigned Identity.
1616
| :-- | :-- |
1717
| `Microsoft.Authorization/locks` | [2020-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-05-01/locks) |
1818
| `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
19-
| `Microsoft.ManagedIdentity/userAssignedIdentities` | [2018-11-30](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ManagedIdentity/2018-11-30/userAssignedIdentities) |
19+
| `Microsoft.ManagedIdentity/userAssignedIdentities` | [2023-01-31](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ManagedIdentity/2023-01-31/userAssignedIdentities) |
20+
| `Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials` | [2023-01-31](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ManagedIdentity/2023-01-31/userAssignedIdentities/federatedIdentityCredentials) |
2021

2122
## Parameters
2223

@@ -25,6 +26,7 @@ This module deploys a User Assigned Identity.
2526
| Parameter Name | Type | Default Value | Allowed Values | Description |
2627
| :-- | :-- | :-- | :-- | :-- |
2728
| `enableDefaultTelemetry` | bool | `True` | | Enable telemetry via a Globally Unique Identifier (GUID). |
29+
| `federatedIdentityCredentials` | array | `[]` | | The federated identity credentials list to indicate which token from the external IdP should be trusted by your application. Federated identity credentials are supported on applications only. A maximum of 20 federated identity credentials can be added per application object. |
2830
| `location` | string | `[resourceGroup().location]` | | Location for all resources. |
2931
| `lock` | string | `''` | `['', CanNotDelete, ReadOnly]` | Specify the type of lock. |
3032
| `name` | string | `[guid(resourceGroup().id)]` | | Name of the User Assigned Identity. |
@@ -165,6 +167,16 @@ module userAssignedIdentity './managed-identity/user-assigned-identity/main.bice
165167
name: '${uniqueString(deployment().name, location)}-test-miuaicom'
166168
params: {
167169
enableDefaultTelemetry: '<enableDefaultTelemetry>'
170+
federatedIdentityCredentials: [
171+
{
172+
audiences: [
173+
'api://AzureADTokenExchange'
174+
]
175+
issuer: '<issuer>'
176+
name: 'test-fed-cred-miuaicom-001'
177+
subject: 'system:serviceaccount:default:workload-identity-sa'
178+
}
179+
]
168180
lock: 'CanNotDelete'
169181
name: 'miuaicom001'
170182
roleAssignments: [
@@ -200,6 +212,18 @@ module userAssignedIdentity './managed-identity/user-assigned-identity/main.bice
200212
"enableDefaultTelemetry": {
201213
"value": "<enableDefaultTelemetry>"
202214
},
215+
"federatedIdentityCredentials": {
216+
"value": [
217+
{
218+
"audiences": [
219+
"api://AzureADTokenExchange"
220+
],
221+
"issuer": "<issuer>",
222+
"name": "test-fed-cred-miuaicom-001",
223+
"subject": "system:serviceaccount:default:workload-identity-sa"
224+
}
225+
]
226+
},
203227
"lock": {
204228
"value": "CanNotDelete"
205229
},
@@ -230,3 +254,40 @@ module userAssignedIdentity './managed-identity/user-assigned-identity/main.bice
230254

231255
</details>
232256
<p>
257+
258+
<h3>Example 2: Min</h3>
259+
260+
<details>
261+
262+
<summary>via Bicep module</summary>
263+
264+
```bicep
265+
module userAssignedIdentity './managed-identity/user-assigned-identity/main.bicep' = {
266+
name: '${uniqueString(deployment().name, location)}-test-miuaimin'
267+
params: {
268+
enableDefaultTelemetry: '<enableDefaultTelemetry>'
269+
}
270+
}
271+
```
272+
273+
</details>
274+
<p>
275+
276+
<details>
277+
278+
<summary>via JSON Parameter file</summary>
279+
280+
```json
281+
{
282+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
283+
"contentVersion": "1.0.0.0",
284+
"parameters": {
285+
"enableDefaultTelemetry": {
286+
"value": "<enableDefaultTelemetry>"
287+
}
288+
}
289+
}
290+
```
291+
292+
</details>
293+
<p>

‎modules/managed-identity/user-assigned-identity/federated-identity-credential/README.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# User Assigned Identity Federated Identity Credential `[Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials]`
2+
3+
This module deploys a User Assigned Identity Federated Identity Credential.
4+
5+
## Navigation
6+
7+
- [Resource Types](#Resource-Types)
8+
- [Parameters](#Parameters)
9+
- [Outputs](#Outputs)
10+
- [Cross-referenced modules](#Cross-referenced-modules)
11+
12+
## Resource Types
13+
14+
| Resource Type | API Version |
15+
| :-- | :-- |
16+
| `Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials` | [2023-01-31](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ManagedIdentity/2023-01-31/userAssignedIdentities/federatedIdentityCredentials) |
17+
18+
## Parameters
19+
20+
**Required parameters**
21+
22+
| Parameter Name | Type | Description |
23+
| :-- | :-- | :-- |
24+
| `audiences` | array | The list of audiences that can appear in the issued token. Should be set to api://AzureADTokenExchange for Azure AD. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Azure AD in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your IdP to serve as the audience of this token. |
25+
| `issuer` | string | The URL of the issuer to be trusted. Must match the issuer claim of the external token being exchanged. |
26+
| `name` | string | The name of the secret. |
27+
| `subject` | string | The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format, as each IdP uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Azure AD. |
28+
29+
**Conditional parameters**
30+
31+
| Parameter Name | Type | Description |
32+
| :-- | :-- | :-- |
33+
| `userAssignedIdentityName` | string | The name of the parent user assigned identity. Required if the template is used in a standalone deployment. |
34+
35+
**Optional parameters**
36+
37+
| Parameter Name | Type | Default Value | Description |
38+
| :-- | :-- | :-- | :-- |
39+
| `enableDefaultTelemetry` | bool | `True` | Enable telemetry via a Globally Unique Identifier (GUID). |
40+
41+
42+
## Outputs
43+
44+
| Output Name | Type | Description |
45+
| :-- | :-- | :-- |
46+
| `name` | string | The name of the federated identity credential. |
47+
| `resourceGroupName` | string | The name of the resource group the federated identity credential was created in. |
48+
| `resourceId` | string | The resource ID of the federated identity credential. |
49+
50+
## Cross-referenced modules
51+
52+
_None_

‎modules/managed-identity/user-assigned-identity/federated-identity-credential/main.bicep‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
metadata name = 'User Assigned Identity Federated Identity Credential'
2+
metadata description = 'This module deploys a User Assigned Identity Federated Identity Credential.'
3+
metadata owner = 'Azure/module-maintainers'
4+
5+
@description('Conditional. The name of the parent user assigned identity. Required if the template is used in a standalone deployment.')
6+
param userAssignedIdentityName string
7+
8+
@description('Required. The name of the secret.')
9+
param name string
10+
11+
@description('Required. The list of audiences that can appear in the issued token. Should be set to api://AzureADTokenExchange for Azure AD. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Azure AD in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your IdP to serve as the audience of this token.')
12+
param audiences array
13+
14+
@description('Required. The URL of the issuer to be trusted. Must match the issuer claim of the external token being exchanged.')
15+
param issuer string
16+
17+
@description('Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format, as each IdP uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Azure AD.')
18+
param subject string
19+
20+
@description('Optional. Enable telemetry via a Globally Unique Identifier (GUID).')
21+
param enableDefaultTelemetry bool = true
22+
23+
resource defaultTelemetry 'Microsoft.Resources/deployments@2021-04-01' = if (enableDefaultTelemetry) {
24+
name: 'pid-47ed15a6-730a-4827-bcb4-0fd963ffbd82-${uniqueString(deployment().name)}'
25+
properties: {
26+
mode: 'Incremental'
27+
template: {
28+
'$schema': 'https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#'
29+
contentVersion: '1.0.0.0'
30+
resources: []
31+
}
32+
}
33+
}
34+
35+
resource userAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing = {
36+
name: userAssignedIdentityName
37+
}
38+
39+
resource federatedIdentityCredential 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials@2023-01-31' = {
40+
name: name
41+
parent: userAssignedIdentity
42+
properties: {
43+
audiences: audiences
44+
issuer: issuer
45+
subject: subject
46+
}
47+
}
48+
49+
@description('The name of the federated identity credential.')
50+
output name string = federatedIdentityCredential.name
51+
52+
@description('The resource ID of the federated identity credential.')
53+
output resourceId string = federatedIdentityCredential.id
54+
55+
@description('The name of the resource group the federated identity credential was created in.')
56+
output resourceGroupName string = resourceGroup().name

‎modules/managed-identity/user-assigned-identity/federated-identity-credential/main.json‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"metadata": {
5+
"_generator": {
6+
"name": "bicep",
7+
"version": "0.20.4.51522",
8+
"templateHash": "13014227007294077055"
9+
},
10+
"name": "User Assigned Identity Federated Identity Credential",
11+
"description": "This module deploys a User Assigned Identity Federated Identity Credential.",
12+
"owner": "Azure/module-maintainers"
13+
},
14+
"parameters": {
15+
"userAssignedIdentityName": {
16+
"type": "string",
17+
"metadata": {
18+
"description": "Conditional. The name of the parent user assigned identity. Required if the template is used in a standalone deployment."
19+
}
20+
},
21+
"name": {
22+
"type": "string",
23+
"metadata": {
24+
"description": "Required. The name of the secret."
25+
}
26+
},
27+
"audiences": {
28+
"type": "array",
29+
"metadata": {
30+
"description": "Required. The list of audiences that can appear in the issued token. Should be set to api://AzureADTokenExchange for Azure AD. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Azure AD in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your IdP to serve as the audience of this token."
31+
}
32+
},
33+
"issuer": {
34+
"type": "string",
35+
"metadata": {
36+
"description": "Required. The URL of the issuer to be trusted. Must match the issuer claim of the external token being exchanged."
37+
}
38+
},
39+
"subject": {
40+
"type": "string",
41+
"metadata": {
42+
"description": "Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format, as each IdP uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Azure AD."
43+
}
44+
},
45+
"enableDefaultTelemetry": {
46+
"type": "bool",
47+
"defaultValue": true,
48+
"metadata": {
49+
"description": "Optional. Enable telemetry via a Globally Unique Identifier (GUID)."
50+
}
51+
}
52+
},
53+
"resources": [
54+
{
55+
"condition": "[parameters('enableDefaultTelemetry')]",
56+
"type": "Microsoft.Resources/deployments",
57+
"apiVersion": "2021-04-01",
58+
"name": "[format('pid-47ed15a6-730a-4827-bcb4-0fd963ffbd82-{0}', uniqueString(deployment().name))]",
59+
"properties": {
60+
"mode": "Incremental",
61+
"template": {
62+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
63+
"contentVersion": "1.0.0.0",
64+
"resources": []
65+
}
66+
}
67+
},
68+
{
69+
"type": "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials",
70+
"apiVersion": "2023-01-31",
71+
"name": "[format('{0}/{1}', parameters('userAssignedIdentityName'), parameters('name'))]",
72+
"properties": {
73+
"audiences": "[parameters('audiences')]",
74+
"issuer": "[parameters('issuer')]",
75+
"subject": "[parameters('subject')]"
76+
}
77+
}
78+
],
79+
"outputs": {
80+
"name": {
81+
"type": "string",
82+
"metadata": {
83+
"description": "The name of the federated identity credential."
84+
},
85+
"value": "[parameters('name')]"
86+
},
87+
"resourceId": {
88+
"type": "string",
89+
"metadata": {
90+
"description": "The resource ID of the federated identity credential."
91+
},
92+
"value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials', parameters('userAssignedIdentityName'), parameters('name'))]"
93+
},
94+
"resourceGroupName": {
95+
"type": "string",
96+
"metadata": {
97+
"description": "The name of the resource group the federated identity credential was created in."
98+
},
99+
"value": "[resourceGroup().name]"
100+
}
101+
}
102+
}

‎modules/managed-identity/user-assigned-identity/federated-identity-credential/version.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
3+
"version": "0.4",
4+
"pathFilters": [
5+
"./main.json"
6+
]
7+
}

0 commit comments

Comments
 (0)