github action az login setup for managed identity via oidc

You can setup OIDC login using managed identity in your github action. 

First you need to create your managed identity and then federate it. 

1. So go and create your managed identity and ensure you have added it to your subscriptions.

2. Federate your managed identity by setting up federated credential. In this example, we using main branch. This step is a MUST and won't work without it.

3. Create your actions workflow. It is important to provide permission as shown below:

name: 'Build .Net app'

on: [push, workflow_dispatch]

permissions:

  id-token: write

  contents: read

 

jobs:

  build-and-deploy:

    runs-on: ubuntu-latest

    steps:

      - name: Azure login

        uses: azure/login@v2

        with:

          client-id: ${{ secrets.AZURE_CLIENT_ID }}

          tenant-id: ${{ secrets.AZURE_TENANT_ID }}

          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Azure CLI script

        uses: azure/cli@v2

        with:

          azcliversion: latest

          inlineScript: |

            az account show

4. Setup your secrets in your repository.

5. Trigger the pipeline and see how it goes.

Common errors

Github action azlogin No subscriptions found for managed identity.

Please ensure you have place the managed identity in your subscriptions and assign a RBAC. 

Sample code 

https://github.com/mitzenjeremywoo/azure-login-managed-identity/blob/main/.github/workflows/blank.yml