github actions setup and authenticating terraform provider using managed identity

You can use the following yaml to setup terraform azurerm which authenticate using managed identity. 

All you need is the following information 

-  AZURE_CLIENT_ID - this would be your managed identity client id

- AZURE_SUBSCRIPTION_ID 

- AZURE_TENANT_ID 

The permission is important and you need this to work.

name: 'Build .Net app'

on: [push, workflow_dispatch]

permissions:

  id-token: write

  contents: read

 

jobs:

  build-and-deploy:

    runs-on: ubuntu-latest

    steps:

      - name: Azure login

        uses: azure/login@v2

        with:

          client-id: ${{ secrets.AZURE_CLIENT_ID }}

          tenant-id: ${{ secrets.AZURE_TENANT_ID }}

          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Azure CLI script

        uses: azure/cli@v2

        with:

          azcliversion: latest

          inlineScript: |

            az account show

 

Common error: 

When you didn't setup federated credentials for your client id. you will get this error message "AADSTS700213: No matching federated identity record found for presented assertion subject

It is important to ensure that the "subject identifier" is correct. If not, please update accordingly The github actions would complaint and shows you what this value would look like. 

Do you need this managed identity to be a contributor of a subscriptions? 

No you don't