bartvdbraak/keyweave
1
0
Fork 0
mirror of https://github.com/bartvdbraak/keyweave.git synced 2025-04-28 15:21:21 +00:00
Code Issues Projects Releases Packages Wiki Activity

feat: add federated logins

Browse source
This commit is contained in:
Bart van der Braak 2023-11-21 18:51:26 +01:00
parent 3fd2ad2f7c
commit bfb45cefa0
3 changed files with 33 additions and 38 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
bicep/main.bicep
View file

@ -80,7 +80,6 @@ module KeyVault 'modules/kv.bicep' = {
location: location location: location
tags: tags tags: tags
getPrincipalIds: ManagedIdentities.outputs.getPrincipalIds identities: ManagedIdentities.outputs.identities
listPrincipalIds: ManagedIdentities.outputs.listPrincipalIds
} }
} }

59
bicep/modules/id.bicep
View file

@ -2,35 +2,32 @@ param nameFormat string
param location string param location string
param tags object param tags object
resource managedIdentityNone 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = { param identityEnvironments array = [
name: format(nameFormat, 'ID', 1) 'none'
location: location 'get'
tags: tags 'list'
} 'getlist'
resource managedIdentityGet 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
name: format(nameFormat, 'ID', 2)
location: location
tags: tags
}
resource managedIdentityList 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
name: format(nameFormat, 'ID', 3)
location: location
tags: tags
}
resource managedIdentityGetList 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
name: format(nameFormat, 'ID', 4)
location: location
tags: tags
}
output getPrincipalIds array = [
managedIdentityGet.properties.principalId
managedIdentityGetList.properties.principalId
]
output listPrincipalIds array = [
managedIdentityList.properties.principalId
managedIdentityGetList.properties.principalId
] ]
resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = [for (environment, index) in identityEnvironments: {
name: format(nameFormat, 'ID', index+1)
location: location
tags: tags
}]
resource federatedCredential 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials@2023-01-31' = [for (environment, index) in identityEnvironments: {
name: environment
parent: managedIdentity[index+1]
properties: {
issuer: 'https://token.actions.githubusercontent.com'
subject: 'repo:bartvdbraak/keyweave:environment:${environment}'
audiences: [
'api://AzureADTokenExchange'
]
}
}]
output identities array = [for (environment, index) in identityEnvironments: {
name: environment
id: managedIdentity[index+1].properties.principalId
}]

9
bicep/modules/kv.bicep
View file

@ -2,14 +2,13 @@ param nameFormat string
param location string param location string
param tags object param tags object
param getPrincipalIds array param identities array
param listPrincipalIds array
var accessPolicies = [for id in union(getPrincipalIds, listPrincipalIds): { var accessPolicies = [for identity in identities: {
tenantId: tenant().tenantId tenantId: tenant().tenantId
objectId: id objectId: identity.id
permissions: { permissions: {
secrets: contains(getPrincipalIds, id) && contains(listPrincipalIds, id) ? ['Get', 'List'] : contains(listPrincipalIds, id) ? ['List'] : ['Get'] secrets: contains(identity.name, 'get') && contains(identity.name, 'list') ? ['Get', 'List'] : contains(identity.name, 'get') ? ['Get'] : ['List']
} }
}] }]