Login with Github and Federated Identity Credential

[joufflu1]

Hello,
I have the project in mind to automatize AZQR excution into a github workflow.
Technical team now creates Service Principals and use Federated Identity Credentials, so the login to Azure is provided by Github and only the tenant ID and Subscription ID have to be provided to the Github action as variables.

Is AZQR compliant with that login process or May I use another way like Managed Identity ?

Thanks by advance for your answer !
David

[cmendible]

Hi!

If you are using any of the options outlined here: https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure-openid-connect#prerequisites

You should add the following environments variables before running azqr:

AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}

Sample action:

      # Run azqr scan
      - name: Run azqr scan
        env:
          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        run: |
          timestamp=$(date '+%Y%m%d%H%M%S')
          echo "DATETIME=$timestamp" >> $GITHUB_ENV
          azqr scan -o "${{ github.workspace }}/azqr_action_plan_$timestamp"