feat: Replace DefaultAzureCredential with ManagedIdentityCredential in Acc…

infra/scripts/aihub_scripts/create_ai_hub.py

@@ -10,14 +10,15 @@
     AzureOpenAIConnection,
 )
 from azure.keyvault.secrets import SecretClient
-from azure.identity import DefaultAzureCredential
+
+from infra.scripts.azure_credential_utils import get_azure_credential
 
 def get_secrets_from_kv(kv_name, secret_name):
     # Set the name of the Azure Key Vault
     key_vault_name = kv_name
 
     # Create a credential object using the default Azure credentials
-    credential = DefaultAzureCredential()
+    credential = get_azure_credential()
 
     # Create a secret client object using the credential and Key Vault name
     secret_client = SecretClient(
@@ -60,7 +61,7 @@ def get_secrets_from_kv(kv_name, secret_name):
 ai_search_key = get_secrets_from_kv(key_vault_name, "AZURE-SEARCH-KEY")
 
 # Credentials
-credential = DefaultAzureCredential()
+credential = get_azure_credential()
 
 # Create an ML client
 ml_client = MLClient(

infra/scripts/azure_credential_utils.py

@@ -0,0 +1,22 @@
+from azure.identity import ManagedIdentityCredential, DefaultAzureCredential
+
+APP_ENV = 'prod'  # Change to 'dev' for local development
+
+def get_azure_credential(client_id=None):
+    """
+    Retrieves the appropriate Azure credential based on the application environment.
+
+    If the application is running locally, it uses Azure CLI credentials.
+    Otherwise, it uses a managed identity credential.
+
+    Args:
+        client_id (str, optional): The client ID for the managed identity. Defaults to None.
+
+    Returns:
+        azure.identity.DefaultAzureCredential or azure.identity.ManagedIdentityCredential: 
+        The Azure credential object.
+    """
+    if APP_ENV == 'dev':
+        return DefaultAzureCredential() # CodeQL [SM05139] Okay use of DefaultAzureCredential as it is only used in development
+    else:
+        return ManagedIdentityCredential(client_id=client_id)

infra/scripts/fabric_scripts/create_fabric_items.py

@@ -4,11 +4,12 @@
 import requests
 import pandas as pd
 
-# credential = DefaultAzureCredential()
 
-from azure.identity import AzureCliCredential
 
-credential = AzureCliCredential()
+# credential = DefaultAzureCredential()
+
+from infra.scripts.azure_credential_utils import get_azure_credential
+credential = get_azure_credential()
 
 cred = credential.get_token('https://api.fabric.microsoft.com/.default')
 token = cred.token

infra/scripts/index_scripts/create_articles_index.py

@@ -15,15 +15,16 @@
 num_pages = 10
 
 from azure.keyvault.secrets import SecretClient  
-from azure.identity import DefaultAzureCredential  
+
+from infra.scripts.azure_credential_utils import get_azure_credential
 
 def get_secrets_from_kv(kv_name, secret_name):
 
   # Set the name of the Azure Key Vault  
   key_vault_name = kv_name 
 
   # Create a credential object using the default Azure credentials  
-  credential = DefaultAzureCredential()
+  credential = get_azure_credential()
 
     # Create a secret client object using the credential and Key Vault name  
   secret_client = SecretClient(vault_url=f"https://{key_vault_name}.vault.azure.net/", credential=credential)  
@@ -351,7 +352,7 @@ def chunk_data(text):
 
 
 account_name = get_secrets_from_kv(key_vault_name, "ADLS-ACCOUNT-NAME")
-credential = DefaultAzureCredential()
+credential = get_azure_credential()
 
 account_url = f"https://{account_name}.dfs.core.windows.net"
 

infra/scripts/index_scripts/create_drafts_index.py

@@ -12,15 +12,16 @@
 num_pages = 10
 
 from azure.keyvault.secrets import SecretClient  
-from azure.identity import DefaultAzureCredential  
+
+from infra.scripts.azure_credential_utils import get_azure_credential
 
 def get_secrets_from_kv(kv_name, secret_name):
 
   # Set the name of the Azure Key Vault  
   key_vault_name = kv_name 
 
   # Create a credential object using the default Azure credentials  
-  credential = DefaultAzureCredential()
+  credential = get_azure_credential()
 
   # Create a secret client object using the credential and Key Vault name  
   secret_client = SecretClient(vault_url=f"https://{key_vault_name}.vault.azure.net/", credential=credential)  
@@ -342,7 +343,7 @@ def chunk_data(text):
 
 
 account_name = get_secrets_from_kv(key_vault_name, "ADLS-ACCOUNT-NAME")
-credential = DefaultAzureCredential()
+credential = get_azure_credential()
 
 account_url = f"https://{account_name}.dfs.core.windows.net"
 

infra/scripts/index_scripts/create_grants_index.py

@@ -11,15 +11,16 @@
 num_pages = 10
 
 from azure.keyvault.secrets import SecretClient  
-from azure.identity import DefaultAzureCredential  
+
+from infra.scripts.azure_credential_utils import get_azure_credential 
 
 def get_secrets_from_kv(kv_name, secret_name):
 
   # Set the name of the Azure Key Vault  
   key_vault_name = kv_name 
 
   # Create a credential object using the default Azure credentials  
-  credential = DefaultAzureCredential()
+  credential = get_azure_credential()
 
   # Create a secret client object using the credential and Key Vault name  
   secret_client = SecretClient(vault_url=f"https://{key_vault_name}.vault.azure.net/", credential=credential)  
@@ -340,7 +341,7 @@ def chunk_data(text):
 
 
 account_name = get_secrets_from_kv(key_vault_name, "ADLS-ACCOUNT-NAME")
-credential = DefaultAzureCredential()
+credential = get_azure_credential()
 
 account_url = f"https://{account_name}.dfs.core.windows.net"
 

infra/scripts/run_create_aihub_scripts.sh

@@ -21,6 +21,7 @@ echo "Download Started"
 
 # Download the create_index python files
 curl --output "create_ai_hub.py" ${baseUrl}"infra/scripts/aihub_scripts/create_ai_hub.py"
+curl --output "azure_credential_utils.py" "${baseUrl}infra/scripts/azure_credential_utils.py"
 
 # Download the requirement file
 curl --output "$requirementFile" "$requirementFileUrl"

infra/scripts/run_create_index_scripts.sh

@@ -13,6 +13,7 @@ echo "Download Started"
 curl --output "create_articles_index.py" ${baseUrl}"infra/scripts/index_scripts/create_articles_index.py"
 curl --output "create_grants_index.py" ${baseUrl}"infra/scripts/index_scripts/create_grants_index.py"
 curl --output "create_drafts_index.py" ${baseUrl}"infra/scripts/index_scripts/create_drafts_index.py"
+curl --output "azure_credential_utils.py" "${baseUrl}infra/scripts/azure_credential_utils.py"
 
 # Download the requirement file
 curl --output "$requirementFile" "$requirementFileUrl"

infra/scripts/run_fabric_items_scripts.sh

@@ -16,6 +16,7 @@ curl --output "create_fabric_items.py" ${baseUrl}"infra/scripts/fabric_scripts/c
 curl --output "create_articles_index.ipynb" ${baseUrl}"infra/scripts/fabric_scripts/create_articles_index.ipynb"
 curl --output "create_grants_index.ipynb" ${baseUrl}"infra/scripts/fabric_scripts/create_grants_index.ipynb"
 curl --output "create_drafts_index.ipynb" ${baseUrl}"infra/scripts/fabric_scripts/create_drafts_index.ipynb"
+curl --output "azure_credential_utils.py" "${baseUrl}infra/scripts/azure_credential_utils.py"
 
 # Download the requirement file
 curl --output "$requirementFile" "$requirementFileUrl"