Replaced DefaultAzureCredential with AzureCliCredential in Scripts

Author: Vamshi-Microsoft

infra/scripts/index_scripts/01_create_search_index.py

@@ -1,4 +1,4 @@
-from azure.identity import DefaultAzureCredential
+from azure.identity import AzureCliCredential
 from azure.keyvault.secrets import SecretClient
 from azure.search.documents.indexes import SearchIndexClient
 from azure.search.documents.indexes.models import (
@@ -27,12 +27,11 @@ def get_secrets_from_kv(secret_name: str) -> str:
     Retrieves a secret value from Azure Key Vault.
     Args:
         secret_name (str): Name of the secret.
-        credential (DefaultAzureCredential): Credential with access to Key Vault.
+        credential (AzureCliCredential): Credential with access to Key Vault.
     Returns:
         str: The secret value.
     """
-    kv_credential = DefaultAzureCredential(managed_identity_client_id=managed_identity_client_id)
-    # CodeQL [SM05139] Okay use of DefaultAzureCredential as it is only used in local environment.
+    kv_credential = AzureCliCredential()
     secret_client = SecretClient(
         vault_url=f"https://{key_vault_name}.vault.azure.net/",
         credential=kv_credential
@@ -44,8 +43,7 @@ def create_search_index():
     """Create an Azure Search index."""
 
     # Shared credential
-    credential = DefaultAzureCredential(managed_identity_client_id=managed_identity_client_id)
-    # CodeQL [SM05139] Okay use of DefaultAzureCredential as it is only used in local environment.
+    credential = AzureCliCredential()
 
     # Retrieve secrets from Key Vault
     search_endpoint = get_secrets_from_kv("AZURE-SEARCH-ENDPOINT")

infra/scripts/index_scripts/02_process_data.py

@@ -7,7 +7,7 @@
 from azure.search.documents import SearchClient
 from azure.storage.filedatalake import DataLakeServiceClient
 from azure.search.documents.indexes import SearchIndexClient
-from azure.identity import (DefaultAzureCredential, get_bearer_token_provider)
+from azure.identity import (AzureCliCredential, get_bearer_token_provider)
 
 
 key_vault_name = 'kv_to-be-replaced'
@@ -22,12 +22,11 @@ def get_secrets_from_kv(secret_name: str) -> str:
     Retrieves a secret value from Azure Key Vault.
     Args:
         secret_name (str): Name of the secret.
-        credential (DefaultAzureCredential): Credential with access to Key Vault.
+        credential (AzureCliCredential): Credential with access to Key Vault.
     Returns:
         str: The secret value.
     """
-    kv_credential = DefaultAzureCredential(managed_identity_client_id=managed_identity_client_id)
-    # CodeQL [SM05139] Okay use of DefaultAzureCredential as it is only used in local environment.
+    kv_credential = AzureCliCredential()
     secret_client = SecretClient(
         vault_url=f"https://{key_vault_name}.vault.azure.net/",
         credential=kv_credential
@@ -45,8 +44,7 @@ def get_secrets_from_kv(secret_name: str) -> str:
 
 # Azure Data Lake settings
 account_url = f"https://{account_name}.dfs.core.windows.net"
-credential = DefaultAzureCredential(managed_identity_client_id=managed_identity_client_id)
-# CodeQL [SM05139] Okay use of DefaultAzureCredential as it is only used in local environment.
+credential = AzureCliCredential()
 service_client = DataLakeServiceClient(account_url, credential=credential, api_version='2023-01-03')
 file_system_client = service_client.get_file_system_client(file_system_client_name)
 directory_name = directory

scripts/chunk_documents.py

@@ -5,7 +5,7 @@
 
 from azure.ai.formrecognizer import DocumentAnalysisClient
 from azure.core.credentials import AzureKeyCredential
-from azure.identity import DefaultAzureCredential
+from azure.identity import AzureCliCredential
 from azure.keyvault.secrets import SecretClient
 from data_utils import chunk_directory
 
@@ -57,8 +57,7 @@ def get_document_intelligence_client(config, secret_client):
     with open(args.config_file) as f:
         config = json.load(f)
 
-    credential = DefaultAzureCredential()  # CodeQL [SM05139] Okay use of DefaultAzureCredential as it is only used in local environment.
-
+    credential = AzureCliCredential()
     if type(config) is not list:
         config = [config]
 

scripts/embed_documents.py

@@ -2,7 +2,7 @@
 import json
 from asyncio import sleep
 
-from azure.identity import DefaultAzureCredential
+from azure.identity import AzureCliCredential
 from azure.keyvault.secrets import SecretClient
 from data_utils import get_embedding
 
@@ -19,8 +19,7 @@
     with open(args.config_file) as f:
         config = json.load(f)
 
-    credential = DefaultAzureCredential()  # CodeQL [SM05139] Okay use of DefaultAzureCredential as it is only used in local environment.
-
+    credential = AzureCliCredential()
     if type(config) is not list:
         config = [config]