You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Update quickstart examples and docs to include fic and v1 resources (#88)
* Update quickstart examples and docs to include fic and v1 resources
* Fix type and update v1.0 powershell script
* Update example and doc based on review
* Address comments
* Address comments
* Use a single string parameter for fic subject
* Update based on feedback
* minor update
Copy file name to clipboardExpand all lines: DEVELOPMENT.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -47,6 +47,6 @@ This document describes the steps to setup development tools and run Bicep types
47
47
```
48
48
49
49
## Adding New Types
50
-
1. Update the definitions and paths forthe new typeinthe swagger file [microsoftgraph-beta.json](swagger\specification\microsoftgraph\resource-manager\microsoftgraph\preview\2023-09-15-preview\microsoftgraph-beta.json). Currently only `beta` version resources are supported.
50
+
1. Update the entities and properties in[config-beta.yml](src\swagger-generation\config-beta.yml) and [config-v1.0.yml](src\swagger-generation\config-beta.yml)
51
51
52
-
1. Re-run generation using the commandin [Running](#running), and new types will be available in [/generated](./generated)
52
+
1. Follow steps in [Running Generation Locally](#running-generation-locally), and new types will be available in [/generated](./generated)
@@ -50,9 +51,10 @@ Make sure that you've updated Azure CLI and/or Azure PS to use the latest Bicep
50
51
We've created some quick-start templates to get you started.
51
52
52
53
1.[Create an applications and service principals for a client and resource application](../quickstart-templates/application-serviceprincipal-create-client-resource/)
53
-
2.[Create an application and service principal for a client app using a key vault certificate](../quickstart-templates/create-client-app-sp-with-kv-cert/)
54
-
3.[Grant a client application access (via an app role) to a resource application](../quickstart-templates/resource-application-access-grant-to-client-application/)
55
-
4.[Create a security group with owners and members](../quickstart-templates/security-group-create-with-owners-and-members/)
56
-
5.[Assign an Azure role to a security group](../quickstart-templates/security-group-assign-azure-role/)
54
+
1.[Create an application and service principal for a client app using a key vault certificate](../quickstart-templates/create-client-app-sp-with-kv-cert/)
55
+
1.[Configure federated identity credential for GitHub Actions](../quickstart-templates/create-fic-for-github-actions/)
56
+
1.[Grant a client application access (via an app role) to a resource application](../quickstart-templates/resource-application-access-grant-to-client-application/)
57
+
1.[Create a security group with owners and members](../quickstart-templates/security-group-create-with-owners-and-members/)
58
+
1.[Assign an Azure role to a security group](../quickstart-templates/security-group-assign-azure-role/)
57
59
58
60
Feel free to contribute and share your own samples too, by creating some PRs for template examples!
# Configure federated identity credential for GitHub Actions
2
+
3
+
> **Note**: This template sample **only** configures the Microsoft Entra ID portion (to enable workload identity federation). Additional configuration steps are also required on the GitHub side, to ensure that the federation works end-to-end. See [Use GitHub Actions to connect to Azure](https://learn.microsoft.com/azure/developer/github/connect-from-azure?tabs=azure-cli%2Cwindows#use-the-azure-login-action-with-openid-connect), but skip the sections on "Create a Microsoft Entra application and service principal" and "Add federated credentials", as the following Bicep template replaces those sections.
4
+
5
+
This template enables a GitHub Actions workflow to exchange a GitHub access token for a Microsoft Entra ID access token, so that the GitHub Actions workflow can access Azure resources. To enable this, the template creates an application (to represent the GitHub Action) and configures it with a federated identity credential. When the GitHub Actions workflow requests to exchange a GitHub access token for an access token, from the Microsoft identity platform, the values in the federated identity credential are checked against the provided GitHub token's `issuer` and `subject` claim values.
6
+
7
+
*`subject` identifies the GitHub organization, repo, branch, and environment for your GitHub Actions workflow. Refer to [example subject claims](https://docs.github.com/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#example-subject-claims) which describes the `subject` value options for different scenarios.
8
+
9
+
For limitations on federated identity credentials, please refer to [Federated identity credentials considerations and limitations](https://learn.microsoft.com/entra/workload-id/workload-identity-federation-considerations).
10
+
11
+
You can deploy the template with the following Azure CLI command (replace `<resource-group>` with name of your resource group, and `<github-actions-fic-subject>` with the `subject` based on your scenario.):
12
+
13
+
```sh
14
+
az deployment group create --resource-group <resource-group> --template-file main.bicep --parameter githubActionsFicSubject='<github-actions-fic-subject>'
15
+
```
16
+
17
+
To deploy the same template using Az Powershell, use:
@description('Subject of the GitHub Actions workflow\'s federated identity credentials (FIC) that is checked before issuing an Entra ID access token to access Azure resources. GitHub Actions subject examples can be found in https://docs.github.com/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#example-subject-claims')
0 commit comments