amplihack/.env.example at main · rysweet/amplihack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
# ============================================================================
# Azure Service Principal Credentials
# ============================================================================
# Required for remote execution on Azure VMs

# Azure AD Tenant ID (Directory ID)
AZURE_TENANT_ID=your-tenant-id-here

# Service Principal Application (Client) ID
AZURE_CLIENT_ID=your-client-id-here

# Service Principal Client Secret Value
AZURE_CLIENT_SECRET=your-client-secret-here

# Azure Subscription ID
AZURE_SUBSCRIPTION_ID=your-subscription-id-here

# Optional: Default Resource Group
# AZURE_RESOURCE_GROUP=your-resource-group-name

# ----------------------------------------------------------------------------
# HOW TO GET THESE VALUES:
# ----------------------------------------------------------------------------
#
# 1. Create Service Principal:
#    az ad sp create-for-rbac --name "amplihack-remote-exec" \
#      --role Contributor \
#      --scopes /subscriptions/YOUR_SUBSCRIPTION_ID
#
# 2. The command outputs:
#    {
#      "appId": "<your-client-id>",          # Use for AZURE_CLIENT_ID
#      "displayName": "amplihack-remote-exec",
#      "password": "<your-client-secret>",   # Use for AZURE_CLIENT_SECRET
#      "tenant": "<your-tenant-id>"          # Use for AZURE_TENANT_ID
#    }
#
# 3. Get Subscription ID:
#    az account show --query id -o tsv
#
# ----------------------------------------------------------------------------
# SECURITY NOTES:
# ----------------------------------------------------------------------------
#
# - NEVER commit .env files to git (already in .gitignore)
# - Rotate secrets regularly (90 days recommended)
# - Use minimum required permissions (Contributor on specific resource group)
# - Store backups encrypted
# - Revoke unused Service Principals