https://pulumi.com logo
Join Slack
Powered by
This message was deleted.
# azure
s
This message was deleted.
i
I use a combination of Pulumi access key and Azure AD Service Principal that I assign Azure RBAC roles to allow it to interact with the subscription. Can use 
az
CLI to create one:
Copy code
az ad sp create-for-rbac --name sp-REPLACE-WITH-NAME
you can create a provider resource that has all of those details once created as well:
Copy code
new Pulumi.AzureNative.Provider(pulumiName, new Pulumi.AzureNative.ProviderArgs()
            {
                SubscriptionId = subscriptionId,
                ClientId = servicePrincipalId,
                ClientSecret = servicePrincipalSecret,
                TenantId = tenantId
            });
store those values in your pulumi configuration files:
Copy code
pulumi config set azure-native:clientId $ARM_CLIENT_ID
pulumi config set azure-native:clientSecret $ARM_CLIENT_SECRET --secret
pulumi config set azure-native:tenantId $ARM_TENANT_ID
pulumi config set azure-native:subscriptionId $ARM_SUBSCRIPTION_ID
can reference them in your code using:
Copy code
private static Pulumi.Config config = new Pulumi.Config();
var subscriptionId = config.Get("subscriptionId");
i use GitHub Actions for my CD … and I store the object returned from the 
az
cli call in a GH Repo Secret and reference that in my step that logs in to azure
Copy code
# Log in to Azure
      - uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
m
In addition to Patrck's answer, pulumi now supports OIDC for Azure providers so you don't even need to use the service principal secret in your pipeline https://www.pulumi.com/blog/oidc-with-azure/ I think this would even be better in terms of security but what explained Patrick with a secret works as well.
a
Pretty cool. Thanks @icy-doctor-13719 and @millions-journalist-34868
🎉 1
5 Views
Open in Slack
PreviousNext
Powered by