https://pulumi.com
Join Slack
This message was deleted.
# azure
s
This message was deleted.
i
I use a combination of Pulumi access key and Azure AD Service Principal that I assign Azure RBAC roles to allow it to interact with the subscription. Can use 
az
CLI to create one:
Copy code
az ad sp create-for-rbac --name sp-REPLACE-WITH-NAME
you can create a provider resource that has all of those details once created as well:
Copy code
new Pulumi.AzureNative.Provider(pulumiName, new Pulumi.AzureNative.ProviderArgs()
            {
                SubscriptionId = subscriptionId,
                ClientId = servicePrincipalId,
                ClientSecret = servicePrincipalSecret,
                TenantId = tenantId
            });
store those values in your pulumi configuration files:
Copy code
pulumi config set azure-native:clientId $ARM_CLIENT_ID
pulumi config set azure-native:clientSecret $ARM_CLIENT_SECRET --secret
pulumi config set azure-native:tenantId $ARM_TENANT_ID
pulumi config set azure-native:subscriptionId $ARM_SUBSCRIPTION_ID
can reference them in your code using:
Copy code
private static Pulumi.Config config = new Pulumi.Config();
var subscriptionId = config.Get("subscriptionId");
i use GitHub Actions for my CD … and I store the object returned from the 
az
cli call in a GH Repo Secret and reference that in my step that logs in to azure
Copy code
# Log in to Azure
      - uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
m
In addition to Patrck's answer, pulumi now supports OIDC for Azure providers so you don't even need to use the service principal secret in your pipeline https://www.pulumi.com/blog/oidc-with-azure/ I think this would even be better in terms of security but what explained Patrick with a secret works as well.
a
Pretty cool. Thanks @icy-doctor-13719 and @millions-journalist-34868
🎉 1
Open in Slack
PreviousNext
Powered by

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Powered by