No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

how can i get an azure.msi.UserAssignedIdentity clientId please - it doesn't seem to exist in the pulumi source at all but it's an essential part of using them

are you sure it's not the principalId you want? I just used some UAI in my app, and I didn't need the clientId

yeah i use principalId and resourceId elsewhere

but i'm using aad-pod-identity to assign MSI to pods

i had a look through terraform and it only seems to be mentioned with servicePrincipals there... not really sure why

i know this probably isnt exactly what you're using, but if you find the code for your SDK and object, you might be able to simply add it as an output as shown here: <https://github.com/pulumi/pulumi-azure/blob/master/sdk/python/pulumi_azure/msi/user_assigned_identity.py#L58>

can give that a shot, and if it works add it as a PR

although that is generated by tfgen.. still, might be worth a shot just to see if it's available at that point

or maybe it would be a TF PR.. since all this stuff is based off terraform

yeah i suspect it would be - terraform doesnt mention it anywhere inside the msi bits

yea according to TF docs it's not listed as an attribute that's exported: <https://www.terraform.io/docs/providers/azurerm/r/user_assigned_identity.html>

<https://github.com/terraform-providers/terraform-provider-azurerm/blob/master/azurerm/resource_arm_user_assigned_identity.go>

yea i wouldnt expect you could get it until TF adds it

you can probably use the regular azure SDK to query the UAI in your code and set it as a config var or something

that's the nice thing about infra as code :slightly_smiling_face: lots of tricks

i was hoping to make a new identity per app and have it all full auto :sad:

you prob still can tho, after you create it, write a loop that queries via the SDK for the UAI.clientId, then move on to the usage of it

oh I see what you mean, yeah I'll give that a go cheers

<https://github.com/Azure/azure-sdk-for-go/blob/master/services/msi/mgmt/2015-08-31-preview/msi/userassignedidentities.go#L193>

not got the auto-client-id-getting-bit working yet but its the final link in the chain

```const testApplicationClientId = testApplicationIdentity.id.apply(resourceId =&gt; {
    let cmd = `az identity show --output tsv --query "clientId" --ids ${resourceId}`;
    var result = child.execSync(cmd);
    return result.toString();
})
testApplicationClientId.apply(x =&gt; console.log(x));```