Update OIDC audience default to ElasticCloudConnector #3654
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This pull request does not have a backport label. Could you fix it @Copilot? 🙏
|
Co-authored-by: jeniawhite <[email protected]>
Copilot
AI
changed the title
[WIP] Update OIDC audience default to ElasticCloudConnector
Update OIDC audience default to ElasticCloudConnector
Oct 17, 2025
Copilot finished work on behalf of
jeniawhite
October 17, 2025 22:32
olegsu
approved these changes
Oct 20, 2025
moukoublen
approved these changes
Oct 23, 2025
mergify bot
pushed a commit
that referenced
this pull request
Oct 23, 2025
## Summary
Replace hardcoded Azure OIDC audience value
(`api://AzureADTokenExchange`) with Elastic-specific audience
(`ElasticCloudConnector`) in ARM templates for cloud connectors. This
aligns the configuration with ElasticCloudConnector usage and improves
security by using a more specific audience claim.
## Changes
Updated the `audiences` array in the federated identity credentials
configuration for both single-account and organization-account ARM
templates:
**Before:**
```json
"audiences": [
"api://AzureADTokenExchange"
]
```
**After:**
```json
"audiences": [
"ElasticCloudConnector"
]
```
## Files Modified
- `deploy/azure/ARM-for-cloud-connectors-single-account.json`
- `deploy/azure/ARM-for-cloud-connectors-organization-account.json`
## Rationale
The previous value `api://AzureADTokenExchange` is the default Azure
audience for OIDC token exchange. Using a more specific audience value
like `ElasticCloudConnector` provides better security by ensuring tokens
are explicitly intended for Elastic Cloud Connector usage, preventing
potential token misuse across different systems.
<!-- START COPILOT CODING AGENT SUFFIX -->
<details>
<summary>Original prompt</summary>
> Replace every occurrence of the OIDC audience string
"api://AzureADTokenExchange" with "ElasticCloudConnector" in the
repository.
>
> Files to change (confirmed from code search):
> - deploy/azure/ARM-for-cloud-connectors-single-account.json
> - Replace the audiences array value:
> - "api://AzureADTokenExchange" -> "ElasticCloudConnector"
>
> - deploy/azure/ARM-for-cloud-connectors-organization-account.json
> - Replace the audiences array value:
> - "api://AzureADTokenExchange" -> "ElasticCloudConnector"
>
> Notes:
> - The search may be incomplete. The PR should include these
replacements and any other occurrences found in the repo.
> - Create a new branch named: copilot/update-oidc-audience-default
> - Commit message: "Update OIDC audience to ElasticCloudConnector"
> - Open a pull request with title: "Update OIDC audience default to
ElasticCloudConnector"
> - PR description: "Replace hardcoded Azure OIDC audience value
(api://AzureADTokenExchange) with Elastic-specific audience
(ElasticCloudConnector) in ARM templates and other relevant files. This
aligns configuration with ElasticCloudConnector usage."
>
> Repository: elastic/cloudbeat
</details>
*This pull request was created as a result of the following prompt from
Copilot chat.*
> Replace every occurrence of the OIDC audience string
"api://AzureADTokenExchange" with "ElasticCloudConnector" in the
repository.
>
> Files to change (confirmed from code search):
> - deploy/azure/ARM-for-cloud-connectors-single-account.json
> - Replace the audiences array value:
> - "api://AzureADTokenExchange" -> "ElasticCloudConnector"
>
> - deploy/azure/ARM-for-cloud-connectors-organization-account.json
> - Replace the audiences array value:
> - "api://AzureADTokenExchange" -> "ElasticCloudConnector"
>
> Notes:
> - The search may be incomplete. The PR should include these
replacements and any other occurrences found in the repo.
> - Create a new branch named: copilot/update-oidc-audience-default
> - Commit message: "Update OIDC audience to ElasticCloudConnector"
> - Open a pull request with title: "Update OIDC audience default to
ElasticCloudConnector"
> - PR description: "Replace hardcoded Azure OIDC audience value
(api://AzureADTokenExchange) with Elastic-specific audience
(ElasticCloudConnector) in ARM templates and other relevant files. This
aligns configuration with ElasticCloudConnector usage."
>
> Repository: elastic/cloudbeat
<!-- START COPILOT CODING AGENT TIPS -->
---
💡 You can make Copilot smarter by setting up custom instructions,
customizing its development environment and configuring Model Context
Protocol (MCP) servers. Learn more [Copilot coding agent
tips](https://gh.io/copilot-coding-agent-tips) in the docs.
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: jeniawhite <[email protected]>
Co-authored-by: Evgeniy Belyi <[email protected]>
(cherry picked from commit 5c35455)
jeniawhite
added a commit
that referenced
this pull request
Oct 23, 2025
…nector (#3659) ## Summary Replace hardcoded Azure OIDC audience value (`api://AzureADTokenExchange`) with Elastic-specific audience (`ElasticCloudConnector`) in ARM templates for cloud connectors. This aligns the configuration with ElasticCloudConnector usage and improves security by using a more specific audience claim. ## Changes Updated the `audiences` array in the federated identity credentials configuration for both single-account and organization-account ARM templates: **Before:** ```json "audiences": [ "api://AzureADTokenExchange" ] ``` **After:** ```json "audiences": [ "ElasticCloudConnector" ] ``` ## Files Modified - `deploy/azure/ARM-for-cloud-connectors-single-account.json` - `deploy/azure/ARM-for-cloud-connectors-organization-account.json` ## Rationale The previous value `api://AzureADTokenExchange` is the default Azure audience for OIDC token exchange. Using a more specific audience value like `ElasticCloudConnector` provides better security by ensuring tokens are explicitly intended for Elastic Cloud Connector usage, preventing potential token misuse across different systems. <details> <summary>Original prompt</summary> > Replace every occurrence of the OIDC audience string "api://AzureADTokenExchange" with "ElasticCloudConnector" in the repository. > > Files to change (confirmed from code search): > - deploy/azure/ARM-for-cloud-connectors-single-account.json > - Replace the audiences array value: > - "api://AzureADTokenExchange" -> "ElasticCloudConnector" > > - deploy/azure/ARM-for-cloud-connectors-organization-account.json > - Replace the audiences array value: > - "api://AzureADTokenExchange" -> "ElasticCloudConnector" > > Notes: > - The search may be incomplete. The PR should include these replacements and any other occurrences found in the repo. > - Create a new branch named: copilot/update-oidc-audience-default > - Commit message: "Update OIDC audience to ElasticCloudConnector" > - Open a pull request with title: "Update OIDC audience default to ElasticCloudConnector" > - PR description: "Replace hardcoded Azure OIDC audience value (api://AzureADTokenExchange) with Elastic-specific audience (ElasticCloudConnector) in ARM templates and other relevant files. This aligns configuration with ElasticCloudConnector usage." > > Repository: elastic/cloudbeat </details> *This pull request was created as a result of the following prompt from Copilot chat.* > Replace every occurrence of the OIDC audience string "api://AzureADTokenExchange" with "ElasticCloudConnector" in the repository. > > Files to change (confirmed from code search): > - deploy/azure/ARM-for-cloud-connectors-single-account.json > - Replace the audiences array value: > - "api://AzureADTokenExchange" -> "ElasticCloudConnector" > > - deploy/azure/ARM-for-cloud-connectors-organization-account.json > - Replace the audiences array value: > - "api://AzureADTokenExchange" -> "ElasticCloudConnector" > > Notes: > - The search may be incomplete. The PR should include these replacements and any other occurrences found in the repo. > - Create a new branch named: copilot/update-oidc-audience-default > - Commit message: "Update OIDC audience to ElasticCloudConnector" > - Open a pull request with title: "Update OIDC audience default to ElasticCloudConnector" > - PR description: "Replace hardcoded Azure OIDC audience value (api://AzureADTokenExchange) with Elastic-specific audience (ElasticCloudConnector) in ARM templates and other relevant files. This aligns configuration with ElasticCloudConnector usage." > > Repository: elastic/cloudbeat --- 💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more [Copilot coding agent tips](https://gh.io/copilot-coding-agent-tips) in the docs.<hr>This is an automatic backport of pull request #3654 done by [Mergify](https://mergify.com). Co-authored-by: Copilot <[email protected]> Co-authored-by: jeniawhite <[email protected]> Co-authored-by: Evgeniy Belyi <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Replace hardcoded Azure OIDC audience value (
api://AzureADTokenExchange) with Elastic-specific audience (ElasticCloudConnector) in ARM templates for cloud connectors. This aligns the configuration with ElasticCloudConnector usage and improves security by using a more specific audience claim.Changes
Updated the
audiencesarray in the federated identity credentials configuration for both single-account and organization-account ARM templates:Before:
After:
Files Modified
deploy/azure/ARM-for-cloud-connectors-single-account.jsondeploy/azure/ARM-for-cloud-connectors-organization-account.jsonRationale
The previous value
api://AzureADTokenExchangeis the default Azure audience for OIDC token exchange. Using a more specific audience value likeElasticCloudConnectorprovides better security by ensuring tokens are explicitly intended for Elastic Cloud Connector usage, preventing potential token misuse across different systems.Original prompt
This pull request was created as a result of the following prompt from Copilot chat.
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.