Allow authentication via managed service identity #639

hbuckle · 2017-12-18T20:51:36Z

Adds a provider option to allow authentication using managed service identity
e.g.

provider "azurerm" {
  subscription_id = "xxx"
  tenant_id       = "xxx"
  use_msi         = true
}

paultyng · 2018-01-26T16:15:53Z

@hbuckle Code wise this looks good to me. I have no experience with MSI though. We have some additional authentication changes coming targeted at 1.0.3 so grouping this up with those (see the other issues under the authentication label).

paultyng · 2018-01-26T16:16:27Z

It looks like this has a minor merge conflict, could maybe use a rebase.

VaijanathB · 2018-01-26T23:03:11Z

@hbuckle ,

Am I understanding correctly that this only supports MSI with ServicePrincipal and does not do it with azure cli ? Also I pulled your branch and tried to verify using the construct specified

provider "azurerm" {
subscription_id = "xxx"
tenant_id = "xxx"
use_msi = true
}
and was not able to authenticate. Can you please elaborate how to do it ?

Thanks,
VJ

hbuckle · 2018-01-27T08:26:27Z

@VaijanathB MSI works by creating a service principal to act on behalf of an Azure resource (such as a VM). For it to work you need to be running Terraform from a VM in Azure that has MSI configured - see authenticating_via_msi.html.markdown for details

metacpp · 2018-01-30T01:17:39Z

azurerm/provider.go

 			SkipCredentialsValidation: d.Get("skip_credentials_validation").(bool),
 			SkipProviderRegistration:  d.Get("skip_provider_registration").(bool),
 		}

-		if config.ClientSecret != "" {
+		if config.UseMsi {


Shall we use the same if-else logic as in the azurerm/config.go ?

Do you mean from getAuthorizationToken ? I think the logic is slightly different in each

Yes, I mean why we don't check if ClientSecret exists firstly.

VaijanathB · 2018-01-31T23:58:54Z

website/docs/authenticating_via_msi.html.markdown

+Managed service identity can also be configured using Terraform. The following template shows how. Note that for a Linux VM you must use the ManagedIdentityExtensionForLinux.
+
+```hcl
+resource "azurerm_virtual_machine" "virtual_machine" {


Can you put a Linux example ? This example creates WindowsServer and the documentation above says about Linux.

As noted, for Linux it would be exactly the same except you use ManagedIdentityExtensionForLinux instead of ManagedIdentityExtensionForWindows extension

metacpp · 2018-02-05T23:00:54Z

azurerm/provider.go

+			"msi_endpoint": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				DefaultFunc: schema.EnvDefaultFunc("ARM_MSI_ENDPOINT", ""),


Can we change the default environment variable to "AZURE_MSI_ENDPOINT", coz this endpoint is not just for getting tokens for ARM, but also for graph/datalake/keyvault.

(same here) - given the prefix for the other Environment Variables is ARM - we'd be best to leave this as ARM_MSI_ENDPOINT rather than making this AZURE_MSI_ENDPOINT - in future we can migrate across to use AZURE as a prefix if needed)

should this be defaulted to http://localhost:50342/oauth2/token?

@tombuildsstuff by leaving it blank then the endpoint should be auto-discovered using GetMSIVMEndpoint(). I only put the option there in case the endpoint can't be discovered (such as when running in a container)

metacpp · 2018-02-05T23:01:23Z

azurerm/provider.go

+			"use_msi": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				DefaultFunc: schema.EnvDefaultFunc("ARM_USE_MSI", false),


Change to "USE_MSI".

given all the other Environment Variables are prefixed with ARM - we should leave this as ARM_USE_MSI for consistency (we may change this for AZURE_USE_MSI in future, but it should be consistent for now)

tombuildsstuff

hey @hbuckle

Thanks for this PR - apologies for the delayed review here!

I've taken a look through and left some comments in-line but this mostly looks good to me - if we can fix those minor issues this should be good to merge, as such I'll go ahead and test this PR in the meantime :)

Thanks!

tombuildsstuff · 2018-02-06T23:11:27Z

azurerm/provider.go

+			"msi_endpoint": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				DefaultFunc: schema.EnvDefaultFunc("ARM_MSI_ENDPOINT", ""),


should this be defaulted to http://localhost:50342/oauth2/token?

tombuildsstuff · 2018-02-06T23:24:06Z

website/docs/authenticating_via_msi.html.markdown

+
+Terraform supports authenticating to Azure through Managed Service Identity, Service Principal or the Azure CLI.
+
+We recommend using Managed Service Identity when running in a Shared Environment (such as within a CI server/automation) that you do not wish to configure credentials for - and [authenticating via the Azure CLI](authenticating_via_azure_cli.html) when you're running Terraform locally. Note that managed service identity is only available for virtual machines within Azure.


I'd suggest we change this to:

Managed Service Identity can be used to access other Azure Services from within a Virtual Machine in Azure instead of specifying a Service Principal or Azure CLI credentials.

tombuildsstuff · 2018-02-07T23:58:55Z

website/docs/authenticating_via_msi.html.markdown

+
+# Grant the VM identity contributor rights to the current subscription
+resource "azurerm_role_assignment" "role_assignment" {
+  name               = "${uuid()}"


I believe this field is optional - so we should be able to not specify it and it'll be populated automatically?

tombuildsstuff · 2018-02-08T00:00:32Z

website/docs/authenticating_via_msi.html.markdown

+
+### Configuring Managed Service Identity using Terraform
+
+Managed service identity can also be configured using Terraform. The following template shows how. Note that for a Linux VM you must use the ManagedIdentityExtensionForLinux.


can we make this "ManagedIdentityExtensionForLinux extension"

tombuildsstuff · 2018-02-08T21:42:25Z

website/docs/authenticating_via_msi.html.markdown

+
+Managed Service Identity allows an Azure virtual machine to retrieve a token to access the Azure API without needing to pass in credentials. This works by creating a service principal in Azure Active Directory that is associated to a virtual machine. This service principal can then be granted permissions to Azure resources.
+There are various ways to configure managed service identity - see the [Microsoft documentation](https://docs.microsoft.com/en-us/azure/active-directory/msi-overview) for details.
+You can then run Terraform from the MSI enabled virtual machine by setting the use_msi provider option to true.


can we quote use_msi and true here?

metacpp · 2018-02-09T18:14:21Z

@hbuckle any update ?

tombuildsstuff · 2018-02-14T03:27:59Z

Results of testing this so far:

❌ issues in CloudShell
✅ MSI on a Windows VM
✅ MSI on a Linux VM

~~Once I've confirmed this works on Linux~~
I'm looking into why this fails in CloudShell (since MSI is now available there too)

tombuildsstuff · 2018-02-14T22:35:57Z

hey @hbuckle

Just to give an update here - I've been working through testing this, and this looks good on the VM's (both Linux and Windows), however there's an issue when running in CloudShell (where MSI's recently been enabled). In CloudShell the API doesn't return the same schema as the API available when running in a VM (an integer value is returned, rather than a string) for the expiresOn field, which means deserialization fails.

Since MSI is enabled by default in CloudShell - I've reached out to Microsoft to see how if they can patch the API to return the correct data type - if that's not going to be possible for a while the other option would be to error when running in CloudShell with MSI enabled, until we've confirmed the API's been patched (which would allow us to ship this for use in VM's).

Apologies for the delay, but bear with us here - I'm hoping we'll have an answer about this later this week :)

Thanks!

tombuildsstuff

hey @hbuckle

Apologies for the delay getting this merged - we've been working with Microsoft to fix the broken MSI API. That's now been deployed - and I can confirm this looks good in our testing.

Thanks for pushing those updates to this PR - this now LGTM 👍

Thanks!

also restructuring the changelog to match the releases better

tombuildsstuff · 2018-03-02T17:30:25Z

👋 hey @hbuckle

Just to let you know that support for MSI has just been released in v1.2.0 of the AzureRM Provider - full details of what's included are available here: https://github.com/terraform-providers/terraform-provider-azurerm/blob/v1.2.0/CHANGELOG.md#120-march-02-2018

Thanks!

ghost · 2020-03-31T15:27:06Z

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!

Henry Buckle and others added 10 commits December 11, 2017 10:54

Merge remote-tracking branch 'upstream/master'

cf4e46f

Merge remote-tracking branch 'upstream/master'

e25b50b

Merge remote-tracking branch 'upstream/master'

5c9d01b

allow auth via msi

0092e8d

tweaks

988fc2d

get endpoint during provider setup

9e671ec

docs

03667c1

update error msg

d5a5e8b

docs

d000097

tidy

d1bfd42

tombuildsstuff added authentication enhancement labels Jan 8, 2018

tombuildsstuff added this to the 1.0.2 milestone Jan 10, 2018

tombuildsstuff modified the milestones: 1.0.2, 1.0.3 Jan 24, 2018

paultyng previously approved these changes Jan 26, 2018

View reviewed changes

Merge remote-tracking branch 'upstream/master' into msiauth

86594ad

hbuckle dismissed paultyng’s stale review via 86594ad January 27, 2018 08:44

metacpp self-requested a review January 29, 2018 22:55

metacpp reviewed Jan 30, 2018

View reviewed changes

VaijanathB reviewed Jan 31, 2018

View reviewed changes

tombuildsstuff modified the milestones: 1.1.1, 1.1.2 Feb 5, 2018

metacpp suggested changes Feb 5, 2018

View reviewed changes

tombuildsstuff self-assigned this Feb 6, 2018

metacpp approved these changes Feb 8, 2018

View reviewed changes

tombuildsstuff suggested changes Feb 8, 2018

View reviewed changes

metacpp added the service/cloudshell label Feb 13, 2018

tombuildsstuff removed the service/cloudshell label Feb 13, 2018

update docs

b65c8cd

tombuildsstuff added the upstream/microsoft Indicates that there's an upstream issue blocking this issue/PR label Feb 14, 2018

tombuildsstuff modified the milestones: 1.1.2, 1.1.3 Feb 15, 2018

tombuildsstuff approved these changes Mar 1, 2018

View reviewed changes

tombuildsstuff removed the upstream/microsoft Indicates that there's an upstream issue blocking this issue/PR label Mar 1, 2018

tombuildsstuff merged commit d7e6931 into hashicorp:master Mar 1, 2018

tombuildsstuff added a commit that referenced this pull request Mar 1, 2018

Updating to include #639

f89a4b4

also restructuring the changelog to match the releases better

ghost locked and limited conversation to collaborators Mar 31, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow authentication via managed service identity #639

Allow authentication via managed service identity #639

hbuckle commented Dec 18, 2017

paultyng commented Jan 26, 2018 •

edited

Loading

paultyng commented Jan 26, 2018

VaijanathB commented Jan 26, 2018

hbuckle commented Jan 27, 2018

metacpp Jan 30, 2018

hbuckle Feb 1, 2018

metacpp Feb 1, 2018 •

edited

Loading

VaijanathB Jan 31, 2018

hbuckle Feb 1, 2018

metacpp Feb 5, 2018

tombuildsstuff Feb 6, 2018

tombuildsstuff Feb 6, 2018

metacpp Feb 8, 2018

hbuckle Feb 9, 2018

metacpp Feb 5, 2018

tombuildsstuff Feb 6, 2018

metacpp Feb 8, 2018

tombuildsstuff left a comment •

edited

Loading

tombuildsstuff Feb 6, 2018

tombuildsstuff Feb 6, 2018

tombuildsstuff Feb 7, 2018

tombuildsstuff Feb 8, 2018

tombuildsstuff Feb 8, 2018

metacpp commented Feb 9, 2018

tombuildsstuff commented Feb 14, 2018 •

edited

Loading

tombuildsstuff commented Feb 14, 2018

tombuildsstuff left a comment

tombuildsstuff commented Mar 2, 2018

ghost commented Mar 31, 2020


		Terraform supports authenticating to Azure through Managed Service Identity, Service Principal or the Azure CLI.

		We recommend using Managed Service Identity when running in a Shared Environment (such as within a CI server/automation) that you do not wish to configure credentials for - and [authenticating via the Azure CLI](authenticating_via_azure_cli.html) when you're running Terraform locally. Note that managed service identity is only available for virtual machines within Azure.


		### Configuring Managed Service Identity using Terraform

		Managed service identity can also be configured using Terraform. The following template shows how. Note that for a Linux VM you must use the ManagedIdentityExtensionForLinux.

Allow authentication via managed service identity #639

Allow authentication via managed service identity #639

Conversation

hbuckle commented Dec 18, 2017

paultyng commented Jan 26, 2018 • edited Loading

paultyng commented Jan 26, 2018

VaijanathB commented Jan 26, 2018

hbuckle commented Jan 27, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

metacpp Feb 1, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tombuildsstuff left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

metacpp commented Feb 9, 2018

tombuildsstuff commented Feb 14, 2018 • edited Loading

tombuildsstuff commented Feb 14, 2018

tombuildsstuff left a comment

Choose a reason for hiding this comment

tombuildsstuff commented Mar 2, 2018

ghost commented Mar 31, 2020

paultyng commented Jan 26, 2018 •

edited

Loading

metacpp Feb 1, 2018 •

edited

Loading

tombuildsstuff left a comment •

edited

Loading

tombuildsstuff commented Feb 14, 2018 •

edited

Loading