Add ability to use the Azure CLI as a service principal, so that it can be used with GitHub OIDC

[OmpahDev]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

I'm trying to use GitHub Actions to run Terragrunt to deploy Azure resources.

For security reasons, I'm trying to implement a solution that does not require any sensitive secrets or certificates to be stored in GitHub as variables, so we implemented OIDC login for GitHub (see https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services) to authenticate to Azure directly as a service principal.

However, with this approach, using Terraform is impossible, because azurerm fails with the error:
"│ Error: Error building ARM Config: Authenticating using the Azure CLI is only supported as a User (not a Service Principal)."

When I follow the documentation, it seems that azurerm only supports using Service Principals if you're using client certificates or client secrets... but the whole point of using OIDC is to avoid using those in the first place!

This is a pretty big limitation as it effectively means that GitHub-Azure OIDC cannot be used with Terraform.

New or Affected Resource(s)/Data Source(s)

N/A (all)

Potential Terraform Configuration

No response

References

No response

[OmpahDev]

Oops. I was searching for "GitHub" when looking over existing issues instead of "OIDC" and didn't realize there is in fact an open PR for this one right now.

#16555

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.