New resource: azurerm_federated_identity_credential

[favoretti]

Fixes #18617

[favoretti]

$ TF_ACC=1 go test -v ./internal/services/managedidentity -timeout=1000m -run='TestAccFederatedIdentityCredential'
=== RUN   TestAccFederatedIdentityCredential_basic
=== PAUSE TestAccFederatedIdentityCredential_basic
=== RUN   TestAccFederatedIdentityCredential_requiresImport
=== PAUSE TestAccFederatedIdentityCredential_requiresImport
=== CONT  TestAccFederatedIdentityCredential_basic
=== CONT  TestAccFederatedIdentityCredential_requiresImport
--- PASS: TestAccFederatedIdentityCredential_basic (190.41s)
--- PASS: TestAccFederatedIdentityCredential_requiresImport (210.06s)
PASS
ok  	github.com/hashicorp/terraform-provider-azurerm/internal/services/managedidentity	211.229s

[favoretti]

[favoretti]

No regressions after API upgrade either it seems:

[katbyte]

Thanks @favoretti - LGTM 🍄

[github-actions]

This functionality has been released in v3.31.0 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[weisdd]

@favoretti I've just tried to use the resource and noticed that the documentation has a small defect. - location is actually not part of the resource spec, and it's not needed at all. So, all references to location should be removed.

[favoretti]

@weisdd oh, you're completely correct, fixed it here: #19254
Resource itself works though, right?

[weisdd]

@favoretti the resource itself works well. - In our corporate terraform module, I replaced raw azapi resources with azurerm_federated_identity_credential, and then ran terraform apply, it all went flawlessly. Happy to see there are no migration issues.

Thanks for fixing the docs :)

[TeamDman]

Example script for future reference

resource "azurerm_user_assigned_identity" "gifts" {
  resource_group_name = azurerm_resource_group.main.name
  name = "gifts"
  location = "canadacentral"
}

resource "azurerm_federated_identity_credential" "gifts" {
  resource_group_name = azurerm_resource_group.main.name
  parent_id = azurerm_user_assigned_identity.gifts.id
  name = "gifts"
  issuer = azurerm_kubernetes_cluster.main.oidc_issuer_url
  subject = "system:serviceaccount:gifts:gifts"
  audience = ["api://AzureADTokenExchange"]
}

The azuread_application_federated_identity_credential resource from the azuread provider one asks for an application id instead of the reference to the managed identity which had me confused for a bit until I noticed that there's also an azurerm resource

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.