lz-identity

Type: bicep-module

Snippet

module identity 'br/public:avm/res/managed-identity/user-assigned-identity:0.2.1' = { scope: az.resourceGroup(landingzoneResourceGroupName) name: 'lz-serviceConnection' params: { name: 'id-${appName}-${environment}' location: location federatedIdentityCredentials: [ { name: 'landingzoneOwner' audiences: [ 'api://AzureADTokenExchange' ] issuer: 'https://token.actions.githubusercontent.com' subject: 'repo:${githubOrganizationName}/${githubRepoName}:environment:${environment}' } ] } } module rbacLandingzoneOwner 'base/roleAssignments-subscription.bicep' = { name: 'lz-rbac-serviceConnection' params: { principalId: identity.outputs.principalId roleDefinitionId: AzureRoles.Owner principleType: 'ServicePrincipal' } } module rbacApplicationReader 'base/roleAssignments-subscription.bicep' = { name: 'lz-rbac-applicationReader' params: { principalId: applicationReaderEntraGroupId roleDefinitionId: AzureRoles.Reader principleType: 'Group' } }

Path

landing-zones/bicep/modules/identity.bicep

← Back to bigbang