Container app now uses user managed identity instead of system one.

.github/workflows/deploy.yml

@@ -64,19 +64,10 @@ jobs:
           else
             IMAGE="ghcr.io/pagopa/mil-auth:$IMAGE_TAG"
           fi
-          echo "*** [$IMAGE] will be deployed."
-
-          if [[ "$ENVIRONMENT" == "prod-cd" ]]; then
-            ENV_FOLDER="prod"
-          elif [[ "$ENVIRONMENT" == "uat-cd" ]]; then
-            ENV_FOLDER="uat"
-          else
-            ENV_FOLDER="dev"
-          fi
-          echo "*** [$ENV_FOLDER] folder will be used."
+          echo "[$IMAGE] will be deployed."
           
           echo "Terraform init..."
-          terraform init -backend-config="env/$ENV_FOLDER/backend.tfvars" -backend-config="use_oidc=true" -reconfigure
+          terraform init -backend-config="env/$ENVIRONMENT/backend.tfvars" -reconfigure
 
           echo "Terraform apply..."
-          terraform apply -var-file="env/$ENV_FOLDER/terraform.tfvars" -var="mil_auth_image=$IMAGE" -auto-approve -lock-timeout=300s
+          terraform apply -var-file="env/$ENVIRONMENT/terraform.tfvars" -var="mil_auth_image=$IMAGE" -auto-approve -lock-timeout=300s

src/main/terraform/resource_container_app.tf → src/main/terraform/container_app.tf

@@ -118,6 +118,11 @@ resource "azurerm_container_app" "auth" {
         name        = "mongodb.connection-string-2"
         secret_name = "cosmosdb-account-mil-secondary-mongodb-connection-string"
       }
+
+      env {
+        name        = "IDENTITY_CLIENT_ID"
+        secret_name = "identity-client-id"
+      }
     }
 
     max_replicas = var.mil_auth_max_replicas
@@ -127,35 +132,41 @@ resource "azurerm_container_app" "auth" {
   secret {
     name                = "cosmosdb-account-mil-primary-mongodb-connection-string"
     key_vault_secret_id = "${data.azurerm_key_vault.general.vault_uri}secrets/cosmosdb-account-mil-primary-mongodb-connection-string"
-    identity            = "System"
+    identity            = data.azurerm_user_assigned_identity.auth.id
   }
 
   secret {
     name                = "cosmosdb-account-mil-secondary-mongodb-connection-string"
     key_vault_secret_id = "${data.azurerm_key_vault.general.vault_uri}secrets/cosmosdb-account-mil-secondary-mongodb-connection-string"
-    identity            = "System"
+    identity            = data.azurerm_user_assigned_identity.auth.id
   }
 
   secret {
     name                = "storage-account-auth-primary-blob-endpoint"
     key_vault_secret_id = "${data.azurerm_key_vault.general.vault_uri}secrets/storage-account-auth-primary-blob-endpoint"
-    identity            = "System"
+    identity            = data.azurerm_user_assigned_identity.auth.id
   }
 
   secret {
     name                = "key-vault-auth-vault-uri"
     key_vault_secret_id = "${data.azurerm_key_vault.general.vault_uri}secrets/key-vault-auth-vault-uri"
-    identity            = "System"
+    identity            = data.azurerm_user_assigned_identity.auth.id
   }
 
   secret {
     name                = "application-insigths-mil-connection-string"
     key_vault_secret_id = "${data.azurerm_key_vault.general.vault_uri}secrets/application-insigths-mil-connection-string"
-    identity            = "System"
+    identity            = data.azurerm_user_assigned_identity.auth.id
+  }
+
+  secret {
+    name  = "identity-client-id"
+    value = "${data.azurerm_user_assigned_identity.auth.client_id}"
   }
 
   identity {
-    type = "SystemAssigned"
+    type = "UserAssigned"
+    identity_ids = [data.azurerm_user_assigned_identity.auth.id]
   }
 
   ingress {

src/main/terraform/data.tf

@@ -0,0 +1,39 @@
+# ------------------------------------------------------------------------------
+# Container Apps Environment.
+# ------------------------------------------------------------------------------
+data "azurerm_container_app_environment" "mil" {
+  name                = "${local.project}-cae"
+  resource_group_name = "${local.project}-app-rg"
+}
+
+# ------------------------------------------------------------------------------
+# Identity for this Container App.
+# ------------------------------------------------------------------------------
+data "azurerm_user_assigned_identity" "auth" {
+  resource_group_name = "${local.project}-identity-rg"
+  name                = "${var.prefix}-${var.env_short}-auth-identity"
+}
+
+# ------------------------------------------------------------------------------
+# General purpose key vault used to protect secrets.
+# ------------------------------------------------------------------------------
+data "azurerm_key_vault" "general" {
+  name                = "${local.project}-general-kv"
+  resource_group_name = "${local.project}-sec-rg"
+}
+
+# ------------------------------------------------------------------------------
+# Key vault for cryptographics operations.
+# ------------------------------------------------------------------------------
+data "azurerm_key_vault" "auth" {
+  name                = "${local.project}-auth-kv"
+  resource_group_name = "${local.project}-sec-rg"
+}
+
+# ------------------------------------------------------------------------------
+# Storage account containing configuration files.
+# ------------------------------------------------------------------------------
+data "azurerm_storage_account" "auth" {
+  name                = "${var.prefix}${var.env_short}authst"
+  resource_group_name = "${local.project}-data-rg"
+}

src/main/terraform/locals.tf

@@ -1,5 +1,4 @@
 locals {
   project = "${var.prefix}-${var.env_short}"
-
   domain = "mil"
-}
+}

src/main/terraform/main.tf

@@ -5,10 +5,6 @@ terraform {
       source  = "hashicorp/azurerm"
       version = "= 3.99.0"
     }
-    azuread = {
-      source  = "hashicorp/azuread"
-      version = "= 2.48.0"
-    }
   }
 
   backend "azurerm" {
@@ -31,4 +27,4 @@ provider "azurerm" {
 
 data "azurerm_subscription" "current" {}
 
-data "azurerm_client_config" "current" {}
+data "azurerm_client_config" "current" {}

src/main/terraform/variables.tf

@@ -43,9 +43,6 @@ variable "location_short" {
 
 variable "tags" {
   type = map(any)
-  default = {
-    CreatedBy = "Terraform"
-  }
 }
 
 # ------------------------------------------------------------------------------