[PRDP-175] feat: migrating to federated identity

.identity/00_data.tf

@@ -2,6 +2,11 @@ data "azurerm_resource_group" "dashboards" {
   name = "dashboards"
 }
 
+data "azurerm_storage_account" "tfstate_app" {
+  name                = "pagopainfraterraform${var.env}"
+  resource_group_name = "io-infra-rg"
+}
+
 data "azurerm_kubernetes_cluster" "aks" {
   name                = local.aks_cluster.name
   resource_group_name = local.aks_cluster.resource_group_name

.identity/02_application_main.tf

@@ -0,0 +1,16 @@
+resource "azuread_application" "main" {
+  display_name = "${local.app_name}-main"
+}
+
+resource "azuread_service_principal" "main" {
+  application_id = azuread_application.main.application_id
+}
+
+resource "azuread_application_federated_identity_credential" "main" {
+  application_object_id = azuread_application.main.object_id
+  display_name          = "github-federated"
+  description           = "github-federated"
+  audiences             = ["api://AzureADTokenExchange"]
+  issuer                = "https://token.actions.githubusercontent.com"
+  subject               = "repo:${local.github.org}/${local.github.repository}:environment:${var.env}"
+}

.identity/02_application_main_auth.tf

@@ -0,0 +1,22 @@
+resource "azurerm_role_assignment" "main_terraform_subscription" {
+  scope                = data.azurerm_subscription.current.id
+  role_definition_name = "Reader"
+  principal_id         = azuread_service_principal.main.object_id
+}
+
+resource "azurerm_role_assignment" "main_terraform_storage_account_tfstate_app" {
+  scope                = data.azurerm_storage_account.tfstate_app.id
+  role_definition_name = "Contributor"
+  principal_id         = azuread_service_principal.main.object_id
+}
+resource "azurerm_role_assignment" "main_terraform_storage_account_tfstate_app_github_aks" {
+  scope                = data.azurerm_storage_account.tfstate_app.id
+  role_definition_name = "Contributor"
+  principal_id         = module.github_runner_app.object_id
+}
+
+resource "azurerm_role_assignment" "main_terraform_resource_group_dashboards" {
+  scope                = data.azurerm_resource_group.dashboards.id
+  role_definition_name = "Contributor"
+  principal_id         = azuread_service_principal.main.object_id
+}