Azure Examples

cd workload-identity
terraform init
terraform plan \
  -var="resource_group_name=my-rg" \
  -var="aks_cluster_name=my-aks" \
  -var="namespace=my-app" \
  -var="service_account_name=my-app-sa"
terraform apply

# Apply the annotated ServiceAccount
kubectl apply -f serviceaccount.yaml

# Federated credential binds managed identity to AKS ServiceAccount
resource "azurerm_federated_identity_credential" "app" {
  issuer  = data.azurerm_kubernetes_cluster.aks.oidc_issuer_url
  subject = "system:serviceaccount:${var.namespace}:${var.service_account_name}"
  audience = ["api://AzureADTokenExchange"]
}

# ServiceAccount — annotated with client ID
metadata:
  annotations:
    azure.workload.identity/client-id: "<managed-identity-client-id>"

# Pod spec — label triggers token injection
metadata:
  labels:
    azure.workload.identity/use: "true"
spec:
  serviceAccountName: my-app-sa

resource "azurerm_role_assignment" "app_storage" {
  scope                = azurerm_storage_account.app.id
  role_definition_name = "Storage Blob Data Reader"
  principal_id         = azurerm_user_assigned_identity.app.principal_id
}

locals {
  common_tags = { environment = var.environment, team = var.team, managed-by = "terraform" }
}
resource "azurerm_resource_group" "app" {
  tags = merge(local.common_tags, { service = "my-app" })
}