Manages a federated identity credential associated with an application within Azure Active Directory.
The following API permissions are required in order to use this resource.
When authenticated with a service principal, this resource requires one of the following application roles: Application.ReadWrite.OwnedBy
or Application.ReadWrite.All
When authenticated with a user principal, this resource requires one of the following directory roles: Application Administrator
or Global Administrator
resource "azuread_application_registration" "example" {
display_name = "example"
}
resource "azuread_application_federated_identity_credential" "example" {
application_id = azuread_application_registration.example.id
display_name = "my-repo-deploy"
description = "Deployments for my-repo"
audiences = ["api://AzureADTokenExchange"]
issuer = "https://token.actions.githubusercontent.com"
subject = "repo:my-organization/my-repo:environment:prod"
}
The following arguments are supported:
application_id
- (Required) The resource ID of the application for which this federated identity credential should be created. Changing this field forces a new resource to be created.audiences
- (Required) List of audiences that can appear in the external token. This specifies what should be accepted in the aud
claim of incoming tokens.description
- (Optional) A description for the federated identity credential.display_name
- (Required) A unique display name for the federated identity credential. Changing this forces a new resource to be created.issuer
- (Required) The URL of the external identity provider, which must match the issuer claim of the external token being exchanged. The combination of the values of issuer and subject must be unique on the app.subject
- (Required) The identifier of the external software workload within the external identity provider. The combination of issuer and subject must be unique on the app.In addition to all arguments above, the following attributes are exported:
credential_id
- A UUID used to uniquely identify this federated identity credential.Federated Identity Credentials can be imported using the object ID of the associated application and the ID of the federated identity credential, e.g.
terraform import azuread_application_federated_identity_credential.example 00000000-0000-0000-0000-000000000000/federatedIdentityCredential/11111111-1111-1111-1111-111111111111