Create MI for Github workflow in Vulnaribility Scanner

terraform/subscriptions/modules/userassignedidentity/main.tf

@@ -9,4 +9,15 @@ resource "azurerm_role_assignment" "this" {
   scope                = each.value.scope_id
   role_definition_name = each.value.role
   principal_id         = azurerm_user_assigned_identity.userassignedidentity.principal_id
-}
+}
+
+resource "azurerm_federated_identity_credential" "this" {
+  for_each = var.federated_credentials
+
+  audience            = ["api://AzureADTokenExchange"]
+  issuer              = each.value.issuer
+  name                = each.value.name
+  parent_id           = azurerm_user_assigned_identity.userassignedidentity.id
+  resource_group_name = var.resource_group_name
+  subject             = each.value.subject
+}

terraform/subscriptions/modules/userassignedidentity/output.tf

@@ -2,3 +2,8 @@ output "data" {
   description = "userassignedidentity"
   value       = azurerm_user_assigned_identity.userassignedidentity
 }
+
+output "client-id" {
+  description = "userassignedidentity"
+  value       = azurerm_user_assigned_identity.userassignedidentity.client_id
+}

terraform/subscriptions/modules/userassignedidentity/variables.tf

@@ -19,4 +19,13 @@ variable "roleassignments" {
     scope_id = string
   }))
   default = {}
-}
+}
+
+variable "federated_credentials" {
+  type = map(object({
+    name    = string
+    issuer  = string
+    subject = string
+  }))
+  default = {}
+}

terraform/subscriptions/s941/dev/vulnerability-scanner/main.tf

@@ -8,10 +8,9 @@ module "config" {
   source = "../../../modules/config"
 }
 
-# TODO: Migrate keys to radix-keyv-dev when ready
 data "azurerm_key_vault" "keyvault" {
-  name                = "radix-vault-dev" # module.config.key_vault_name
-  resource_group_name = "common"          # module.config.common_resource_group
+  name                = module.config.key_vault_name
+  resource_group_name = module.config.common_resource_group
 }
 
 data "azurerm_key_vault_secret" "keyvault_secrets" {
@@ -50,6 +49,44 @@ module "mssql-database" {
   }
 }
 
+data "azurerm_container_registry" "acr" {
+  name = var.acr_name
+  resource_group_name = "common" # TODO: Fix module.config.common_resource_group
+}
+
+module "github-workload-id" {
+  source = "../../../modules/userassignedidentity"
+  name = "radix-id-github-vulnerability-scan-${module.config.environment}"
+  resource_group_name = module.resourcegroup.data.name
+  location = module.resourcegroup.data.location
+  roleassignments = {
+    contributor = {
+      role = "Contributor" # Needed to open firewall
+      scope_id = data.azurerm_container_registry.acr.id
+    },
+  }
+  federated_credentials = {
+    github-main = {
+      name    = "gh-radix-vulnerability-scan-acr-main-${module.config.environment}"
+      issuer  = "https://token.actions.githubusercontent.com"
+      subject = "repo:equinor/radix-vulnerability-scanner:ref:refs/heads/main"
+    }
+    github-release = {
+      name    = "gh-radix-vulnerability-scan-acr-release-${module.config.environment}"
+      issuer  = "https://token.actions.githubusercontent.com"
+      subject = "repo:equinor/radix-vulnerability-scanner:ref:refs/heads/release"
+    }
+    github-pr = {
+      name    = "gh-radix-vulnerability-scan-acr-pr-${module.config.environment}"
+      issuer  = "https://token.actions.githubusercontent.com"
+      subject = "repo:equinor/radix-vulnerability-scanner:pull_request"
+    }
+  }
+}
+
 output "mi-client-id" {
   value = module.mssql-database.mi-admin
 }
+output "radix-id-github-vulnerability-scan" {
+  value = { "client-id" = module.github-workload-id.client-id }
+}

terraform/subscriptions/s941/dev/vulnerability-scanner/variables.tf

@@ -12,3 +12,8 @@ variable "keyvault_dbadmin_secret_name" {
   type    = string
   default = "radix-vulnerability-scan-db-admin"
 }
+
+variable "acr_name" {
+  type    = string
+  default = "radixdev"
+}