Refactor KeyVault examples to use objectId
MODIFY
azure-py-msi-keyvault-rbac/__main__.py
azure-py-msi-keyvault-rbac/__main__.py
from pulumi_azure import core, storage, sql, appservice, keyvault, role
from pulumi import export, Output, asset
import pulumi_random as random
-import json, os
def createFirewallRules(arg):
ips = arg.split(",")
@@ -52,7 +51,6 @@ connection_string = Output.all(sql_server.name, database.name) \
text_blob = storage.Blob(
"text",
- resource_group_name=resource_group.name,
storage_account_name=storage_account.name,
storage_container_name=container.name,
type="block",
@@ -71,7 +69,6 @@ app_service_plan = appservice.Plan(
blob = storage.ZipBlob(
"zip",
- resource_group_name=resource_group.name,
storage_account_name=storage_account.name,
storage_container_name=container.name,
type="block",
@@ -80,7 +77,7 @@ blob = storage.ZipBlob(
client_config = core.get_client_config()
tenant_id = client_config.tenant_id
-current_principal = client_config.service_principal_object_id or json.loads(os.popen("az ad signed-in-user show --query objectId").read())
+current_principal = client_config.object_id
vault = keyvault.KeyVault(
"vault",

MODIFY
azure-ts-msi-keyvault-rbac/index.ts
azure-ts-msi-keyvault-rbac/index.ts
import * as azure from "@pulumi/azure";
import * as pulumi from "@pulumi/pulumi";
import * as random from "@pulumi/random";
-import { execSync } from "child_process";
// Create a resource group
const resourceGroup = new azure.core.ResourceGroup("resourceGroup");
@@ -43,7 +42,6 @@ const connectionString = pulumi.interpolate`Server=tcp:${sqlServer.name}.databas
// A file in Blob Storage that we want to access from the application
const textBlob = new azure.storage.Blob("text", {
- resourceGroupName: resourceGroup.name,
storageAccountName: storageAccount.name,
storageContainerName: storageContainer.name,
type: "block",
@@ -62,7 +60,6 @@ const appServicePlan = new azure.appservice.Plan("asp", {
// ASP.NET deployment package
const blob = new azure.storage.ZipBlob("zip", {
- resourceGroupName: resourceGroup.name,
storageAccountName: storageAccount.name,
storageContainerName: storageContainer.name,
type: "block",
@@ -72,20 +69,12 @@ const blob = new azure.storage.ZipBlob("zip", {
const clientConfig = azure.core.getClientConfig({});
const tenantId = clientConfig.tenantId;
-
-// Currently, only service principal ID is available in the context. If we are provided the
-// principle in the config, then just use it. Otherwise, if logged in with a user, find their ID
-// via Azure CLI. see https://github.com/terraform-providers/terraform-provider-azurerm/issues/3234
-const currentPrincipal = clientConfig.servicePrincipalObjectId !== ""
- ? clientConfig.servicePrincipalObjectId
- : <string>JSON.parse(execSync("az ad signed-in-user show --query objectId").toString());
+const currentPrincipal = clientConfig.objectId;
// Key Vault to store secrets (e.g. Blob URL with SAS)
const vault = new azure.keyvault.KeyVault("vault", {
resourceGroupName: resourceGroup.name,
- sku: {
- name: "standard",
- },
+ skuName: "standard",
tenantId: tenantId,
accessPolicies: [{
tenantId,

Refactor KeyVault examples to use objectId (#412)