Azure / Azure/azure-cli-extensions
az vm ssh does not support managed identity
- Dominant language
- Python
- Stars
- 454
- Forks
- 1.7k
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 64
Description
### Related command
```sh
$ az login --identity
$ az vm ssh --ip xxx.xxx.xxx.xxx
```
### Extension name (the extension in question)
```json
{
"extensionType": "whl",
"name": "ssh",
"version": "1.1.2"
"preview": false,
[...]
}
```
### Description of issue (in as much detail as possible)
I am working on a development setup for Ansible using virtual machines in Azure. Ansible is installed on a VM with a managed identity assigned to it. We use Azure IAM wherever possible and thus would like to use said managed identity to connect to other VMs. Azure AD authentication is enabled on all VMs and the managed identity has the necessary permissions to connect via SSH.
After installing Azure CLI version 2.40.0 and the ssh extension version 1.1.2, we can use SSH with our personal accounts by running the following commands:
```sh
$ az login
$ az ssh vm --ip xxx.xxx.xxx.xxx
```
Next, we tried using the VM's managed identity. The authentication works fine, but `az ssh` returns an error.
```
$ az login identity
[
{
"environmentName": "AzureCloud",
"homeTenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"isDefault": "true",
"managedByTenants": [],
"name": "xxxxxxxxx",
"state": "Enabled",
"tenant-id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"user": {
"assignedIdentityInfo": "MSI",
"name": "systemAssignedIdentity",
"type": "servicePrincipal"
}
}
]
$ az ssh vm --ip xxx.xxx.xxx.xxx
VM SSH currently doesn't support managed identity.
```
As a workaround we could use a self-managed service principal, however we would like to avoid the credential management.
Contributor guide
Assessment
This issue has not been assessed yet.