Azure / Azure/azure-powershell
[Feature]: Support system-assigned managed identity in VM/Arc Run Command cmdlets
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description of the new feature
The `{New,Update,Invoke}-AzConnectedMachineRunCommand` and `{Set,Invoke}-AzVmRunCommand` cmdlets support using user-assigned managed identities to retrieve a script from Azure Storage via the `-ScriptUriManagedIdentityClientId` and `-ScriptUriManagedIdentityObjectId` parameters. It does not appear there is a way to use a system-assigned managed identity via these parameters.
The support for user-assigned managed identities in the ConnectedMachine cmdlets is great, except for one small problem: as far as I can tell, Arc servers still don't support user-assigned managed identities. So this feature is currently useless for those cmdlets.
The underlying VM and Arc RunCommand REST APIs supposedly supports system-assigned managed identities via the JSON payload:
```json
{
"location": "West US 2",
"properties": {
"source": {
"scriptUri": "...",
"scriptUriManagedIdentity": {}
}
}
}
```
> `scriptUriManagedIdentity`: User-assigned managed identity that has access to scriptUri in case of Azure storage blob. Use an empty object in case of system-assigned identity.
https://learn.microsoft.com/en-us/rest/api/hybridcompute/machine-run-commands/create-or-update?view=rest-hybridcompute-2025-01-13&tabs=HTTP#machineruncommandscriptsource
However, when I try this via the `-JsonString` parameter, I receive "The request does not have sufficient information to complete the operation. Missing or invalid properties: ScriptUriManagedIdentity is not valid: Exactly one property should be populated between CientId and ObjectId.."
### Proposed implementation details (optional)
It would be nice if we had a `-ScriptUriManagedIdentity` switch to simplify this.
Contributor guide
Assessment
This issue has not been assessed yet.