hashicorp / hashicorp/packer-plugin-azure

azure-arm builder does not allow subscription_id selection when using managed identity authentication

Open
#29 0 comments 0 reactions 0 assignees View on GitHub
bug builder/azure
Dominant language
Go
Stars
63
Forks
103
PR merge metrics
No merged PRs in 30d

Description

_This issue was originally opened by @dougbw as hashicorp/packer#9140. It was migrated here as a result of the [Packer plugin split](https://github.com/hashicorp/packer/issues/8610#issuecomment-770034737). The original body of the issue is below._


#### Overview of the Issue

Currently it is impossible to specify a subscription_id when using managed identity authentication, as when **only** subscription_id is provided packer assumes an interactive login is desired.

In our case we need the base images to be stored in a different subscription to on running our CI/CD pipeline build agents. A single managed identity can have access to many Azure subscriptions.

#### Reproduction Steps

- Create a user assigned managed identity
- Grant the identity Azure RBAC permissions to multiple subscriptions
- Assign the managed identity to a vm
- On the vm execute `az login --identity` and you should see output for multiple subscriptions
- Provide a subscription_id to the azure-arm builder in packer and you will be stuck on an interactive login

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.