This repository contains a demo of using GitHub Actions with Federated/ODIC Authentication to pull a secret from Azure Key Vault.

The GitHub Action authenticates to Azure as a service principal; however, instead of managing secrets in GitHub, this implements Federated Authentication with OIDC.

Documentation:

• Configuring OpenID Connect in Azure - GitHub Docs
• Authenticate to Azure from GitHub Action workflows | Microsoft Learn

1. Fork this repository
2. Configure Azure infrastructure (see: Infrastructure Configuration)
   • Service Principal
   • Key Vault
   • Role assignment
3. Set up GitHub secrets for Actions (see: GitHub Configuration)
4. Execute Action

The Action runs manully from the Actions tab in this repository.

The Action steps are defined in get-azure-secrets.yml.

1. Azure Login: Logs into Azure CLI with Federated Credentials (OIDC). This eliminates the need to manage a client ID and secret.
2. Get Secrets: This will fetch additional secrets from Azure Key Vault, using the identity from the Login step.
3. Show Secrets: This will output the secrets from the Get Secrets step, showing that the secret2 value is masked.

The log will show a result, one of a plaintext secret1 value and the other of a masked secret2 value:

secret1: value1
secret2: ***

If you wish to fork and run this demo in your environment, you will need to provision a Key Vault in Azure and grant the service principal used in Actions the Key Vault Secrets User role or assign the appropriate legacy Key Vault access policy.

Documentation:

• Grant permission to applications to access an Azure key vault using Azure RBAC | Microsoft Learn

You can reference or use the deploy.sh script in this repository to assist with setting up a demo environment.

GitHub Actions will also expect the following secrets to be configured in the repository:

• AZURE_TENANT_ID: The tenant ID for your Azure environment
• AZURE_CLIENT_ID: Your Azure service principal client ID
• AZURE_SUBSCRIPTION_ID: Your Azure subscription ID
• AZURE_KEY_VAULT_NAME: The name of the Azure Key Vault