This pull request primarily focuses on simplifying and enhancing the security of the Azure scripts in the azure_jumpstart_arcbox/artifacts directory. The changes involve removing the need to pass the tenant ID during Azure CLI login, replacing the use of Azure Service Principal with Managed Identity for Azure account connection, and updating the role definition ID for the Key Vault Certificates Officer in the clientVm.bicep file.
azure_jumpstart_arcbox/artifacts/ArcServersLogonScript.ps1: Added variables for tenant ID, subscription ID, and resource group to the script block in the ForEach-Object loop. This allows the script to use these variables when connecting to the Azure account.
azure_jumpstart_arcbox/artifacts/Bootstrap.ps1: Replaced the environment variable $env:resourceGroup with $resourceGroup when getting the Key Vault. This ensures the correct resource group is used when connecting to the Azure account.
azure_jumpstart_arcbox/artifacts/Bootstrap.ps1: Replaced the test secrets with actual secrets when setting the secrets in the Key Vault. This enhances security by ensuring that real secrets are stored in the Key Vault.
azure_jumpstart_arcbox/artifacts/tests/common.tests.ps1 and azure_jumpstart_arcbox/artifacts/tests/itpro.tests.ps1: Replaced the use of Azure Service Principal with Managed Identity when connecting to the Azure account. This enhances security by leveraging Azure's identity management capabilities. [1][2]
This pull request primarily focuses on simplifying and enhancing the security of the Azure scripts in the
azure_jumpstart_arcbox/artifactsdirectory. The changes involve removing the need to pass the tenant ID during Azure CLI login, replacing the use of Azure Service Principal with Managed Identity for Azure account connection, and updating the role definition ID for the Key Vault Certificates Officer in theclientVm.bicepfile.Azure CLI Login:
azure_jumpstart_arcbox/artifacts/ArcServersLogonScript.ps1: Removed the need to pass the tenant ID during Azure CLI login. This simplifies the login process and enhances security by reducing the need to handle sensitive data.Azure Account Connection:
azure_jumpstart_arcbox/artifacts/ArcServersLogonScript.ps1: Added variables for tenant ID, subscription ID, and resource group to the script block in theForEach-Objectloop. This allows the script to use these variables when connecting to the Azure account.azure_jumpstart_arcbox/artifacts/Bootstrap.ps1: Replaced the environment variable$env:resourceGroupwith$resourceGroupwhen getting the Key Vault. This ensures the correct resource group is used when connecting to the Azure account.azure_jumpstart_arcbox/artifacts/Bootstrap.ps1: Replaced the test secrets with actual secrets when setting the secrets in the Key Vault. This enhances security by ensuring that real secrets are stored in the Key Vault.azure_jumpstart_arcbox/artifacts/tests/common.tests.ps1andazure_jumpstart_arcbox/artifacts/tests/itpro.tests.ps1: Replaced the use of Azure Service Principal with Managed Identity when connecting to the Azure account. This enhances security by leveraging Azure's identity management capabilities. [1] [2]Role Definition ID Update:
azure_jumpstart_arcbox/bicep/clientVm/clientVm.bicep: Updated the role definition ID for the Key Vault Certificates Officer. This ensures the correct role is assigned to the principal.