Auto-auth method: Azure

The azure method reads in Azure instance credentials and uses them to authenticate with the Azure Auth method. It reads most parameters needed for authentication directly from instance information based on the value of the resource parameter.

Configuration

• role (string: required) - The role to authenticate against on Vault

• authenticate_from_environment (boolean: false) - If set to true, will attempt to make an Azure identity object through Azure specific environment variables, in priority order and as specified in Azure documentation. Will work seamlessly with Azure Workload Identity and others.

• scope (string: optional) - The scope to use when obtaining a token. If not supplied, will default to the value used for resource appended with "/.default" appended as a suffix. For more information on scopes in Azure, see this document.

• resource (string: required) - The resource name to use when getting identity information.

• object_id (string: optional) - The object ID of the user-assigned managed identity to use when acquiring an access token. Only one of object_id or client_id may be provided.

• client_id (string: optional) - The client ID of the user-assigned managed identity to use when acquiring an access token. Only one of object_id or client_id may be provided.

Example configuration

Example client auto-auth configuration block for an Azure Workload Identity:

auto_auth {
  method {
    type = "azure"
    config = {
      authenticate_from_environment = true
      role = "dev-role"
      resource = "https://management.azure.com/"
    }
  }
}