Azure CI to BitBucket Deploy with Managed Identity

Question

Azure CI to BitBucket Deploy with Managed Identity

David V. Corbin 1

As the title says... Everything works when I use my identity... I log in, authenticate, setup tokens... all good.

But how to do this for a managed identity????

1 answer

Your answer

Answer 1

Ryan Hill 30,291 Microsoft Employee Moderator

Hi @David V. Corbin ,

You can create a service principal, with the least set of privileges, with the following the command and use the json output to your secrets in your BitBucket yaml script.

   az ad sp create-for-rbac --name "myAppDeployAuth" --role contributor \  
                               --scopes /subscriptions/<subscription-id>/resourceGroups/<group-name>/providers/Microsoft.Web/sites/<app-name> \  
                               --sdk-auth

---

EDIT: I came across https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/atlassian-cloud-tutorial and think this is what you're referring to. A system managed identity isn't going for work for this use case because only Azure services can use it. What I suggest is creating a user identity per the tutorial and assigning that user identity to you Azure resource. Another option you have is configuring a JWT token that your code running on Azure can use.

David V. Corbin 1 Reputation point

2021-11-02T14:58:38.627+00:00

Sorry, if I was not clear.... I am in an Azure environment.. I have code (e.g. a Logic Function) that is running under a managed Identity.... How do I get that managed identity accepted by bitbucket, so that the correct tokens are created for the existing managed identity... The goal is to push code to BitBucket while authenticated under the managed identity.
Ryan Hill 30,291 Reputation points Microsoft Employee Moderator

2021-11-03T03:37:37.12+00:00

Sorry @David V. Corbin , I'm still not clear on "pushing code from Azure into BitBucket". Can you provide further details on your use case? For instance, is the Logic App being used as a webhook to pull a repo and push it into BitBucket?
David V. Corbin 1 Reputation point

2021-11-03T10:10:19.667+00:00

Code running in Azure, could be a logic app, or a vm or anything, but it is running under a common existing Managed Identity. This code needs to manipulate a repository which exists in BitBucket. Therefore the managed identity needs the same end result as a interactive user would normally get [aka register with BitBucket, set the requisite permissions (usually requires a dialog box to confirm the permissions that are being given), set the appropriate "sourcecontrols" token [for the Managed Identity], so that it can seamlessly access BitBucket the exact same way a user identit y would.

No webhooks, nothing, just switching something from running under MY identity, to the same thing running under an Azure Managed Identity.
Ryan Hill 30,291 Reputation points Microsoft Employee Moderator

2021-11-03T15:43:47.4+00:00

Thanks for the clarification @David V. Corbin , I've updated my answer above.

Share via

Azure CI to BitBucket Deploy with Managed Identity

1 answer

Your answer