Using azcopy in GitHub actions with federated credentials

locals {
  org        = "your-github-org" # replace-me
  repository = "your-repository-name" # replace-me
}

resource "azurerm_resource_group" "example" {
  name     = "example"
  location = "West Europe"
}

resource "azurerm_user_assigned_identity" "example" {
  location            = azurerm_resource_group.example.location
  name                = "example"
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_federated_identity_credential" "example" {
  name                = "${local.repository}-main"
  resource_group_name = azurerm_resource_group.example.name
  audience            = ["api://AzureADTokenExchange"]
  
  # this is the default issuer, enterprise customers may customise it
  # see https://docs.github.com/en/enterprise-cloud@latest/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-issuer-value-for-an-enterprise
  issuer              = "https://token.actions.githubusercontent.com"
  
  parent_id           = azurerm_user_assigned_identity.example.id
  subject             = "repo:${local.org}/${local.repository}:ref:refs/heads/main"
}

resource "azurerm_storage_account" "example" {
  name                     = "storageaccountname"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

resource "azurerm_storage_container" "example" {
  name                  = "example"
  storage_account_name  = azurerm_storage_account.example.name
  container_access_type = "private"
}

resource "azurerm_role_assignment" "example" {
  principal_id = azurerm_user_assigned_identity.example.principal_id
  scope        = azurerm_storage_account.example.id

  role_definition_name = "Storage Blob Data Contributor"
}

az group create --name example --location westus

PRINCIPAL_ID=$(az identity create \
  --name example \
  --resource-group example \
  --query principalId \
  -o tsv)

ORG="your-github-org" # replace-me
REPO="your-github-repo" # replace-me
export AZURE_STORAGE_ACCOUNT="replace-me"

az identity federated-credential create \
  --name "${REPO}-main" \
  --identity-name example \
  --resource-group example \
  --issuer "https://token.actions.githubusercontent.com" \
  --subject "repo:$ORG/$REPO:ref:refs/heads/main" \
  --audiences myAudiences

ID=$(az storage account create \
  --resource-group example \
  --name ${AZURE_STORAGE_ACCOUNT} \
  --sku Standard_LRS \
  --kind StorageV2 \
  --query id \
  -o tsv)

az storage container create -n example

az role assignment create --assignee "${PRINCIPAL_ID}" \
--role "Storage Blob Data Contributor" \
--scope "${ID}"

name: Copy files
on:
  push:
    branches: ["main"]

permissions:
  id-token: write # Require write permission to Fetch an OIDC token.

jobs:
  copy:
    runs-on: ubuntu-latest
    steps:
      # Login to Azure using federated credential
      # No secret is required due to OIDC authentication
      - name: Azure CLI Login
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - name: Install azcopy
        run: |
          sudo apt-get update
          sudo apt-get install -y wget

          # when ubuntu-latest changes this needs updating from 22.04
          wget https://packages.microsoft.com/config/ubuntu/22.04/packages-microsoft-prod.deb
          sudo dpkg -i packages-microsoft-prod.deb
          sudo apt-get update
          sudo apt-get install -y azcopy
          rm -f packages-microsoft-prod.deb
      - name: Create file
        run: |
          echo "Hello, world!" > hello.txt
      - name: Copy file to Azure Blob Storage
        env:
          AZURE_STORAGE_ACCOUNT: your-storage-account-name
          AZURE_CONTAINER_NAME: example
          AZCOPY_AUTO_LOGIN_TYPE: AZCLI
          AZCOPY_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        run: |
          azcopy sync --compare-hash=md5 \
            --delete-destination=true \
            --include-pattern="*.txt"  \
            "." "https://$AZURE_STORAGE_ACCOUNT.blob.core.windows.net/$AZURE_CONTAINER_NAME/"