IaC Bazaar
AzureLive-tested

User-Assigned Managed Identities

A map-driven module creating one or many user-assigned managed identities, each with optional workload identity federation (OIDC) and least-privilege RBAC role assignments - no secrets to rotate.

terraformAzure#azure

Part of: Azure Production Landing Zone

azure-managed-identityterraform v1.7

Verification

Live-tested

Really deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.

Conformance

  • Static validation (fmt · validate · tflint)
  • Security scan clean (Checkov)
  • Plan test superseded by live test

Provenance

Functional

  • Live-tested - applied, verified, destroyed

Last verified 2026-06-30 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o azure-managed-identity-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/azure-managed-identity/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle azure-managed-identity-1.0.0.sigstore.json \
  azure-managed-identity-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "3f71ed475d592224f2c14d3033a5e9783b9bd5dd75c80a61896850bcd078db2b  azure-managed-identity-1.0.0.tar.gz" | sha256sum -c
Signature bundlePublic keyMachine-readable receiptHow we verify

Use it from the registry

terraform · opentofu
module "managed_identity" {
  source  = "www.iac-bazaar.com/iac-bazaar/azure-managed-identity/azure"
  version = "1.0.0"
}

Paid module — needs a purchase (or a subscription that covers it) plus a registry token from /account/tokens. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract — every input name, type, default and description, plus every output — is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every Free module. This one is Basic, so its contract unlocks when you buy it.

Create a free account →Sign in

Documentation

azure-managed-identity

Create one or many user-assigned managed identities (a map-driven module), each with optional workload identity federation (OIDC) and least-privilege RBAC role assignments. A managed identity is the secret-free way to give an app, VM, AKS workload or CI pipeline an Entra ID principal: no client secret to store or rotate. Consumes an existing resource group. Works with Terraform and OpenTofu (>= 1.6), azurerm provider >= 4.0, < 5.0. Creating identities is free.

Security notes

  • No secrets. A user-assigned managed identity has no password. Prefer federated credentials over app-registration client secrets for any external workload (GitHub Actions, GitLab, Kubernetes service accounts, other clouds) so there is nothing long-lived to leak.
  • Federated credential subject is the trust boundary. Scope it tightly (e.g. a specific repo + branch/environment, or a specific Kubernetes namespace
    • service account) — a loose subject lets unintended workloads mint tokens.
  • Least-privilege RBAC. Grant the narrowest role at the narrowest scope that works (resource over resource group over subscription). Role assignments set principal_type = "ServicePrincipal" and skip_service_principal_aad_check = true so an assignment created in the same apply as the identity does not race Entra ID replication.
  • Lifecycle. Identity name, resource group and location are immutable — changing any of them replaces the identity (and breaks anything that still references its principal/client id).

Requirements

RequirementVersion
Terraform / OpenTofu>= 1.6
hashicorp/azurerm>= 4.0, < 5.0

The Microsoft.ManagedIdentity resource provider must be registered on the subscription (and Microsoft.Authorization if you use role_assignments).

License

Commercial — IaC Bazaar EULA. © IaC Bazaar. Original work (not derived from a third-party module).

Usage code & full reference unlock after purchase

The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.

  • Usage
  • Inputs
  • Outputs

Related modules

Azure✓ live-tested

Azure Bastion + Hardened Jumpbox

Bastion (Developer/Basic/Standard SKU) with optional hardened Linux VM, JIT-style NSG rules and boot diagnostics for secure VM access without public IPs.

$29.00v1.0.0
Azure✓ live-tested

Entra ID Workload Identity Baseline

App registrations, service principals, groups and federated credentials (OIDC for GitHub/Terraform) - the identity plumbing every Azure org rebuilds by hand.

$29.00v1.0.0