OpenSec Atlas

Name: azure-devops-workload-identity-federation
Author: devopsshield

azure-devops-workload-identity-federation: An Open Source Script for Identity & Access Management (IAM) | OpenSec Atlas

Back to Browse

Identity & Access Management (IAM)

Script

azure-devops-workload-identity-federation

A PowerShell script tool to bulk update Azure DevOps ARM Service Connections from service principal authentication to the recommended workload identity federation method.

Visit Website View on GitHub

About This Tool

Azure DevOps Workload Identity Federation - Updating your Azure DevOps ARM Service Connections to use the recommended Workload Identity Federation

Primary Use Case

This tool is designed for Azure DevOps administrators and DevOps engineers who need to efficiently migrate multiple ARM Service Connections to use workload identity federation, eliminating the need to manage secrets and improving security. It automates the conversion process, saving time and reducing the risk of pipeline failures due to expired secrets.

Key Features

Bulk conversion of Azure DevOps ARM Service Connections to workload identity federation
Eliminates the need to manage and rotate secrets for service principals
Improves security by removing persistent secrets from pipeline authentication
Provides an inventory approach to identify all ARM Service Connections
Uses an undocumented Azure DevOps API PUT call for conversion
Supports integration with DevOps Shield for continuous inventory management
Includes a PowerShell script for automation

Insights & Recommendations

This tool relies on an undocumented Azure DevOps API endpoint, which may change without notice. Users should ensure they have appropriate permissions in Azure DevOps and test the script in a non-production environment before bulk applying changes. Using DevOps Shield for inventory management is recommended for continuous tracking of service connections.

Installation

Clone the repository or download the Convert-ServicePrincipals.ps1 script
Ensure you have PowerShell installed on your machine
Obtain an inventory of your Azure DevOps ARM Service Connections either manually or using DevOps Shield
Prepare necessary Azure DevOps organization and project details for the script

Usage

powershell ./scripts/Convert-ServicePrincipals.ps1

Executes the bulk conversion of ARM Service Connections from service principal authentication to workload identity federation.

Smart Usage Notes

Integrate this script into CI/CD pipeline security checks to automate secure authentication migration.Combine with continuous inventory tools like DevOps Shield to maintain real-time visibility of service connections.Use workload identity federation to reduce attack surface by eliminating persistent secrets in pipelines.Leverage this tool to enforce least privilege and scoped access in Azure DevOps environments.Develop custom alerts for any service connections not migrated to workload identity federation to ensure compliance.