Switch Terraform backend to use storage account keys instead of Azure AD authentication

.github/workflows/deploy-infrastructure.yml

@@ -52,7 +52,6 @@ jobs:
         working-directory: ${{ env.WORKING_DIR }}
         env:
           ARM_USE_OIDC: true
-          ARM_USE_AZUREAD_AUTH: true
           ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
           ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
@@ -62,15 +61,14 @@ jobs:
           storage_account_name = "${{ secrets.TF_STATE_STORAGE_ACCOUNT }}"
           container_name       = "${{ secrets.TF_STATE_CONTAINER }}"
           key                  = "terraform.tfstate"
-          use_azuread_auth     = true
+          access_key           = "${{ secrets.TF_STATE_STORAGE_ACCESS_KEY }}"
           EOF
           terraform init -backend-config=backend.hcl
 
       - name: Terraform Validate
         working-directory: ${{ env.WORKING_DIR }}
         env:
           ARM_USE_OIDC: true
-          ARM_USE_AZUREAD_AUTH: true
           ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
           ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
@@ -80,7 +78,6 @@ jobs:
         working-directory: ${{ env.WORKING_DIR }}
         env:
           ARM_USE_OIDC: true
-          ARM_USE_AZUREAD_AUTH: true
           ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
           ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
@@ -98,7 +95,6 @@ jobs:
         working-directory: ${{ env.WORKING_DIR }}
         env:
           ARM_USE_OIDC: true
-          ARM_USE_AZUREAD_AUTH: true
           ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
           ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
@@ -109,7 +105,6 @@ jobs:
         working-directory: ${{ env.WORKING_DIR }}
         env:
           ARM_USE_OIDC: true
-          ARM_USE_AZUREAD_AUTH: true
           ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
           ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
@@ -126,7 +121,6 @@ jobs:
         working-directory: ${{ env.WORKING_DIR }}
         env:
           ARM_USE_OIDC: true
-          ARM_USE_AZUREAD_AUTH: true
           ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
           ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

infra/QUICKSTART.md

@@ -63,6 +63,10 @@ postgresql_admin_password = "PASTE_POSTGRES_PASSWORD_HERE"
 app_secret_key            = "PASTE_SECRET_KEY_HERE"
 github_repository         = "YOUR_USERNAME/ml-recommender"  # Change this!
 github_branch             = "main"
+
+# Optional: These are no longer required since we use storage account keys
+# tf_state_resource_group  = "rg-mlshop-tfstate"
+# tf_state_storage_account = "mlshoptfstate"
 ```
 
 ### 5. Deploy Infrastructure (5-10 minutes)
@@ -206,6 +210,7 @@ Add these secrets:
 - `TF_STATE_RESOURCE_GROUP`: `rg-mlshop-tfstate`
 - `TF_STATE_STORAGE_ACCOUNT`: `mlshoptfstate`
 - `TF_STATE_CONTAINER`: `tfstate`
+- `TF_STATE_STORAGE_ACCESS_KEY`: Get with `az storage account keys list --resource-group rg-mlshop-tfstate --account-name mlshoptfstate --query '[0].value' -o tsv`
 - `POSTGRESQL_ADMIN_PASSWORD`: (your PostgreSQL password)
 - `APP_SECRET_KEY`: (your Flask secret key)
 

infra/README.md

@@ -94,6 +94,10 @@ postgresql_admin_password = "YourSecurePassword123!"
 app_secret_key            = "YourSecretKey"
 github_repository         = "your-username/ml-recommender"
 github_branch             = "main"
+
+# Optional: These are no longer required since we use storage account keys
+# tf_state_resource_group  = "rg-mlshop-tfstate"
+# tf_state_storage_account = "mlshoptfstate"
 ```
 
 **Important**: Generate secure random values for passwords and secrets:
@@ -194,6 +198,7 @@ Add these secrets to your GitHub repository (Settings → Secrets and variables
 - `TF_STATE_RESOURCE_GROUP`: `rg-mlshop-tfstate`
 - `TF_STATE_STORAGE_ACCOUNT`: `mlshoptfstate`
 - `TF_STATE_CONTAINER`: `tfstate`
+- `TF_STATE_STORAGE_ACCESS_KEY`: Storage account access key (get with `az storage account keys list --resource-group rg-mlshop-tfstate --account-name mlshoptfstate --query '[0].value' -o tsv`)
 - `POSTGRESQL_ADMIN_PASSWORD`: Your PostgreSQL password
 - `APP_SECRET_KEY`: Your Flask secret key
 

infra/scripts/init-terraform-state.sh

@@ -96,24 +96,16 @@ echo "resource_group_name  = \"$RESOURCE_GROUP_NAME\""
 echo "storage_account_name = \"$STORAGE_ACCOUNT_NAME\""
 echo "container_name       = \"$CONTAINER_NAME\""
 echo "key                  = \"terraform.tfstate\""
-echo "use_azuread_auth     = true"
 echo ""
 echo "Then initialize Terraform with:"
 echo "  terraform init -backend-config=backend.hcl"
 echo ""
-echo "NOTE: For GitHub Actions with OIDC authentication, the service principal"
-echo "needs 'Storage Blob Data Contributor' role on the storage account."
-echo "After creating the GitHub Actions service principal via Terraform,"
-echo "grant access with:"
+echo "NOTE: For GitHub Actions, you'll need to add the storage account access key as a secret:"
 echo ""
-echo "  STORAGE_ACCOUNT_ID=\$(az storage account show \\"
-echo "    --name $STORAGE_ACCOUNT_NAME \\"
+echo "  # Get the storage account access key"
+echo "  az storage account keys list \\"
 echo "    --resource-group $RESOURCE_GROUP_NAME \\"
-echo "    --query id -o tsv)"
-echo "  GITHUB_ACTIONS_SP_ID=\$(az ad sp list \\"
-echo "    --display-name 'mlshop-github-actions-prod' \\"
-echo "    --query '[0].id' -o tsv)"
-echo "  az role assignment create \\"
-echo "    --assignee \"\$GITHUB_ACTIONS_SP_ID\" \\"
-echo "    --role 'Storage Blob Data Contributor' \\"
-echo "    --scope \"\$STORAGE_ACCOUNT_ID\""
+echo "    --account-name $STORAGE_ACCOUNT_NAME \\"
+echo "    --query '[0].value' -o tsv"
+echo ""
+echo "  # Add this key to GitHub as secret: TF_STATE_STORAGE_ACCESS_KEY"

infra/terraform/backend.hcl.example

@@ -6,4 +6,3 @@ resource_group_name  = "rg-mlshop-tfstate"
 storage_account_name = "mlshoptfstate"
 container_name       = "tfstate"
 key                  = "terraform.tfstate"
-use_azuread_auth     = true  # Use Azure AD auth instead of storage account keys

infra/terraform/terraform.tfvars.example

@@ -19,8 +19,9 @@ app_secret_key            = "CHANGE_ME_generate_random_secret_key"
 github_repository = "aluczak/ml-recommender"
 github_branch     = "main"
 
-# Terraform state storage (optional, for granting GitHub Actions access)
-# Leave empty if you don't want to grant GitHub Actions access to state storage
+# Terraform state storage (optional, no longer required since we use storage account keys)
+# These values are used to grant the GitHub Actions service principal access to the storage account
+# However, we now use storage account keys instead, so these are optional
 # tf_state_resource_group  = "rg-mlshop-tfstate"
 # tf_state_storage_account = "mlshoptfstate"
 

infra/terraform/variables.tf

@@ -62,13 +62,13 @@ variable "tags" {
 }
 
 variable "tf_state_resource_group" {
-  description = "Resource group name for Terraform state storage (optional, for granting GitHub Actions access)"
+  description = "Resource group name for Terraform state storage (optional, only used if granting GitHub Actions SP access to storage)"
   type        = string
   default     = ""
 }
 
 variable "tf_state_storage_account" {
-  description = "Storage account name for Terraform state (optional, for granting GitHub Actions access)"
+  description = "Storage account name for Terraform state (optional, only used if granting GitHub Actions SP access to storage)"
   type        = string
   default     = ""
 }