-
Type: Task
-
Resolution: Fixed
-
Priority: Major - P3
-
Affects Version/s: None
-
Component/s: None
-
None
-
Server Security
-
Fully Compatible
-
Security 2023-06-26, Security 2023-07-10, Security 2023-07-24, Security 2023-08-07, Security 2023-08-21, Security 2023-09-04, Security 2023-09-18, Security 2023-10-02, Security 2023-10-16, Security 2023-10-30
-
167
This ticket will create simple integration test for an Azure Managed Identity VM, where the OIDC access and refresh token are obtained via a local machine metadata URI (see https://wiki.corp.mongodb.com/display/~adam.rayner/Azure+POC+Notes#AzurePOCNotes-ServiceAccounts/ManagedIdentities/MachineFlows)
To achieve this, we will need to do some orchestration of Azure VMs from our evergreen instances running in AWS. A starting point for what this kind of thing looks like is the AWS IAM external auth jstests (https://github.com/10gen/mongo-enterprise-modules/tree/master/jstests/external_auth_aws): these use the AWS python API to construct a temporary container instance in AWS Fargate, deploy test code to this, run the tests on the remote container instance while getting access to a local machine-specific token, and then clean up this newly-created infrastructure.
We will want to essentially port this approach to Azure (and then GCP).