Deploy Static Sites to Azure CDN with GitHub Actions OIDC¶

terraform {
  required_providers {
    azuread = {
      source  = "hashicorp/azuread"
      version = "< 4"
    }
  }

  required_version = "< 2"
}

variable "github_org" {
  type     = string
  nullable = false
}

variable "github_repo" {
  type     = string
  nullable = false
}

data "azuread_client_config" "current" {}

resource "azuread_application" "this" {
  display_name     = "github-oidc-${var.github_repo}"
  owners           = [data.azuread_client_config.current.object_id]
  sign_in_audience = "AzureADMyOrg"
}

resource "azuread_service_principal" "this" {
  client_id                    = azuread_application.this.client_id
  app_role_assignment_required = false
  owners                       = [data.azuread_client_config.current.object_id]
}

resource "azuread_application_federated_identity_credential" "this" {
  application_id = azuread_application.this.id
  display_name   = "github-actions-oidc"
  description    = "GitHub Actions OIDC for ${var.github_org}/${var.github_repo}"
  audiences      = ["api://AzureADTokenExchange"]
  issuer         = "https://token.actions.githubusercontent.com"
  subject        = "repo:${var.github_org}/${var.github_repo}:ref:refs/heads/main"
}

output "client_id" {
  value = azuread_application.this.client_id
}

output "service_principal_guid" {
  value = azuread_service_principal.this.object_id
}

output "tenant_id" {
  value = data.azuread_client_config.current.tenant_id
}

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "< 5"
    }
    random = {
      source  = "hashicorp/random"
      version = "< 4"
    }
  }

  required_version = "< 2"
}

variable "service_principal_guid" {
  type     = string
  nullable = false
}

data "azurerm_client_config" "current" {}

resource "random_pet" "this" {
  for_each = toset([
    "storage_account",
    "cdn_profile",
    "cdn_endpoint",
  ])

  length = 3
}

resource "azurerm_resource_group" "this" {
  name     = "deploy-static-site-to-az"
  location = "Germany West Central"
}

resource "azurerm_storage_account" "this" {
  name                     = replace(random_pet.this["storage_account"].id, "-", "")
  resource_group_name      = azurerm_resource_group.this.name
  location                 = azurerm_resource_group.this.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
  account_kind             = "StorageV2"
}

resource "azurerm_storage_account_static_website" "this" {
  storage_account_id = azurerm_storage_account.this.id
  error_404_document = "index.html"
  index_document     = "index.html"
}

resource "azurerm_cdn_profile" "this" {
  name                = random_pet.this["cdn_profile"].id
  location            = "global"
  resource_group_name = azurerm_resource_group.this.name
  sku                 = "Standard_Microsoft"
}

resource "azurerm_cdn_endpoint" "this" {
  name                = random_pet.this["cdn_endpoint"].id
  profile_name        = azurerm_cdn_profile.this.name
  location            = "global"
  resource_group_name = azurerm_resource_group.this.name
  origin_host_header  = azurerm_storage_account.this.primary_web_host

  origin {
    name      = "azblob"
    host_name = azurerm_storage_account.this.primary_web_host
  }

  delivery_rule {
    name  = "EnforceHTTPS"
    order = 1

    request_scheme_condition {
      operator     = "Equal"
      match_values = ["HTTP"]
    }

    url_redirect_action {
      redirect_type = "PermanentRedirect"
      protocol      = "Https"
    }
  }
}

resource "azurerm_role_assignment" "blob_contributor" {
  scope                = azurerm_storage_account.this.id
  role_definition_name = "Storage Blob Data Contributor"
  principal_id         = var.service_principal_guid
}

resource "azurerm_role_assignment" "endpoint_contributor" {
  scope                = azurerm_cdn_endpoint.this.id
  role_definition_name = "CDN Endpoint Contributor"
  principal_id         = var.service_principal_guid
}

output "cdn_endpoint" {
  value = azurerm_cdn_endpoint.this.name
}

output "cdn_profile_name" {
  value = azurerm_cdn_profile.this.name
}

output "resource_group_name" {
  value = azurerm_resource_group.this.name
}

output "storage_account_name" {
  value = azurerm_storage_account.this.name
}

output "subscription_id" {
  value = data.azurerm_client_config.current.subscription_id
}

output "url" {
  value = format("https://%s", azurerm_cdn_endpoint.this.fqdn)
}

terraform {
  required_providers {
    github = {
      source  = "integrations/github"
      version = "< 7"
    }
  }

  required_version = "< 2"
}

variable "azure_client_id" {
  type     = string
  nullable = false
}

variable "azure_subscription_id" {
  type     = string
  nullable = false
}

variable "azure_tenant_id" {
  type     = string
  nullable = false
}

variable "cdn_endpoint" {
  type     = string
  nullable = false
}

variable "cdn_profile_name" {
  type     = string
  nullable = false
}

variable "github_repo" {
  type     = string
  nullable = false
}

variable "resource_group" {
  type     = string
  nullable = false
}

variable "storage_account_name" {
  type     = string
  nullable = false
}

data "github_repository" "this" {
  name = var.github_repo
}

resource "github_actions_secret" "this" {
  for_each = {
    AZURE_CLIENT_ID       = var.azure_client_id
    AZURE_SUBSCRIPTION_ID = var.azure_subscription_id
    AZURE_TENANT_ID       = var.azure_tenant_id
    CDN_ENDPOINT          = var.cdn_endpoint
    CDN_PROFILE_NAME      = var.cdn_profile_name
    RESOURCE_GROUP        = var.resource_group
    STORAGE_ACCOUNT_NAME  = var.storage_account_name
  }

  repository      = data.github_repository.this.name
  secret_name     = each.key
  plaintext_value = each.value
}

resource "github_repository_file" "ci" {
  repository          = data.github_repository.this.name
  branch              = "main"
  file                = ".github/workflows/ci.yml"
  content             = file("${path.module}/files/ci.yml")
  commit_message      = "chore(CI): add github workflow"
  commit_author       = "opentofu[bot]"
  commit_email        = "opentofu[bot]@users.noreply.github.com"
  overwrite_on_create = true

  depends_on = [
    github_actions_secret.this,
  ]
}