Consuming Postgres Flexible Server from ACA with Managed Identity

[MirzaMerdovic]

Hello,

I would appreciate some help and/or answer regarding my conundrum, as I am not certain anymore if what I want to do is even possible.

Here is my setup:

• I have a Postgres Flexible server with enable MS Entra authentication.
• I have an ACA instance that needs to consume the PG database and I want that to go via managed identity.
• ACA instance is running a Golang app (docker image based on scratch) and it has managed identity enabled.
• I have created a used in Postgres for the ACA instance's managed identity (followed the tutorial here)

Below is the source code that initiates az credentials:

// clientId is fetch from an environment variable AZURE_CLIENT_ID
// AZURE_TENANT_ID environment variable is also set
 credential, err := azidentity.NewManagedIdentityCredential(&azidentity.ManagedIdentityCredentialOptions{
    ID: azidentity.ClientID(clientId),
})
if err != nil {
    ...
}

token, err := credential.GetToken(s.ctx, policy.TokenRequestOptions{
   Scopes: []string{"https://ossrdbms-aad.database.windows.net/.default"},
})
if err != nil {
    ...
}

Once deployed GetToken function throws an error:

"No User Assigned or Delegated Managed Identity found for specified ClientId/ResourceId/PrincipalId."

[MirzaMerdovic]

I figured out what my issue is and this old issue in Azure SDK helped me.
What I did is:

• Dropped the AZURE_CLIENT_ID environment variable
• Switched back to using Default Credentials credential, err := azidentity.NewDefaultAzureCredential(nil)

I realize that my question here was seeping into different areas ACA and AZURE SDK and auth, so if moderators feel that this shouldn't be here please feel free to delete this, otherwise if anyone needs more detail about the solution just comment