ExAzureCore.Auth.ManagedIdentity.ImdsProvider (ex_azure_core v0.2.0)

IMDS (Instance Metadata Service) provider for Azure Managed Identity.

Fetches tokens from the Azure IMDS endpoint for VMs, AKS pods (legacy pod identity), Container Instances, and other Azure compute resources.

IMDS Details

Endpoint: http://169.254.169.254/metadata/identity/oauth2/token Required headers: Metadata: true API Version: 2019-08-01

Summary

Types

config()

Functions

fetch_token(config)

Fetches an access token from Azure IMDS.

Types

config()

@type config() :: %{
  :resource => String.t(),
  optional(:client_id) => String.t(),
  optional(:object_id) => String.t(),
  optional(:mi_res_id) => String.t(),
  optional(:timeout) => non_neg_integer()
}

Functions

fetch_token(config)

@spec fetch_token(config()) :: {:ok, map()} | {:error, term()}

Fetches an access token from Azure IMDS.

Configuration

:resource (required) - The Azure resource URI (e.g., "https://management.azure.com/")
:client_id (optional) - Client ID for user-assigned managed identity
:object_id (optional) - Object ID for user-assigned managed identity
:mi_res_id (optional) - Resource ID for user-assigned managed identity
:timeout (optional) - Request timeout in milliseconds (default: 5000)

Examples

# System-assigned identity
{:ok, token} = ImdsProvider.fetch_token(%{resource: "https://management.azure.com/"})

# User-assigned identity
{:ok, token} = ImdsProvider.fetch_token(%{
  resource: "https://vault.azure.net/",
  client_id: "user-assigned-client-id"
})