Module-managedIdentity.bicep

targetScope = 'resourceGroup'

@description('Name of the user-assigned managed identity.')
param managedIdentityName string

@description('Optional flag to lock the managed identity from deletion. Lock created only with federated credential.')
param managedIdentityLockDelete bool = true

@description('Optional federated credential name. Leave empty to skip creation.')
param federatedCredentialName string = ''

@description('Optional federated credential token issuer URL.')
param federatedCredentialIssuer string = ''

@description('Optional federated credential subject claim.')
param federatedCredentialSubject string = ''

@description('Optional federated credential audiences. Defaults to api://AzureADTokenExchange.')
param federatedCredentialAudiences string[] = []

var shouldCreateFederatedCredential = !empty(federatedCredentialName) && !empty(federatedCredentialIssuer) && !empty(federatedCredentialSubject)
var resolvedAudiences = length(federatedCredentialAudiences) > 0 ? federatedCredentialAudiences : ['api://AzureADTokenExchange']

resource devOpsIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2024-11-30' = {
  name: managedIdentityName
  location: resourceGroup().location
}

resource devOpsFederatedCredential 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials@2024-11-30' = if (shouldCreateFederatedCredential) {
  name: federatedCredentialName
  parent: devOpsIdentity
  properties: {
    issuer: federatedCredentialIssuer
    subject: federatedCredentialSubject
    audiences: resolvedAudiences
  }
}

resource devOpsIdentityLock 'Microsoft.Authorization/locks@2020-05-01' = if (managedIdentityLockDelete && shouldCreateFederatedCredential) {
  name: 'used by DevOps'
  scope: devOpsIdentity
  properties: {
    level: 'CanNotDelete'
    notes: 'Managed identity lock for federated credential: ${federatedCredentialName}'
  }
}

output resourceId string = devOpsIdentity.id
output clientId string = devOpsIdentity.properties.clientId
output principalId string = devOpsIdentity.properties.principalId
output federatedCredentialName string = shouldCreateFederatedCredential ? devOpsFederatedCredential.name : ''