Change cost allocation / vulnerability scanner DB admin account with azure account

[sondresjolyst]

Azure SQL Database should have Microsoft Entra Only Authentication enabled
To disable local authentication methods and only allow Azure Active Directory authentication:

1. Find your Azure Sql server in the portal.
2. Navigate to Microsoft Entra ID in the left navigation pane.
3. Select "Set admin" if Microsoft Entra ID admin is not already set.
4. Check the "Support only Microsoft Entra ID authentication for this server" box and press "Save"

Vulnerability scanner

• Initial Vulnerability scanner module #1169
• Vulnerability scanner part2 #1172 Playground
• terraform config for Vulnerability Scanner in C2 + Prod #1173 C2 + Platform
• Use workload identity for sql server auth radix-vulnerability-scanner#39
• Use workload identity to access database and ACR radix-cost-allocation#114

[emirgens]

1. Create Managed Identity for each database when a database is created
2. Create SQL user for this MI
3. Add SQL user in dbo group of the server
4. Create federated credential for this MI for GitHub actions
5. Update GitHub action

[Richard87]

Vulnerability Scanner

• Create Managed Identity
• Create Federated credentials for Github Actions
• Optional Terraform
  • Create database
  • Create db credentials - store in key vaults
  • Use Azure Key Vault for radix-vulnerability-scanner-api radix integration
  • Use external secret for helm install?
  • Create private links
• optional kubernetes
  • create federated credentials for Azure Workload Identity

Cost