Security best practices: AKS example re-using existing AzureServicePrincipal rather than creating new one

[Aaronontheweb]

From a security perspective, in order to run a Pulumi script that creates an Azure AD service principal, which all of these Azure Kubernetes Service examples do, you have to grant the service principal that is actually running the Pulumi deployment ownership permission over the entire Azure subscription. Not ideal from a "least privilege" point of view.

I would love to see some examples around AKS that try to reduce the amount of permission the Pulumi script needs in order to run - perhaps have the SP that is running the script be the owner the resources created? Something along those lines would be great.

[0x53A]

There's also the AKS managed identity which eliminates the need for a manual service principal, though I'm not sure which permissions you need for that: https://docs.microsoft.com/en-us/azure/aks/use-managed-identity