Azure DevOps Pipeline: Use TerraformTask with Workload Identity federation / OIDC

azure-pipeline.yaml

trigger:
- main

pool:
  vmImage: ubuntu-latest

variables: 
- name: workingDirectory
  value: '<folder containing terraform code>'

stages:
- stage: validate
  displayName: 'Validate'
  jobs:
    - job: Validate
      steps:
      - checkout: self
        clean: true

      - task: TerraformInstaller@1
        displayName: 'Install Terraform'
        inputs:
          terraformVersion: 'latest'

      - task: TerraformTaskV4@4
        displayName: 'terraform init'
        inputs:
          provider: 'azurerm'
          command: 'init'
          workingDirectory: '$(workingDirectory)'
          backendServiceArm: '<service connection>'
          backendAzureRmResourceGroupName: '<resource group name>'
          backendAzureRmStorageAccountName: '<storage account name>'
          backendAzureRmContainerName: '<container name>'
          backendAzureRmKey: '<state file name>'
        env:
          ARM_USE_AZUREAD: true
      
      - task: TerraformTaskV4@4
        displayName: 'terraform validate'
        inputs:
          provider: 'azurerm'
          command: 'validate'
          workingDirectory: '$(workingDirectory)'
      
      - task: TerraformTaskV4@4
        displayName: 'terraform plan'
        inputs:
          provider: 'azurerm'
          command: 'plan'
          workingDirectory: '$(workingDirectory)'
          environmentServiceNameAzureRM: '<service connection>'
        env:
          ARM_USE_AZUREAD: true

- stage: deploy
  displayName: 'Deploy'
  dependsOn:
  - validate
  jobs:
    - job: 'Deploy'
      steps:
      - checkout: self
        clean: true
      
      - task: TerraformInstaller@1
        displayName: 'Install Terraform'
        inputs:
          terraformVersion: 'latest'

      - task: TerraformTaskV4@4
        displayName: 'terraform init'
        inputs:
          provider: 'azurerm'
          command: 'init'
          workingDirectory: '$(workingDirectory)'
          backendServiceArm: '<service connection>'
          backendAzureRmResourceGroupName: '<resource group name>'
          backendAzureRmStorageAccountName: '<storage account name>'
          backendAzureRmContainerName: '<container name>'
          backendAzureRmKey: '<state file name>'
        env:
          ARM_USE_AZUREAD: true

      - task: TerraformTaskV4@4
        displayName: 'terraform apply'
        inputs:
          provider: 'azurerm'
          command: 'apply'
          workingDirectory: '$(workingDirectory)'
          commandOptions: 'demo.tfplan'
          environmentServiceNameAzureRM: '<service connection>'
        env:
          ARM_USE_AZUREAD: true