GHES, Terraform, Azure and GH Actions

So, we’ve got various terraform repos in an on-prem GHES that we use to deploy infra to Azure, all fairly recent, and up until now it’s a manual process of az login and running plans and applies ourselves.

One deploys a storage account, with a vnet, and links the vnet to a vwan hub in a different subscription, and creates private DNS in that same subscription. The TF works great.

Another one just deploys a VM.

The reason I mention both those examples, is just to emphasise the scope of access needed by a service principal, in some cases, wide and multi-sub, in others, very small. In some cases, and subscription is spun up alongside a deployment, so the SP would need rights higher than the per subscription level.

We need to start using service principals, and stop using az login, so we can use GitHub actions proper CI/CD.

What is the recommendation for authentication in this instance? App Registrations? UAMI? What works best in production?

This is all fairly new to me, so looking for any advice and it’s all appreciated.