Utilising Service Connection in CLI tasks? - azure-devops

Question

How does Azure Devops expose the service connection details when running CLI tasks such as BASH or Azure CLI?
Lets say I have a tool such as Packer or Terraform and I want to run tasks authenticated against azure using the service connection.
Is there some file somewhere with the clientid + secret that I can read and use? Or some system variable?
Or do I need to follow some kind of managed identity authentication flow?
I know that I can feed those details in myself via variables but I'm trying to avoid that, ideally I want a simple way just to utilise the already created service connection.

Answer 1

For YAML, I followed the answer below, and included addSpnToEnvironment: true.
- task: AzureCLI#2
displayName: INIT
inputs:
azureSubscription: $(azureSubscription)
scriptType: bash
addSpnToEnvironment: true
scriptLocation: inlineScript
inlineScript: |
az --version
az account show
export ARM_CLIENT_ID=$servicePrincipalId
export ARM_CLIENT_SECRET=$servicePrincipalKey
export ARM_SUBSCRIPTION_ID=`az account show -o json | jq .id | tr -d '"'`
export ARM_TENANT_ID=$tenantId
terraform init
https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/deploy/azure-cli?view=azure-devops

Answer 2

Ok i can't believe I just found this. Not sure how new this option is but... if you check the Azure CLI marketplace task and look at the advanced options you will see this:
So for example to use this with Terraform you can do the following:
export ARM_CLIENT_ID=$servicePrincipalId
export ARM_CLIENT_SECRET=$servicePrincipalKey
export ARM_SUBSCRIPTION_ID=`az account show -o json | jq .id`
export ARM_TENANT_ID=`az account show -o json | jq .tenantId`