feat(resource-group-init): add screening group members as enterprise app SP owners

Fetches members of the screening_<appShortName>_<env> Entra ID group and
adds them as owners of spn-manbrs-web-api-<env> service principal via
Bicep Graph extension, alongside the pipeline managed identity.

Author: josielsouzanordcloud

infrastructure/terraform/resource_group_init/enterpriseAppOwner.bicep

@@ -2,10 +2,11 @@ extension microsoftGraphV1
 
 param miPrincipalId string
 param enterpriseAppClientId string
+param groupMemberIds array = []
 
 resource enterpriseAppSp 'Microsoft.Graph/servicePrincipals@v1.0' = {
   appId: enterpriseAppClientId
   owners: {
-    relationships: [miPrincipalId]
+    relationships: concat([miPrincipalId], groupMemberIds)
   }
 }

infrastructure/terraform/resource_group_init/main.bicep

@@ -8,6 +8,7 @@ param storageAccountName string
 param appShortName string
 param userGroupPrincipalID string
 param enterpriseAppClientId string
+param groupMemberIds array = []
 
 var hubMap = {
   dev:                  'dev'
@@ -214,6 +215,7 @@ module pipelineMiAppRole 'enterpriseAppOwner.bicep' = {
   params: {
     miPrincipalId: managedIdentiyADOtoAZ.outputs.miPrincipalID
     enterpriseAppClientId: enterpriseAppClientId
+    groupMemberIds: groupMemberIds
   }
 }
 

scripts/bash/resource_group_init.sh

@@ -22,6 +22,10 @@ fi
 
 echo "Found group Object ID: $userGroupPrincipalID"
 
+echo "Fetching members of group: $userGroupName"
+groupMemberIds=$(az ad group member list --group "$userGroupName" --query "[].id" -o json)
+echo "Found group members: $groupMemberIds"
+
 enterpriseAppName="spn-manbrs-web-api-${ENV_CONFIG}"
 echo "Fetching appId for enterprise app: $enterpriseAppName"
 enterpriseAppClientId=$(az ad sp list --filter "displayName eq '${enterpriseAppName}'" --query "[0].appId" -o tsv)
@@ -39,7 +43,7 @@ az deployment sub create --location "$REGION" --template-file infrastructure/ter
   --parameters enableSoftDelete="$ENABLE_SOFT_DELETE" envConfig="$ENV_CONFIG" region="$REGION" \
     storageAccountRGName="$STORAGE_ACCOUNT_RG" storageAccountName="$STORAGE_ACCOUNT_NAME" \
     appShortName="$APP_SHORT_NAME" userGroupPrincipalID="$userGroupPrincipalID" \
-    enterpriseAppClientId="$enterpriseAppClientId" --what-if
+    enterpriseAppClientId="$enterpriseAppClientId" groupMemberIds="$groupMemberIds" --what-if
 
 read -r -p "Are you sure you want to execute the deployment? (y/n): " confirm
 [[ "$confirm" != "y" ]] && exit 0
@@ -49,7 +53,7 @@ output=$(az deployment sub create --location "$REGION" --template-file infrastru
   --parameters enableSoftDelete="$ENABLE_SOFT_DELETE" envConfig="$ENV_CONFIG" region="$REGION" \
     storageAccountRGName="$STORAGE_ACCOUNT_RG" storageAccountName="$STORAGE_ACCOUNT_NAME" \
     appShortName="$APP_SHORT_NAME" userGroupPrincipalID="$userGroupPrincipalID" \
-    enterpriseAppClientId="$enterpriseAppClientId")
+    enterpriseAppClientId="$enterpriseAppClientId" groupMemberIds="$groupMemberIds")
 
 echo "$output"