feat(DTOSS-13037): automate app role assignment for Arc machine managed identities

Adds azuread_app_role_assignment per discovered Arc machine so each
gateway's system-assigned MI is granted the Gateway.Access app role on
spn-manbrs-web-api-<env> automatically on terraform apply.

Author: josielsouzanordcloud

infrastructure/modules/arc-infra/app_roles.tf

@@ -0,0 +1,15 @@
+# Look up the web API enterprise app that the gateway MIs need to access.
+data "azuread_service_principal" "enterprise_app" {
+  count        = var.enable_arc_servers ? 1 : 0
+  display_name = "spn-manbrs-web-api-${var.env_config}"
+}
+
+# Assign the configured app role to each discovered Arc machine's managed identity.
+# Static machines are excluded — their MIs are not visible until the next apply after onboarding.
+resource "azuread_app_role_assignment" "managed_identity" {
+  for_each = local.arc_machines_discovered
+
+  app_role_id         = data.azuread_service_principal.enterprise_app[0].app_role_ids[var.enterprise_app_role_value]
+  principal_object_id = data.azurerm_arc_machine.machines[each.key].identity[0].principal_id
+  resource_object_id  = data.azuread_service_principal.enterprise_app[0].object_id
+}

infrastructure/modules/arc-infra/variables.tf

@@ -28,3 +28,9 @@ variable "static_arc_machine_names" {
   type        = list(string)
   default     = []
 }
+
+variable "enterprise_app_role_value" {
+  description = "App role name to assign to each Arc machine's managed identity on the web API enterprise app (spn-manbrs-web-api-<env>). Leave empty to skip assignment."
+  type        = string
+  default     = ""
+}

infrastructure/terraform/main.tf

@@ -9,8 +9,9 @@ module "arc_infra" {
   region              = local.region
   app_short_name      = var.app_short_name
   env_config          = var.env_config
-  resource_group_name = local.resource_group_name
-  enable_arc_servers  = var.enable_arc_servers
+  resource_group_name       = local.resource_group_name
+  enable_arc_servers        = var.enable_arc_servers
+  enterprise_app_role_value = var.enterprise_app_role_value
 
   # Create the HC for the test VM in the same run as VM creation.
   # The Arc data source won't see a machine registered in the same apply.

infrastructure/terraform/variables.tf

@@ -50,6 +50,12 @@ variable "gateway_test_vm_size" {
   default     = "Standard_B2s"
 }
 
+variable "enterprise_app_role_value" {
+  description = "App role name to assign to each Arc machine's managed identity on the web API enterprise app (spn-manbrs-web-api-<env>). Leave empty to skip assignment."
+  type        = string
+  default     = "Gateway.Access"
+}
+
 locals {
   region              = "uksouth"
   resource_group_name = "rg-${var.app_short_name}-${var.environment}-uks"