Merge branch 'main' into DTOSS_Remove_per-HC_SAS_listen_keys

Author: floormind

.gitleaksignore

@@ -109,9 +109,3 @@ feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_proces
 feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_processor.py:ipv4:131
 feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_processor.py:ipv4:150
 feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_processor.py:ipv4:174
-
-# Ignore the SCREENING_ENTRA_GROUP_ID
-infrastructure/environments/prod/variables.tfvars:generic-api-key:2
-infrastructure/environments/preprod/variables.tfvars:generic-api-key:2
-infrastructure/environments/dev/variables.tfvars:generic-api-key:2
-infrastructure/environments/review/variables.tfvars:generic-api-key:2

infrastructure/environments/dev/variables.tfvars

@@ -1,2 +1 @@
 enable_gateway_test_vm   = true
-screening_entra_group_id = "f20d9f9a-b1ac-4875-a5e1-f9dfc0307c34"

infrastructure/environments/preprod/variables.tfvars

@@ -1,2 +1 @@
 # All values use defaults: enable_gateway_test_vm = false, enable_arc_servers = true
-screening_entra_group_id = "ab8fd001-2722-4118-9659-3d4425db7894"

infrastructure/environments/prod/variables.tfvars

@@ -1,2 +1 @@
 # All values use defaults: enable_gateway_test_vm = false, enable_arc_servers = true
-screening_entra_group_id = "3b2b22b0-ac8e-4904-a94b-9010ff08698a"

infrastructure/environments/review/variables.tfvars

@@ -1,3 +1,3 @@
 enable_gateway_test_vm   = true
 screening_entra_group_id = "14f915c3-ef0a-471b-b9bf-31187d18f8b6"
-enable_relay_sas_keys    = false
+enable_relay_sas_keys    = false

infrastructure/modules/arc-infra/arc.tf

@@ -12,12 +12,11 @@ data "azuread_service_principal" "arc_onboarding" {
   display_name = "spn-azure-arc-onboarding-screening-${var.env_config}"
 }
 
-# Awaiting approval from Administrator team, a bit of push back with regards to giving Group.Read.All permission to the service principal, so for now we will use the group ID from the environment variable instead of looking it up by name.
 # Look up the Entra ID group that manages this environment
-# data "azuread_group" "screening" {
-#   count        = var.enable_arc_servers ? 1 : 0
-#   display_name = "screening_${var.app_short_name}_${var.env_config}"
-# }
+data "azuread_group" "screening" {
+  count        = var.enable_arc_servers ? 1 : 0
+  display_name = "screening_${var.app_short_name}_${var.env_config}"
+}
 
 # Assign "Azure Connected Machine Onboarding" role to allow Arc server enrollment
 module "arc_onboarding_role" {
@@ -38,8 +37,5 @@ module "arc_wac_admin_login_role" {
 
   scope                = data.azurerm_resource_group.arc_enabled_servers[0].id
   role_definition_name = "Windows Admin Center Administrator Login"
-  # Awaiting approval from Administrator team, a bit of push back with regards to giving Group.Read.All permission to the service principal, so for now we will use the group ID from the environment variable instead of looking it up by name.
-  # principal_id         = data.azuread_group.screening[0].object_id
-  principal_id = var.screening_entra_group_id
-
+  principal_id         = data.azuread_group.screening[0].object_id
 }

infrastructure/modules/arc-infra/variables.tf

@@ -37,4 +37,4 @@ variable "screening_entra_group_id" {
 variable "enable_relay_sas_keys" {
   description = "Whether to create relay SAS keys for the Arc machines. Only used in the review environment."
   type        = bool
-}
+}

infrastructure/terraform/variables.tf

@@ -44,11 +44,6 @@ variable "bastion_sku" {
   default     = "Standard"
 }
 
-variable "screening_entra_group_id" {
-  description = "Group ID for the environment"
-  type        = string
-}
-
 variable "gateway_test_vm_size" {
   description = "SKU size for the gateway test VM"
   type        = string