feat(DTOSS-13037): replace Terraform automation with manual assignment process

Remove app_role.tf and related variables — AppRoleAssignment.ReadWrite.All
at directory level is unavailable to the pipeline identity, so the assignment
cannot be automated. Add a GitHub issue template to standardise the manual
request process when onboarding each new Arc-enabled machine.

Author: josielsouzanordcloud

.github/ISSUE_TEMPLATE/4_arc_machine_api_role_assignment.yaml

@@ -0,0 +1,112 @@
+name: 🔐 Arc Machine API Role Assignment
+description: Request Gateway.Access app role assignment for a newly onboarded Arc-enabled gateway machine
+labels: ['infrastructure', 'entra-id']
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Each Arc-enabled gateway machine has a system-assigned managed identity that must be granted
+        the `Gateway.Access` app role on `spn-manbrs-web-api-<env>` before it can authenticate to
+        the manbrs cloud API.
+
+        This assignment cannot be automated via Terraform as it requires `AppRoleAssignment.ReadWrite.All`
+        at directory level, which is not available to the pipeline identity. Raise this ticket each time
+        a new Arc machine is onboarded.
+
+  - type: dropdown
+    attributes:
+      label: Environment
+      options:
+        - review
+        - preprod
+        - prod
+    validations:
+      required: true
+
+  - type: input
+    attributes:
+      label: Arc machine name
+      description: The Arc resource name set during onboarding (e.g. `gw-RVJ-01`).
+      placeholder: gw-XXX-01
+    validations:
+      required: true
+
+  - type: input
+    attributes:
+      label: Managed identity principal ID
+      description: |
+        Object ID of the machine's system-assigned managed identity. Retrieve with:
+
+        ```
+        az connectedmachine show \
+          --name <MACHINE_NAME> \
+          --resource-group rg-mbsgw-<env>-uks-arc-enabled-servers \
+          --query identity.principalId -o tsv
+        ```
+      placeholder: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+    validations:
+      required: true
+
+  - type: markdown
+    attributes:
+      value: |
+        ---
+        ## Steps for assignee
+
+        ### Option A — Azure Portal
+
+        1. Entra ID → Enterprise Applications → `spn-manbrs-web-api-<env>`
+        2. **Users and groups** → **Add user/group**
+        3. Search for the Arc machine name and select its managed identity
+        4. Select the `Gateway.Access` role → **Assign**
+
+        ### Option B — Azure CLI
+
+        ```bash
+        MACHINE_NAME=<MACHINE_NAME>
+        ENV=<ENV>
+        PRINCIPAL_ID=<PRINCIPAL_ID>
+
+        # Get the manbrs SP object ID
+        RESOURCE_SP_ID=$(az ad sp show \
+          --display-name "spn-manbrs-web-api-${ENV}" \
+          --query id -o tsv)
+
+        # Get the Gateway.Access role ID
+        ROLE_ID=$(az ad sp show \
+          --display-name "spn-manbrs-web-api-${ENV}" \
+          --query "appRoles[?value=='Gateway.Access'].id | [0]" -o tsv)
+
+        # Create the assignment
+        az rest --method POST \
+          --uri "https://graph.microsoft.com/v1.0/servicePrincipals/${PRINCIPAL_ID}/appRoleAssignments" \
+          --body "{
+            \"principalId\": \"${PRINCIPAL_ID}\",
+            \"resourceId\": \"${RESOURCE_SP_ID}\",
+            \"appRoleId\": \"${ROLE_ID}\"
+          }"
+        ```
+
+        ### Verification
+
+        Confirm the machine appears under:
+        > Entra ID → Enterprise Applications → `spn-manbrs-web-api-<env>` → Users and groups
+
+        with the `Gateway.Access` role assigned.
+
+  - type: checkboxes
+    attributes:
+      label: Completion checklist
+      options:
+        - label: App role assignment created in Entra ID
+          required: false
+        - label: Assignment verified in portal / CLI
+          required: false
+
+  - type: checkboxes
+    attributes:
+      label: Sensitive Information Declaration
+      description: Do NOT include PII/PID or any other sensitive data in this form.
+      options:
+        - label: I confirm that neither PII/PID nor sensitive data are included in this form
+          required: true

infrastructure/modules/arc-infra/app_role.tf

@@ -28,9 +28,3 @@ variable "static_arc_machine_names" {
   type        = list(string)
   default     = []
 }
-
-variable "manbrs_api_app_role_value" {
-  description = "Value of the app role on spn-manbrs-web-api-<env> to assign to each Arc machine managed identity. Must match a role declared on that application registration."
-  type        = string
-  default     = "Gateway.Access"
-}