DTOSS-12686: Assign Windows Admin Center policy to Arc-enabled servers

Adds policy assignment for "Configure Windows Arc-enabled machines to
enable Windows Admin Center Extension" (0e4b8929) scoped to the
Arc-enabled servers resource group, and a remediation task so existing
non-compliant machines get the extension deployed on the next
terraform apply.

Reuses the existing arc_monitor_policy_identity managed identity which
already holds the Azure Connected Machine Resource Administrator role.

Author: josielsouzanordcloud

infrastructure/modules/arc-infra/azure_monitor.tf

@@ -137,23 +137,50 @@ resource "azurerm_resource_group_policy_assignment" "dcr_association" {
   })
 }
 
+# ---------------------------------------------------------------------------
+# Policy Assignment for Windows Admin Center
+# "Configure Windows Arc-enabled machines to enable Windows Admin Center Extension"
+# ---------------------------------------------------------------------------
+resource "azurerm_resource_group_policy_assignment" "wac" {
+  count = var.enable_arc_servers ? 1 : 0
+
+  name                 = "wac-arc-${var.env_config}"
+  resource_group_id    = data.azurerm_resource_group.arc_enabled_servers[0].id
+  policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/0e4b8929-3957-46e0-bc05-0e34ce4c5f3e"
+  location             = var.region
+
+  identity {
+    type         = "UserAssigned"
+    identity_ids = [module.arc_monitor_policy_identity[0].id]
+  }
+}
+
 # Remediation tasks — re-evaluate compliance and deploy AMA/DCR association on
 # any non-compliant Arc machines each time Terraform applies. Combined with the
 # DeployIfNotExists effect, this makes the monitoring setup self-healing.
 resource "azurerm_resource_group_policy_remediation" "ama_install" {
   count = var.enable_arc_servers ? 1 : 0
 
-  name                   = "remediation-ama-install-${var.env_config}"
-  resource_group_id      = data.azurerm_resource_group.arc_enabled_servers[0].id
-  policy_assignment_id   = azurerm_resource_group_policy_assignment.ama_install[0].id
+  name                    = "remediation-ama-install-${var.env_config}"
+  resource_group_id       = data.azurerm_resource_group.arc_enabled_servers[0].id
+  policy_assignment_id    = azurerm_resource_group_policy_assignment.ama_install[0].id
   resource_discovery_mode = "ReEvaluateCompliance"
 }
 
 resource "azurerm_resource_group_policy_remediation" "dcr_association" {
   count = var.enable_arc_servers ? 1 : 0
 
-  name                   = "remediation-dcr-assoc-${var.env_config}"
-  resource_group_id      = data.azurerm_resource_group.arc_enabled_servers[0].id
-  policy_assignment_id   = azurerm_resource_group_policy_assignment.dcr_association[0].id
+  name                    = "remediation-dcr-assoc-${var.env_config}"
+  resource_group_id       = data.azurerm_resource_group.arc_enabled_servers[0].id
+  policy_assignment_id    = azurerm_resource_group_policy_assignment.dcr_association[0].id
+  resource_discovery_mode = "ReEvaluateCompliance"
+}
+
+resource "azurerm_resource_group_policy_remediation" "wac" {
+  count = var.enable_arc_servers ? 1 : 0
+
+  name                    = "remediation-wac-${var.env_config}"
+  resource_group_id       = data.azurerm_resource_group.arc_enabled_servers[0].id
+  policy_assignment_id    = azurerm_resource_group_policy_assignment.wac[0].id
   resource_discovery_mode = "ReEvaluateCompliance"
 }