feat(DTOSS-13037): remove pipeline MI as SP owner and document app role assignment process

The pipeline MI was added as owner of the enterprise app SP to enable
Terraform app role assignments, but AppRoleAssignment.ReadWrite.All is
required in application auth context regardless of ownership. Since
assignments are now handled by assign_arc_app_roles.sh (delegated auth),
the MI owner entry is no longer needed. Adds inline documentation
explaining the constraint and onboarding process.

Author: josielsouzanordcloud

infrastructure/terraform/resource_group_init/enterpriseAppOwner.bicep

@@ -1,14 +1,13 @@
 extension microsoftGraphV1
 
-param miPrincipalId string
 param enterpriseAppClientId string
 param enterpriseAppName string
 param groupMemberIds array = []
 
 resource enterpriseAppSp 'Microsoft.Graph/servicePrincipals@v1.0' = {
   appId: enterpriseAppClientId
   owners: {
-    relationships: concat([miPrincipalId], groupMemberIds)
+    relationships: groupMemberIds
   }
 }
 

infrastructure/terraform/resource_group_init/main.bicep

@@ -214,7 +214,6 @@ module pipelineMiAppRole 'enterpriseAppOwner.bicep' = {
   name: 'pipelineMiAppRoleAssignment'
   scope: managedIdentityRG
   params: {
-    miPrincipalId: managedIdentiyADOtoAZ.outputs.miPrincipalID
     enterpriseAppClientId: enterpriseAppClientId
     enterpriseAppName: enterpriseAppName
     groupMemberIds: groupMemberIds

scripts/bash/assign_arc_app_roles.sh

@@ -1,4 +1,17 @@
 #!/usr/bin/env bash
+# Assigns the Gateway.Access app role to the managed identity of each Arc-enabled server
+# in the environment, allowing the gateway to authenticate against the web API.
+#
+# This is intentionally a manual script rather than automated via Terraform because the
+# pipeline managed identity (mi-manbrs-<env>-adotoaz-uks) lacks the AppRoleAssignment.ReadWrite.All
+# Graph application permission required to create app role assignments. In the delegated auth
+# context (user running this script), ownership of the service principal is sufficient.
+#
+# Run this script after onboarding new Arc-enabled servers to assign the Gateway.Access role
+# to their managed identities.
+#
+# Usage: ./scripts/bash/assign_arc_app_roles.sh <env> <subscription>
+# Example: ./scripts/bash/assign_arc_app_roles.sh review "Breast Screening - Manage Breast Screening - Dev"
 set -eu
 
 ENV_CONFIG="$1"

scripts/terraform/terraform.mk

@@ -21,7 +21,7 @@ ci: # Skip manual approvals when running in CI - make ci <env> <action>
 set-azure-account: # Set the Azure account for the environment - make <env> set-azure-account
 	[ "${SKIP_AZURE_LOGIN}" != "true" ] && az account set -s ${AZURE_SUBSCRIPTION} || true
 
-resource-group-init: set-azure-account get-subscription-ids # Initialise the resources required by terraform - make <env> resource-group-init
+resource-group-init: set-azure-account get-subscription-ids # Initialise resources required by terraform and assign Gateway.Access role to Arc machine managed identities - make <env> resource-group-init
 	$(eval STORAGE_ACCOUNT_NAME=sa${APP_SHORT_NAME}${ENV_CONFIG}tfstate)
 	scripts/bash/resource_group_init.sh "${REGION}" "${HUB_SUBSCRIPTION_ID}" "${ENABLE_SOFT_DELETE}" "${ENV_CONFIG}" "${STORAGE_ACCOUNT_RG}" "${STORAGE_ACCOUNT_NAME}" "${APP_SHORT_NAME}" "${ARM_SUBSCRIPTION_ID}"
 	scripts/bash/assign_arc_app_roles.sh "${ENV_CONFIG}" "${ARM_SUBSCRIPTION_ID}"