feat(DTOSS-13037): move app role assignment out of Terraform into user script

The pipeline MI lacks AppRoleAssignment.ReadWrite.All and ownership is
insufficient in application permission context. Removes azuread_app_role_assignment
from Terraform and adds assign_arc_app_roles.sh, which runs under user
credentials (where ownership of the SP is sufficient) to assign the
Gateway.Access role to all Arc machine managed identities in an environment.

Usage: ./scripts/bash/assign_arc_app_roles.sh <env>

Author: josielsouzanordcloud

infrastructure/modules/arc-infra/app_roles.tf

@@ -28,9 +28,3 @@ variable "static_arc_machine_names" {
   type        = list(string)
   default     = []
 }
-
-variable "enterprise_app_role_value" {
-  description = "App role name to assign to each Arc machine's managed identity on the web API enterprise app (spn-manbrs-web-api-<env>). Leave empty to skip assignment."
-  type        = string
-  default     = ""
-}

infrastructure/modules/arc-infra/variables.tf

@@ -11,7 +11,6 @@ module "arc_infra" {
   env_config          = var.env_config
   resource_group_name       = local.resource_group_name
   enable_arc_servers        = var.enable_arc_servers
-  enterprise_app_role_value = var.enterprise_app_role_value
 
   # Create the HC for the test VM in the same run as VM creation.
   # The Arc data source won't see a machine registered in the same apply.

infrastructure/terraform/main.tf

@@ -50,11 +50,6 @@ variable "gateway_test_vm_size" {
   default     = "Standard_B2s"
 }
 
-variable "enterprise_app_role_value" {
-  description = "App role name to assign to each Arc machine's managed identity on the web API enterprise app (spn-manbrs-web-api-<env>). Leave empty to skip assignment."
-  type        = string
-  default     = "Gateway.Access"
-}
 
 locals {
   region              = "uksouth"

infrastructure/terraform/variables.tf

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -eu
+
+ENV_CONFIG="$1"
+
+enterpriseAppName="spn-manbrs-web-api-${ENV_CONFIG}"
+rgName="rg-mbsgw-${ENV_CONFIG}-uks-arc-enabled-servers"
+appRoleValue="Gateway.Access"
+
+echo "Fetching enterprise app details for: $enterpriseAppName"
+spObjectId=$(az ad sp list --filter "displayName eq '${enterpriseAppName}'" --query "[0].id" -o tsv)
+appRoleId=$(az ad sp list --filter "displayName eq '${enterpriseAppName}'" --query "[0].appRoles[?value=='${appRoleValue}'].id | [0]" -o tsv)
+
+if [ -z "$spObjectId" ]; then
+  echo "Error: Enterprise app '$enterpriseAppName' not found"
+  exit 1
+fi
+
+echo "SP object ID:          $spObjectId"
+echo "App role ($appRoleValue): $appRoleId"
+
+echo "Listing Arc machines in: $rgName"
+arcMachines=$(az connectedmachine list --resource-group "$rgName" --query "[].name" -o tsv)
+
+if [ -z "$arcMachines" ]; then
+  echo "No Arc machines found in $rgName"
+  exit 0
+fi
+
+while IFS= read -r machine; do
+  [ -z "$machine" ] && continue
+
+  miPrincipalId=$(az connectedmachine show \
+    --resource-group "$rgName" \
+    --name "$machine" \
+    --query "identity.principalId" -o tsv)
+
+  echo "Assigning $appRoleValue to $machine (MI: $miPrincipalId)..."
+  if ! output=$(az rest --method POST \
+    --uri "https://graph.microsoft.com/v1.0/servicePrincipals/${spObjectId}/appRoleAssignedTo" \
+    --headers "Content-Type=application/json" \
+    --body "{\"principalId\": \"${miPrincipalId}\", \"resourceId\": \"${spObjectId}\", \"appRoleId\": \"${appRoleId}\"}" 2>&1); then
+    if echo "$output" | grep -q "Permission being assigned already exists"; then
+      echo "  Already assigned, skipping."
+    else
+      echo "Error: $output"
+      exit 1
+    fi
+  fi
+done <<< "$arcMachines"
+
+echo "Done."