feat(DTOSS-13037): automate app role assignment for Arc machine managed identities

Adds azuread_app_role_assignment per Arc-enabled machine so each gateway's
system-assigned MI is granted the manbrs web API app role automatically on
terraform apply, removing the need for manual Entra ID assignment.

Author: josielsouzanordcloud

infrastructure/modules/arc-infra/app_role.tf

@@ -0,0 +1,25 @@
+# Look up the manbrs web API service principal in the same environment.
+# App role assignments are created against this SP's object_id.
+data "azuread_service_principal" "manbrs_web_api" {
+  count        = var.enable_arc_servers ? 1 : 0
+  display_name = "spn-manbrs-web-api-${var.env_config}"
+}
+
+locals {
+  # Resolve the app role UUID by matching against the SP's declared roles.
+  # Falls back to the Entra ID default-access role UUID if the value is not found.
+  manbrs_api_role_id = var.enable_arc_servers ? try(
+    [for r in data.azuread_service_principal.manbrs_web_api[0].app_roles : r.id if r.value == var.manbrs_api_app_role_value][0],
+    "00000000-0000-0000-0000-000000000000"
+  ) : "00000000-0000-0000-0000-000000000000"
+}
+
+# Grant each Arc machine's managed identity the manbrs web API app role so the
+# gateway services can authenticate to the cloud API using their system-assigned MI.
+resource "azuread_app_role_assignment" "manbrs_api" {
+  for_each = local.arc_machines_discovered
+
+  app_role_id         = local.manbrs_api_role_id
+  principal_object_id = data.azurerm_arc_machine.machines[each.key].identity[0].principal_id
+  resource_object_id  = data.azuread_service_principal.manbrs_web_api[0].object_id
+}

infrastructure/modules/arc-infra/variables.tf

@@ -28,3 +28,9 @@ variable "static_arc_machine_names" {
   type        = list(string)
   default     = []
 }
+
+variable "manbrs_api_app_role_value" {
+  description = "Value of the app role on spn-manbrs-web-api-<env> to assign to each Arc machine managed identity. Must match a role declared on that application registration."
+  type        = string
+  default     = "Gateway.Access"
+}