Description

This PR adds a new bootstrap process using Bicep templates and Makefile targets to initialise the resource group for the mbsgw application. It includes environment-specific variable files, Bicep modules for various infrastructure components such as DNS zones, Key Vault, and managed identities, and a bash script to orchestrate the deployment.

Type of change

• Bug fix
• New feature
• Breaking change
• Infrastructure change
• Pipeline / CI
• Documentation update
• Refactor

Jira link

DTOSS-12260
https://nhsd-jira.digital.nhs.uk/browse/DTOSS-12260

Review notes

• Makefile:
  • Added include for Terraform make targets.
• Environment variable files (variables.sh):
  • Created for dev, preprod, prod, and review environments with necessary configuration.
• Bicep modules:
  • core.bicep: Role assignments for managed identity and Entra ID group.
  • dns.bicep: DNS zone creation.
  • keyVault.bicep: Key Vault creation and role assignments.
  • main.bicep: Orchestrates the deployment of various resources like storage account, private endpoint, and key vault.
  • managedIdentity.bicep: Managed identity creation with federated credentials.
  • privateEndpoint.bicep: Private endpoint creation.
  • storage.bicep: Storage account creation and blob configuration.
• Bash script (resource_group_init.sh):
  • Fetches the user group principal ID and deploys Bicep templates for both hub and core subscriptions.

Breaking changes

None

Impact

• Deployment of infrastructure resources for the mbsgw application.
• Setup of managed identities, DNS zones, Key Vault, and private endpoints.
• Environment-specific configuration based on variable files.

Review checklist

• Check database queries are correctly scoped to current_provider