[Sprint 3] Extract stacks/gateway-rbac/ — APIM + cross-service RBAC

Open
#122 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Refactor
Clarity
Mostly clear
Activity status
Stale
Tech stack
azure, terraform
Domain
cloud, devops, infrastructure

Research direction

Start by comparing the APIM and role-assignment resources in infra/terraform/main.tf with the existing stacks/aca-apps/, stacks/data-ai/, stacks/services/, and foundation outputs. Run terraform plan from stacks/gateway-rbac/ and verify the listed cross-stack inputs and removed blocks preserve the migrated resources. Done means the plan shows 0 changes after migration, APIM and role assignments remain healthy, and per-service stacks continue to work.

Written by the indexing model from the issue text.

Description

component:ci-cd component:terraform priority:P2 type:architecture

Summary

Extract APIM Consumption instance and cross-service role assignments from infra/terraform/main.tf into infra/terraform/stacks/gateway-rbac/.

Parent epic: #119

Business Context

APIM Consumption SKU provisioning takes ~2 min but competes with other heavy resources in the current monolith. More importantly, the Cognitive Services RBAC and agent role assignments require both ACA app principal IDs (from stacks/aca-apps/) and the Foundry ID (from stacks/data-ai/). This stack runs after both parallel stacks complete, making it the natural join-point in the DAG.

Scope

Resources to extract
Current address Notes
azurerm_api_management.main Consumption SKU
azurerm_role_assignment.container_app_cognitive_services (for_each × 8) Scoped to module.ai_foundry.ai_foundry_id
azurerm_role_assignment.agent_permissions (for_each) Multi-scope role assignments
Resources to remove (already migrated to per-service stacks)
Current address Status
azurerm_api_management_api.backend_services Managed by stacks/services/{svc}/ — remove with removed block
azurerm_api_management_api_operation.backend_catch_all Same
azurerm_api_management_api_policy.backend_services_hardening Same
Cross-stack inputs
Input Source stack Output key
aca_principal_ids aca-apps principal_ids (map[service]→principal_id)
ai_foundry_id data-ai ai_foundry_id
resource_group_name foundation resource_group_name
acr_id foundation acr_id
storage_account_id foundation storage_account_id
cosmos_account_id data-ai cosmos_account_id

Acceptance Criteria

  • terraform plan on stacks/gateway-rbac/ shows 0 changes after migration
  • APIM Consumption instance accessible and healthy
  • All 8 ACA apps have Cognitive Services User role on Foundry endpoint
  • Agent role assignments are intact
  • Foundation-level APIM API/operation/policy resources cleanly removed (no orphans)
  • Per-service stacks (stacks/services/) continue to work with the APIM created by this stack

Risk

Risk Likelihood Mitigation
APIM loses API definitions during stack migration Low Per-service stacks own APIs; foundation copies are already stale guards gated by manage_apim_service_edge_in_foundation
Role assignments duplicated Low Terraform is source of truth; removed block prevents foundation from recreating
Dominant language
Python
Stars
17
Forks
8
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Azure-Samples/tutor

All issues in Azure-Samples/tutor

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.