Remove UAMI from infrastructure bicep

Author: Christdej

scripts/automation/infrastructure-dev.bicepparam

@@ -7,8 +7,6 @@ param objectIdFgRobots = '5ac08731-48dd-4499-9151-7bf6b8ab8eac'
 
 param objectIdEnterpriseApplication = '8814d87c-169b-49b1-9237-2347041157ca' // ObjectID enterprise application sara-dev
 
-param managedIdentityName = '${environment}-mi'
-
 param keyVaultName = '${environment}-kv'
 
 param storageAccountNameAnon = '${environment}storeanon'
@@ -17,8 +15,5 @@ param storageAccountNameVis = '${environment}storevis'
 param storageAccountNameThermalRef = '${environment}thermalref'
 param storageAccountNameTimeseries = '${environment}storetime'
 
-param principalId = '80b30892-2768-4b33-92a6-bec41a7f4e2c' //aurora-aks-kubelet-shared dev environment
-param roleDefinitionId = 'f1a07417-d97a-45cb-824c-7a7467783830' // azure built-in role for managed identity operator
-
 // Grant Flotilla (FlotillaBackendAuthDev) role assignment as "Storage Blob Data Reader" to storageanon account
 param principalIdFlotillaApp = '8256d35d-5c07-440b-9f47-4abce94c8565' // ObjectID enterprise application FlotillaBackendAuthDev

scripts/automation/infrastructure-prod.bicepparam

@@ -7,8 +7,6 @@ param objectIdFgRobots = '5ac08731-48dd-4499-9151-7bf6b8ab8eac'
 
 param objectIdEnterpriseApplication = '49613d59-1f36-4835-8dc4-caff1591c8e9' // ObjectID enterprise application sara-prod
 
-param managedIdentityName = '${environment}-mi'
-
 param keyVaultName = '${environment}-kv'
 
 param storageAccountNameAnon = '${environment}storeanon'
@@ -17,8 +15,5 @@ param storageAccountNameVis = '${environment}storevis'
 param storageAccountNameThermalRef = '${environment}thermalref'
 param storageAccountNameTimeseries = '${environment}storetime'
 
-param principalId = 'bf81095d-e13d-481d-a4e8-a5c17faad398' //aurora-aks-kubelet-shared prod environment
-param roleDefinitionId = 'f1a07417-d97a-45cb-824c-7a7467783830' // azure built-in role for managed identity operator
-
 // Grant Flotilla (FlotillaBackendAuthProd) role assignment as "Storage Blob Data Reader" to storageanon account
 param principalIdFlotillaApp = '17c50841-e5d6-4eae-a74b-98d0d2e0b592' // ObjectID enterprise application FlotillaBackendAuthProd

scripts/automation/infrastructure-staging.bicepparam

@@ -7,8 +7,6 @@ param objectIdFgRobots = '5ac08731-48dd-4499-9151-7bf6b8ab8eac'
 
 param objectIdEnterpriseApplication = '7b6946f3-eefd-4036-acd2-d8ba2782e9eb' // ObjectID enterprise application sara-staging
 
-param managedIdentityName = '${environment}-mi'
-
 param keyVaultName = '${environment}-kv'
 
 param storageAccountNameAnon = '${environment}storeanon'
@@ -17,8 +15,5 @@ param storageAccountNameVis = '${environment}storevis'
 param storageAccountNameThermalRef = '${environment}thermalref'
 param storageAccountNameTimeseries = '${environment}storetime'
 
-param principalId = 'bf81095d-e13d-481d-a4e8-a5c17faad398' //aurora-aks-kubelet-shared staging environment
-param roleDefinitionId = 'f1a07417-d97a-45cb-824c-7a7467783830' // azure built-in role for managed identity operator
-
 // Grant Flotilla (FlotillaBackendAuthStaging) role assignment as "Storage Blob Data Reader" to storageanon account
 param principalIdFlotillaApp = 'e7c92357-387d-4c11-a88f-638828a5d4dd' // ObjectID enterprise application FlotillaBackendAuthStaging

scripts/automation/infrastructure.bicep

@@ -16,10 +16,6 @@ param objectIdFgRobots string
 
 param objectIdEnterpriseApplication string
 
-param managedIdentityName string
-param principalId string
-param roleDefinitionId string
-
 param principalIdFlotillaApp string
 
 resource resourceGroup 'Microsoft.Resources/resourceGroups@2024-03-01' = {
@@ -74,17 +70,6 @@ module storageAccountTimeseries 'modules/storage-account-timeseries.bicep' = {
   }
 }
 
-module managedIdentity 'modules/managed-identity.bicep' = {
-  scope: resourceGroup
-  name: 'infrastructure-mi-${deploymentId}'
-  params: {
-    location: location
-    managedIdentityName: managedIdentityName
-    principalId: principalId
-    roleDefinitionID: roleDefinitionId
-  }
-}
-
 module keyVault 'modules/key-vault.bicep' = {
   scope: resourceGroup
   name: 'infrastructure-kv-${deploymentId}'
@@ -93,8 +78,5 @@ module keyVault 'modules/key-vault.bicep' = {
     keyVaultName: keyVaultName
     objectIdFgRobots: objectIdFgRobots
     objectIdEnterpriseApplication: objectIdEnterpriseApplication
-    principalId: principalId
-    managedIdentityName: managedIdentityName
-    roleDefinitionID: roleDefinitionId
   }
 }

scripts/automation/modules/key-vault.bicep

@@ -2,19 +2,6 @@ param location string
 param keyVaultName string
 param objectIdFgRobots string
 param objectIdEnterpriseApplication string
-param managedIdentityName string
-param principalId string
-param roleDefinitionID string
-
-module managedIdentity 'managed-identity.bicep' = {
-  name: 'managedidentity'
-  params: {
-    location: location
-    managedIdentityName: managedIdentityName
-    principalId: principalId
-    roleDefinitionID: roleDefinitionID
-  }
-}
 
 resource keyVault 'Microsoft.KeyVault/vaults@2024-04-01-preview' = {
   name: keyVaultName
@@ -52,17 +39,6 @@ resource keyVaultAccessPolicy 'Microsoft.KeyVault/vaults/accessPolicies@2024-04-
           ]
         }
       }
-      {
-        tenantId: keyVault.properties.tenantId
-        objectId: managedIdentity.outputs.objectIdManagedIdentity
-        permissions: {
-          keys: []
-          secrets: [
-            'get'
-            'list'
-          ]
-        }
-      }
       {
         tenantId: keyVault.properties.tenantId
         objectId: objectIdEnterpriseApplication