Add Example for creating blueprint via ARM template using UAMI

[alex-frankel]

Current example uses system-assigned managed identity. We need another example using user-assigned.

Also should update the system-assigned example with the added roleAssignment resource to grant blueprint app owner rights.

[tikicoder]

if someone is doing it via terraform here is some thing they can use

data "azurerm_client_config" "current" {}

data "azurerm_subscription" "subscription" {}

data "azurerm_blueprint_definition" "blueprint" {
name = var.bp_name
scope_id = var.bp_scope_id
}

data "azurerm_blueprint_published_version" "blueprint_version" {
scope_id = var.bp_scope_id
blueprint_name = var.bp_name
version = var.bp_version
}

resource "azurerm_resource_group" "blueprint_resourcegroup" {
name = local.resource_group
location = var.regions.primary

tags = var.tags
}

resource "azurerm_user_assigned_identity" "blueprint_identity" {
resource_group_name = azurerm_resource_group.blueprint_resourcegroup.name
location = azurerm_resource_group.blueprint_resourcegroup.location
name = "identity-bp-deployment"
}

resource "azurerm_role_assignment" "operator" {
scope = data.azurerm_subscription.subscription.id
role_definition_name = "Blueprint Operator"
principal_id = azurerm_user_assigned_identity.blueprint_identity.principal_id
}

resource "azurerm_role_assignment" "owner" {
scope = data.azurerm_subscription.subscription.id
role_definition_name = "Owner"
principal_id = azurerm_user_assigned_identity.blueprint_identity.principal_id
}

resource "azurerm_blueprint_assignment" "this" {

name = "assignment-${var.bp_name}"
target_subscription_id = data.azurerm_subscription.subscription.id
version_id = data.azurerm_blueprint_published_version.blueprint_version.id
location = azurerm_resource_group.blueprint_resourcegroup.location

lock_mode = "AllResourcesDoNotDelete"

lock_exclude_principals = flatten(concat(
var.blueprint_lock_exclude_principals == null ? [] :var.blueprint_lock_exclude_principals
))

identity {
type = "UserAssigned"
identity_ids = [azurerm_user_assigned_identity.blueprint_identity.id]
}

parameter_values = <<VALUES
{
"subscription_environment": {
"value": "${var.subscription_environment}"
},
"default_subscription_resourcegroup": {
"value": "${var.subscription_variable.default_subscription_resourcegroup}"
},
"default_base_name": {
"value": "${var.subscription_variable.default_base_name}"
}
}
VALUES

depends_on = [
azurerm_role_assignment.operator,
azurerm_role_assignment.owner
]
}