{
  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.46.1.21595",
      "templateHash": "8548306800953940548"
    },
    "description": "Creates the customer-owned identities and static authorization required for PlanetScale Managed on Azure."
  },
  "variables": {
    "location": "[deployment().location]",
    "bootstrapVersion": "0.1.0",
    "bootstrapResourceGroupName": "planetscale-bootstrap"
  },
  "resources": [
    {
      "type": "Microsoft.Resources/resourceGroups",
      "apiVersion": "2024-03-01",
      "name": "[variables('bootstrapResourceGroupName')]",
      "location": "[variables('location')]"
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2025-04-01",
      "name": "planetscale-bootstrap-identities",
      "resourceGroup": "[variables('bootstrapResourceGroupName')]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "location": {
            "value": "[variables('location')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.46.1.21595",
              "templateHash": "1644741554143504899"
            },
            "description": "Creates the customer-native PlanetScale Managed identities and Terraform federation credentials."
          },
          "parameters": {
            "location": {
              "type": "string",
              "metadata": {
                "description": "Azure region for the managed identities."
              }
            }
          },
          "variables": {
            "issuer": "https://a15ec847-2166-49a3-92d6-6a11f01ae2dd.tokens.sts.global.api.aws",
            "audience": "api://AzureADTokenExchange",
            "awsAccountId": "997601596833"
          },
          "resources": [
            {
              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
              "apiVersion": "2024-11-30",
              "name": "planetscale-terraform-planner",
              "location": "[parameters('location')]"
            },
            {
              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
              "apiVersion": "2024-11-30",
              "name": "planetscale-terraform-runner",
              "location": "[parameters('location')]"
            },
            {
              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
              "apiVersion": "2024-11-30",
              "name": "planetscale-support",
              "location": "[parameters('location')]"
            },
            {
              "type": "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials",
              "apiVersion": "2024-11-30",
              "name": "[format('{0}/{1}', 'planetscale-terraform-planner', 'aws-azure-terraform-planner')]",
              "properties": {
                "audiences": [
                  "[variables('audience')]"
                ],
                "issuer": "[variables('issuer')]",
                "subject": "[format('arn:aws:iam::{0}:role/azure-terraform-planner', variables('awsAccountId'))]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'planetscale-terraform-planner')]"
              ]
            },
            {
              "type": "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials",
              "apiVersion": "2024-11-30",
              "name": "[format('{0}/{1}', 'planetscale-terraform-runner', 'aws-azure-terraform-runner')]",
              "properties": {
                "audiences": [
                  "[variables('audience')]"
                ],
                "issuer": "[variables('issuer')]",
                "subject": "[format('arn:aws:iam::{0}:role/azure-terraform-runner', variables('awsAccountId'))]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'planetscale-terraform-runner')]"
              ]
            }
          ],
          "outputs": {
            "planner": {
              "type": "object",
              "value": {
                "client_id": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'planetscale-terraform-planner'), '2024-11-30').clientId]",
                "principal_id": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'planetscale-terraform-planner'), '2024-11-30').principalId]",
                "resource_id": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'planetscale-terraform-planner')]"
              }
            },
            "runner": {
              "type": "object",
              "value": {
                "client_id": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'planetscale-terraform-runner'), '2024-11-30').clientId]",
                "principal_id": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'planetscale-terraform-runner'), '2024-11-30').principalId]",
                "resource_id": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'planetscale-terraform-runner')]"
              }
            },
            "support": {
              "type": "object",
              "value": {
                "client_id": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'planetscale-support'), '2024-11-30').clientId]",
                "principal_id": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'planetscale-support'), '2024-11-30').principalId]",
                "resource_id": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'planetscale-support')]"
              }
            }
          }
        }
      },
      "dependsOn": [
        "[subscriptionResourceId('Microsoft.Resources/resourceGroups', variables('bootstrapResourceGroupName'))]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2025-04-01",
      "name": "planetscale-bootstrap-authorization",
      "location": "[deployment().location]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "plannerPrincipalId": {
            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('bootstrapResourceGroupName')), 'Microsoft.Resources/deployments', 'planetscale-bootstrap-identities'), '2025-04-01').outputs.planner.value.principal_id]"
          },
          "runnerPrincipalId": {
            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('bootstrapResourceGroupName')), 'Microsoft.Resources/deployments', 'planetscale-bootstrap-identities'), '2025-04-01').outputs.runner.value.principal_id]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.46.1.21595",
              "templateHash": "4222264394152824555"
            },
            "description": "Assigns the static subscription authorization required by PlanetScale Managed automation."
          },
          "parameters": {
            "plannerPrincipalId": {
              "type": "string",
              "metadata": {
                "description": "Object ID of the PlanetScale Terraform planner service principal."
              }
            },
            "runnerPrincipalId": {
              "type": "string",
              "metadata": {
                "description": "Object ID of the PlanetScale Terraform runner service principal."
              }
            }
          },
          "variables": {
            "roleDefinitionManagerName": "[format('PlanetScale Role Definition Manager-{0}', subscription().subscriptionId)]",
            "roleDefinitionManagerId": "[guid(subscription().id, variables('roleDefinitionManagerName'))]",
            "readerRoleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
            "contributorRoleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
            "rbacAdministratorRoleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
          },
          "resources": [
            {
              "type": "Microsoft.Authorization/roleDefinitions",
              "apiVersion": "2022-04-01",
              "name": "[variables('roleDefinitionManagerId')]",
              "properties": {
                "assignableScopes": [
                  "[subscription().id]"
                ],
                "description": "Allows PlanetScale Terraform to manage custom Azure role definitions",
                "permissions": [
                  {
                    "actions": [
                      "Microsoft.Authorization/roleDefinitions/read",
                      "Microsoft.Authorization/roleDefinitions/write",
                      "Microsoft.Authorization/roleDefinitions/delete"
                    ],
                    "dataActions": [],
                    "notActions": [],
                    "notDataActions": []
                  }
                ],
                "roleName": "[variables('roleDefinitionManagerName')]",
                "type": "CustomRole"
              }
            },
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "name": "[guid(subscription().id, parameters('plannerPrincipalId'), variables('readerRoleDefinitionId'))]",
              "properties": {
                "principalId": "[parameters('plannerPrincipalId')]",
                "principalType": "ServicePrincipal",
                "roleDefinitionId": "[variables('readerRoleDefinitionId')]"
              }
            },
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "name": "[guid(subscription().id, parameters('runnerPrincipalId'), variables('contributorRoleDefinitionId'))]",
              "properties": {
                "principalId": "[parameters('runnerPrincipalId')]",
                "principalType": "ServicePrincipal",
                "roleDefinitionId": "[variables('contributorRoleDefinitionId')]"
              }
            },
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "name": "[guid(subscription().id, parameters('runnerPrincipalId'), variables('rbacAdministratorRoleDefinitionId'))]",
              "properties": {
                "principalId": "[parameters('runnerPrincipalId')]",
                "principalType": "ServicePrincipal",
                "roleDefinitionId": "[variables('rbacAdministratorRoleDefinitionId')]"
              }
            },
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "name": "[guid(subscription().id, parameters('runnerPrincipalId'), subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitionManagerId')))]",
              "properties": {
                "principalId": "[parameters('runnerPrincipalId')]",
                "principalType": "ServicePrincipal",
                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitionManagerId'))]"
              },
              "dependsOn": [
                "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitionManagerId'))]"
              ]
            }
          ]
        }
      },
      "dependsOn": [
        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('bootstrapResourceGroupName')), 'Microsoft.Resources/deployments', 'planetscale-bootstrap-identities')]"
      ]
    }
  ],
  "outputs": {
    "bootstrap_version": {
      "type": "string",
      "value": "[variables('bootstrapVersion')]"
    },
    "managed": {
      "type": "object",
      "value": {
        "entra_tenant_id": "[subscription().tenantId]",
        "identities": {
          "planner": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('bootstrapResourceGroupName')), 'Microsoft.Resources/deployments', 'planetscale-bootstrap-identities'), '2025-04-01').outputs.planner.value]",
          "runner": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('bootstrapResourceGroupName')), 'Microsoft.Resources/deployments', 'planetscale-bootstrap-identities'), '2025-04-01').outputs.runner.value]",
          "support": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, variables('bootstrapResourceGroupName')), 'Microsoft.Resources/deployments', 'planetscale-bootstrap-identities'), '2025-04-01').outputs.support.value]"
        },
        "subscription_id": "[subscription().subscriptionId]"
      }
    }
  }
}