v1.0.0 Appears to no longer support billing account and agreement type Enterprise Agreement

[mo-AndrewPage]

This error occurred when trying to update testing env to 1.0.0:

In this code:

Met Office has an Enterprise Agreement (rather than an MPA or MCA)

It appears that the REST operation called does not support EA:

From:
create-by-billing-account

[wozzer72]

This has been found as a result of: #56; two separate terraform state deployments within a single tenant account.

The module and all of functionapp are deployed into a dedicated subscription; one subscription each. But Cost Mgmt and Billing operate across all subscriptions.

[wozzer72]

@mo-AndrewPage - for clarity, the need to assign billing account has only been introduced in this latest version of the export.

I am following up with our Azure experts.

[wozzer72]

We re-evaluated our solution approach; one being whereby the cost mgmt export tasks are created in terraform rather than in the function.

As part of the exercise to demonstrate minimum security again, I deleted (commented out) the ""azapi_resource_action::add_role_assignment", an re-tested the function as is - by recreating a cost mgmt export task I had purposely deleted. The function was still able to create the Cost Mgmt Export task. So that role assignment wasn't even necessary.

Pushed back updated code (including a fix for the "COST_MGMT_SUFFIX" function env var for when the suffix is not set in terraform.

[wozzer72]

Turns out, although the code deploys without the createBillingRoleAssignment, when the function tries to create the Cost Mgmt Export task, it fails. Simply removing the terraform resource did not drop the permission (have to execute a separate DELETE API call) from our already deployed account, and thus our tests continued to work.

The "createBillingRoleAssignment" role only works for MCA customers, not Enterprise Agreement Customers (EA). For EA, the "billingRoleAssignment" API can be used to assign "Enrollment Reader" (24f8edb6-1668-4659-b5e2-40bb5f3a7d7e) role. But that requires Enteprirse Admin rights - not something that would be assigned to the terraform billing role.

So for EA customers, the role will need to be assigned manually post-deployment.

[wozzer72]

#57 - includes the changes for this issue.

Now merged to main.
And tagged with v1.1.0.

New release now available.