Apply PR review comments: Function App identity, Key Vault RBAC, network rules

[Copilot]

Addresses review feedback from PR #91 to fix Terraform configuration issues and improve security controls.

Changes

Function App Managed Identity

• Added identity { type = "SystemAssigned" } block to azurerm_linux_function_app resource
• Wrapped principal_id output with try() for null-safety

Key Vault Secret Permissions

• Added azurerm_role_assignment.key_vault_secrets_officer for the deployment service principal
• Updated secret creation to depend on role assignment, ensuring proper ordering

data "azurerm_client_config" "current" {}

resource "azurerm_role_assignment" "key_vault_secrets_officer" {
  scope                = module.key_vault.key_vault_id
  role_definition_name = "Key Vault Secrets Officer"
  principal_id         = data.azurerm_client_config.current.object_id
  depends_on           = [module.key_vault]
}

Key Vault Network ACLs

• Added key_vault_ip_rules and key_vault_subnet_ids variables for granular network access control beyond Azure Services bypass

Documentation

• Fixed grammar inconsistencies in specifications.md (lines 81, 92)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[fpittelo]

ok