Challenge for Hackathon Day 3

[bogdan-grozoiu]

You are working for an electrical energy distributor that needs to expose to its customers a historical price for the energy provided.
The minimum price for energy is regulated every 10 minutes.
The minimum price for energy can be retrieved by querying the Organization Secret: ENERGY_PRICE_URL.
Expect the following json structure on GET requests against the URL above:

{
  "energy_price_eur": 0.056,
  "energy_unit": "kWh",
  "energy_price_expiration": "19/04/2023 10:30"
}

Create a new workflow that meets the following requirements:

• It is reusable
• It can be manually triggered
• It triggers when updating a specific path from your git repo, that you will use to deploy the dedicated infrastructure for this solution.
• Nothing to be hardcoded in the bicep/arm templates used to deploy the IaC.
• Some of the parameters must be replaced at the workflow runtime with the values corresponding to the resources created beforehand during the hackathon.

Using the workflow above, rollout a serverless solution that meets the following infrastructure requirements:

• With each infrastructure rollout it will store the energy price URL as a Key Vault secret version.
• As the Key Vault will be used for multiple solutions, each secret must be accessible by distinct User Assigned Managed Identities (UAMI). The UAMI used by the front-end solution must not be able to retrieve the values for other secrets stored in the same vault and must have the minimum permissions set to retrieve the secret value.
• The energy price URL must be known to the serverless solution as a Key Vault reference, and not explicitly as a string value.
• The solution must save the adjusted energy price in a permanent storage with a maximum surcharge of 10% over the regulated price.
• The solution must use a different UAMI to store the price in its permanent storage than the one used to retrieve the value for the energy price URL.
• The solution must have only one publicly available endpoint to its customers. All its supporting components must be private.
• The public endpoint must support regular web calls using the GET method only.
• The Key Vault and the Storage Account used to store historical data must have their private endpoints available in different virtual network subnets, protected by independent network security groups.
• The network traffic between the front-end, Key Vault and the Storage Account must be controlled by the Azure Firewall deployed in the first 2 days of the hackathon.
• Optional: the solution to allow only the existing Azure AD users to query its public endpoint.
• The Key Vault and the Storage Account must be deployed under a different Management Group than the front-end component(-s).

Good luck!

[bogdan-grozoiu]