Apply tags to Resource Group during Hubs deployment

📝 Scenario

The Deploy to Azure button for FinOps Hubs presents the Azure portal tab to set Tags, but these only get applied to the Resources, not the Resource Group, even if you create a new RG as part of the deployment.

💎 Solution

Add a step to retrofit the tags to the RG too (new or existing), after it has been created.

ℹ️ Additional context

In order to do this, we'll need to update the following:

1. Add "Microsoft.Resources/resourceGroups" to the list of taggable resources in src/templates/finops-hub/createUiDefinition.json
2. In src/templates/finops-hub/modules/hub.bicep, create a new deployment script that tags the resource group
   • Add a new section under Key Vault that includes a new managed identity, role assignment, and deployment script (you can copy what's in storage.bicep)
   • Assign the Resource Group Contributor role to the managed identity
   • Pass the tags in as an environment variable:

     contains(tagsByResource, 'Microsoft.Resources/resourceGroups') ? tagsByResource['Microsoft.Resources/resourceGroups'] : {})
     

   • Create a script in src/templates/finops-hub/modules/scripts/Tag-ResourceGroup.ps1
   • In the script, check to see if there is a tag to add and don't do anything if there isn't
3. Update the docs/finops-hub/template.md file:
   • Add a note about the Resource Group Contributor access being required only if a resource group tag is applied in the tagsByResource variable.
   • Could you also add the tagsByResource parameter to the Parameters section? Get the description from hub.bicep.
   • Add the managed identity to the list.
4. Don't forget to update docs/changelog.md

To test, run the local deployment script from PowerShell:

. src/scripts/Deploy-Toolkit.ps1 finops-hub -Build

🙋‍♀️ Ask for the community

We could use your help:

1. Please vote this issue up (👍) to prioritize it.
2. Leave comments to help us solidify the vision.