allow users to bring their own credentials and override MLZ Service Principal creation

[glennmusa]

Description

This change proposes adding a --no-service-principal flag to deploy.sh in conjunction with two environment variables ARM_CLIENT_ID and ARM_CLIENT_SECRET to deploy MLZ without creating a brand new Service Principal.

This change allows those who do not have Owner RBAC permissions but have been given Subscriptions and a Service Principal with Contributor role to those subscriptions to deploy MissionLZ.

Two new scripts were introduced with this change:

1. checkforarmcredential.sh

This script ensures the environment variables ARM_CLIENT_ID and ARM_CLIENT_SECRET are set and that the Service Principal exists.

2. validate_minimum_role_for_sp.sh

This scripts ensures that the user supplied Service Principal has at minimum a Contributor RBAC role scoped for each of the subscriptions the user is deploying into and provides the scripts the user would run to remediate the issue.

A few good ways to test this:

Deploy with the --no-service-principal flag to test the environment variable check:

src/scripts/deploy.sh -s $your_sub_id --no-service-principal

Create yourself a new Service Principal, set the relevant environment variables, and attempt to deploy into multiple subscriptions without assigning the roles:

az ad sp create-for-rbac
export ARM_CLIENT_ID={the resulting app ID}
export ARM_CLIENT_SECRET={the resulting password}
src/scripts/deploy.sh -s $your_sub_id -u $your_hub_id -0 $your_t0_id --no-service-principal

For more help, check the updated docs.

Issue reference

The issue this PR will close: #176

Checklist

Please make sure you've completed the relevant tasks for this PR, out of the following list:

• Code compiles or validates correctly
• BASH scripts have been validated using shellcheck
• All tests pass (manual and automated)
• The documentation is updated to cover any new or changed features
• Markdown files have been linted using the recommended linter. (See .vscode/extensions.json.)
• Relevant issues are linked to this PR

[Chambras]

So far this has been working as expected for me in commercial and gov. I even used a different SP with owner rights which is expected to work, and it did!
I will start doing some negative testing and see how it reacts and the outputs it shows to the user, but so far it works!

[brooke-hamilton]

So far this has been working as expected for me in commercial and gov. I even used a different SP with owner rights which is expected to work, and it did!
I will start doing some negative testing and see how it reacts and the outputs it shows to the user, but so far it works!

This also worked well for me in commercial, including failure scenarios like the SP not having the contributor role.