fix(iac/azure): register Microsoft.BillingBenefits RP via custom role (closes #752)

SP-virgin subscriptions 409 with MissingSubscriptionRegistration on the first
Savings Plan order because the Microsoft.BillingBenefits resource provider is
not auto-registered. Adding Microsoft.BillingBenefits/register/action to the
custom role lets CUDly register the RP on first use without requiring the
customer to pre-register it manually via az provider register.

Author: cristim

arm/CUDly-CrossSubscription/template.json

@@ -50,6 +50,7 @@
               "Microsoft.Capacity/reservationorders/reservations/read",
               "Microsoft.Capacity/register/action",
               "Microsoft.Capacity/catalogs/read",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",
               "Microsoft.BillingBenefits/savingsPlanOrders/savingsPlans/read",

terraform/modules/iam/azure/cudly-reservation-role/.terraform.lock.hcl

@@ -0,0 +1,51 @@
+terraform {
+  required_version = ">= 1.5"
+
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = ">= 3.0"
+    }
+  }
+}
+
+# Custom role: grants the exact Microsoft.Capacity and Microsoft.BillingBenefits
+# actions used by the calculatePrice -> purchase flow. The built-in Reservation
+# Purchaser role lacks reservationOrders/purchase/action, which causes 403 on
+# production reservation purchases.
+#
+# Used by both:
+#   - customer-side IaC (iac/federation/azure-target/terraform) for the
+#     customer SP that CUDly authenticates with via workload identity federation
+#   - host-side IaC (terraform/modules/compute/azure/container-apps) for the
+#     container-app user-assigned identity running the CUDly process itself
+#
+# Keep the actions list here in sync with arm/CUDly-CrossSubscription/template.json.
+resource "azurerm_role_definition" "cudly_reservation_purchaser" {
+  name        = "CUDly Reservation Purchaser (custom) - ${var.name_suffix}"
+  scope       = var.scope
+  description = "Custom role granting CUDly exactly the Microsoft.Capacity and Microsoft.BillingBenefits actions required by the calculatePrice -> purchase flow. Replaces the built-in Reservation Purchaser, which lacks reservationOrders/purchase/action."
+
+  permissions {
+    actions = [
+      "Microsoft.Capacity/register/action",
+      "Microsoft.Capacity/calculatePrice/action",
+      "Microsoft.Capacity/catalogs/read",
+      "Microsoft.Capacity/reservationOrders/read",
+      "Microsoft.Capacity/reservationOrders/write",
+      "Microsoft.Capacity/reservationOrders/purchase/action",
+      "Microsoft.Capacity/reservationOrders/reservations/read",
+      "Microsoft.BillingBenefits/register/action",
+      "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
+      "Microsoft.BillingBenefits/savingsPlanOrders/read",
+      "Microsoft.BillingBenefits/savingsPlanOrders/savingsPlans/read",
+      "Microsoft.BillingBenefits/savingsPlanOrders/action",
+    ]
+    not_actions = []
+  }
+
+  assignable_scopes = [
+    var.scope,
+    "/providers/Microsoft.Capacity",
+  ]
+}

terraform/modules/iam/azure/cudly-reservation-role/main.tf

@@ -0,0 +1,4 @@
+output "role_definition_resource_id" {
+  description = "Full ARM resource ID of the custom role definition. Use as role_definition_id in azurerm_role_assignment blocks."
+  value       = azurerm_role_definition.cudly_reservation_purchaser.role_definition_resource_id
+}

terraform/modules/iam/azure/cudly-reservation-role/outputs.tf

@@ -0,0 +1,9 @@
+variable "scope" {
+  description = "Subscription resource ID used as the role definition scope and the base of assignable_scopes (e.g. data.azurerm_subscription.current.id)."
+  type        = string
+}
+
+variable "name_suffix" {
+  description = "Suffix appended to the role display name to keep customer and host role definitions distinct within the same Azure AD tenant (e.g. the subscription ID)."
+  type        = string
+}