Unable to deploy SHM and SRE to different subscriptions

[JimMadge]

:white_check_mark: Checklist

• [x] I have searched open and closed issues for duplicates.
• [x] This is a problem observed when deploying a Data Safe Haven.
• [x] I can reproduce this with the latest version.
• [x] I have read through the documentation.
• [x] This isn't an open-ended question (open a discussion if it is).

:computer: System information

• Operating System:
• Data Safe Haven version: v5.0.0

:package: Packages

List of packages

```none Paste list of packages here ```

:no_entry_sign: Describe the problem

It is not possibly to deploy a TRE across subscriptions, with SREs deployed to subscriptions not containing their SHM.

:deciduous_tree: Log messages

Relevant log messages

```none Your log details here ```

:recycle: To reproduce

• Deploy an SHM to SubscriptionA
• Attempt to deploy an SRE to SubscriptionB

[jemrobinson]

In the SRENetworkingComponent we attempt to add a record to the SHM DNS zone. If this is in another subscription, our regular Pulumi provider won't be able to find it - we need to add a separate Pulumi provider in this file that is connected to the SHM subscription.

[JimMadge]

Would it be sensible to the the AzureSDK to add DNS records? (Given we have no SHMProjectManager)

[JimMadge]

Actually, if this works for us a bit of code like this looks pretty easy and clean

class MyResource(pulumi.ComponentResource):
    def __init__(self, name, opts):
        instance = aws.ec2.Instance("instance", ..., opts=pulumi.ResourceOptions(parent=self))
        pod = kubernetes.core.v1.Pod("pod", ..., opts=pulumi.ResourceOptions(parent=self))

useast1 = aws.Provider("useast1", region="us-east-1")
myk8s = kubernetes.Provider("myk8s", context="test-ci")
my_resource = MyResource("myResource", pulumi.ResourceOptions(providers={
    "aws": useast1,
    "kubernetes": myk8s,
})

[jemrobinson]

Doing this with Pulumi should be as simple as replacing:

shm_ns_record = network.RecordSet(
            f"{self._name}_ns_record",
            ...
            opts=ResourceOptions.merge(
                child_opts, ResourceOptions(parent=sre_dns_zone)
            ),
        )

with

shm_provider = pulumi_azure_native.provider.Provider(subscription_id="shm-subscription-id")
shm_ns_record = network.RecordSet(
            f"{self._name}_ns_record",
            ...
            opts=ResourceOptions.merge(
                child_opts, ResourceOptions(parent=sre_dns_zone, provider=shm_provider)
            ),
        )

[JimMadge]

Yes, I was worried it would mean creating a new stack etc. and making another call to the Pulumi CLI :+1: