## IAM

setup IAM for a regional control plane

```bash
CONFIG_PATH=base-config-staging-eastus2-remote.yaml LOCAL_CONFIG_PATH=base-config-staging-eastus2.yaml ./setup-iam.sh apply
```

You can also use plan

```bash
CONFIG_PATH=base-config-prod-japaneast.yaml LOCAL_CONFIG_PATH=base-config-prod-japaneast.yaml ./setup-iam.sh plan
```

setup IAM for global service

```bash
LOCAL_CONFIG_PATH=global-dev-config.yaml CONFIG_PATH=global-dev-config.yaml ./global-setup-iam.sh apply
```

## Azure Regional Control Plane

1. copy a regional config, such as `dev-eastus`, replace all dev-eastus string in the configs
2. `terraform init` and `terraform apply`, check if the config is as expected