chore: reorganise infra scripts

Author: christianacca

tools/infrastructure/arm-templates/main.bicep

@@ -110,22 +110,7 @@ module pbiReportStorage 'br/public:avm/res/storage/storage-account:0.14.3' = {
   }
 }
 
-resource acaEnvManagedId 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
-  name: settings.SubProducts.Aca.ManagedIdentity
-  location: location
-}
-
-var certSettings = settings.TlsCertificates.Current
-module acaEnvCertPermission 'keyvault-cert-role-assignment.bicep' = if (settings.SubProducts.Aca.IsCustomDomainEnabled) {
-  name: '${uniqueString(deployment().name, location)}-AcaEnvCertPermission'
-  scope: resourceGroup((certSettings.KeyVault.SubscriptionId ?? subscription().subscriptionId), certSettings.KeyVault.ResourceGroupName)
-  params: {
-    certificateName: certSettings.ResourceName
-    keyVaultName: certSettings.KeyVault.ResourceName
-    principalId: acaEnvManagedId.properties.principalId
-    roleDefinitionId: '4633458b-17de-408a-b874-0445c86b69e6' // 'Key Vault Secrets User'
-  }
-}
+// ---------- Begin: Container registeries -----------
 
 resource acrPullManagedId 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
   name: settings.SubProducts.AcrPull.ResourceName
@@ -144,9 +129,33 @@ module acrPullPermissions 'acr-role-assignment.bicep' = [for (registry, index) i
   }
 }]
 
+var acaContainerRegistries = map(containerRegistries, registry => ({
+  server: '${registry.ResourceName}.azurecr.io'
+  identity: acrPullManagedId.id
+}))
+
+// ---------- End: Container registeries -----------
+
 
 // ---------- Begin: ACA environments -----------
 
+resource acaEnvManagedId 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
+  name: settings.SubProducts.Aca.ManagedIdentity
+  location: location
+}
+
+var certSettings = settings.TlsCertificates.Current
+module acaEnvCertPermission 'keyvault-cert-role-assignment.bicep' = if (settings.SubProducts.Aca.IsCustomDomainEnabled) {
+  name: '${uniqueString(deployment().name, location)}-AcaEnvCertPermission'
+  scope: resourceGroup((certSettings.KeyVault.SubscriptionId ?? subscription().subscriptionId), certSettings.KeyVault.ResourceGroupName)
+  params: {
+    certificateName: certSettings.ResourceName
+    keyVaultName: certSettings.KeyVault.ResourceName
+    principalId: acaEnvManagedId.properties.principalId
+    roleDefinitionId: '4633458b-17de-408a-b874-0445c86b69e6' // 'Key Vault Secrets User'
+  }
+}
+
 var acaEnvSharedSettings = {
   certSettings: settings.TlsCertificates.Current
   isCustomDomainEnabled: settings.SubProducts.Aca.IsCustomDomainEnabled
@@ -179,12 +188,6 @@ var acaFailoverDomain = !empty(settings.SubProducts.Aca.Failover ?? {}) ? acaEnv
 // ---------- End: ACA environments -----------
 
 
-var acaContainerRegistries = map(containerRegistries, registry => ({
-  server: '${registry.ResourceName}.azurecr.io'
-  identity: acrPullManagedId.id
-}))
-
-
 // ---------- Begin: Template.Api -----------
 
 resource apiManagedId 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {