Bicep landing zone vending module for Azure

---

⚠️⚠️ Repository archival notice ⚠️⚠️

We would like to inform you that this repository has been archived and the Bicep landing zone vending module for Azure now has a new home in the Bicep public registry and is now a pattern module in the Azure Verified Modules initiative.

What does this mean?

• This repository is now in a read-only state.
• No further issues, pull requests, or updates will be maintained on this repository.
• All future releases, fixes and improvements will be managed in the new AVM pattern module hosted on the Bicep public registry.
• We will continue to leverage the Wiki in this repository as the module's additional documentation and guidance location.

Why was this done?

We are converting this module to be an Azure Verified pattern module to better align with the Azure Verified Modules initiative. This will help us align with the Well-architected framework guidance, have improved module support and provide you with a consistent experience consuming AVM Bicep modules.

📒 If you are not familiar with Azure Verified Modules, you can watch the following Youtube videos for a quick overview:

• An Introduction to Azure Verified Modules (AVM) by the Customer Architecture & Engineering team 📽️🎬🎞️
• Azure Verified Modules Overview by John Savill 📽️🎬🎞️

If I'm already using the Bicep Subscription vending module from the Bicep public registry, what do I need to change?

We tried as much as possible to have a smooth transition path with minimal breaking changes. To switch to the new module:

• Review the documentation for the new AVM module.
• Change the module reference in your code to reference br/public:avm/ptn/lz/sub-vending:x.x.x instead of br/public:lz/sub-vending:x.x.x
• If you have a preference on sharing deployment elemetry for this module, the parameter disableTelemetry has been changed to enableTelemetry. This change is due to AVM modules mandate the use of this parameter.

NOTE: After the migration to Azure Verified Modules, version 1.5.2 of the Subscription Vending module is now 0.1.0 in the Bicep public registry.

Feedback

For any issues, suggestions or feedback for this module, please open an issue on the Bicep public registry.

Thank you for your understanding and continued support.

__________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________;

Overview

ℹ️ This module requires the usage of Bicep version v0.11.1 or later. For details on installing/upgrading Bicep see: Install Bicep tools ℹ️

ℹ️ This module is also available on the Bicep Module Registry here. Examples also included in our wiki examples. ℹ️

The landing zone Bicep modules are designed to accelerate deployment of the individual landing zones (aka Subscriptions) within an Microsoft Entra Tenant.

See the different types of landing zones in the Azure Landing Zones documentation here: What is an Azure landing zone? - Platform vs. application landing zones

The modules are designed to be instantiated many times, once for each desired landing zone.

This is currently split logically into the following capabilities:

• Subscription creation and management group placement
• Networking - deploy a Virtual Network with, optional:
  • Hub & spoke connectivity (peering to a hub Virtual Network)
  • Virtual WAN connectivity (peering to a Virtual Hub via a Virtual Hub Connection)
    • Including support for connections to Virtual WAN Hubs with Routing Intent configured
  • Link to existing DDoS Network Protection Plan
  • Specify Custom DNS Servers
• Role assignments
• Tags
• Resource providers and resource providers features registration

When creating Virtual Network peerings, be aware of the limit of peerings per Virtual Network.

We would like feedback on what's missing in the module. Please raise an issue if you have any suggestions.

Community Events/Recordings

• Bicep Community Call - November 2022 📽️🎬🎞️

Change Log/Releases

Please see this repositories GitHub releases for information on the latest changes and releases.

Wiki

Please see the content in the wiki for more detailed information about the module and various other pieces of documentation.

Known Issues

Please see the Known Issues in the wiki.

Parameters for module main.bicep

Parameters documented here: main.bicep.parameters.md.

Details on each of the parameters, including examples and an example parameter file (this is not a valid parameter file as all parameters contain values, so you must remove the un-required parameters or set them back to their default value, as documented), for the main.bicep module can be found here: main.bicep.parameters.md.

These docs are automatically generated using PSDocs.Azure from the Bicep module file itself and this GitHub Action as part of PRs that amend this Bicep module.

Consumer Guide

We have a Consumer Guide available for guidance on how to consume this module.

Example

For more examples please see the wiki and if you cannot find an example you are looking for please raise an issue on the repo 👍

Below is an example showing how to use this module.

Most commonly this module will be deployed using PowerShell, with the Azure Az Module, with a supporting .json parameters file, one per landing zone to create/vend. Or the same approach but using the Azure CLI.

IMPORTANT: The below example requires you have cloned/downloaded the entire repo and have it available at run-time on the machine running the below commands. It is also expected you are in the root of the cloned/extracted repository; otherwise paths will need to be changed in the below example.

PowerShell Example

$inputObject = @{
  DeploymentName        = 'lz-vend-{0}' -f (-join (Get-Date -Format 'yyyyMMddTHHMMssffffZ')[0..63])
  ManagementGroupId     = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' # Set this to the Management Group ID you wish to target the deployment against. NOTE: This isn't the Management Group that the Subscription will be moved to, that is specified via the parameters.
  Location              = 'uksouth' # Set this to the Azure Region you wish the deployment to be targeted against. NOTE: This isn't the Region that the Subscription's resources will be deployed to, that is specified via the parameters.
  TemplateParameterFile = './landingZones/lz1.parameters.json' # This would be changed to the specific file per landing zone.
  TemplateFile          = "./main.bicep" # Set this to the path where you have checked out this repo to.
}

New-AzManagementGroupDeployment @inputObject

Azure CLI Example

dateYMD=$(date +%Y%m%dT%H%M%S%NZ)
DEPLOYMENTNAME="lz-vend-${dateYMD}"
MANAGEMENTGROUPID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" # Set this to the Management Group ID you wish to target the deployment against. NOTE: This isn't the Management Group that the Subscription will be moved to, that is specified via the parameters.
LOCATION="uksouth" # Set this to the Azure Region you wish the deployment to be targeted against. NOTE: This isn't the Region that the Subscription's resources will be deployed to, that is specified via the parameters.
TEMPLATEPARAMETERFILE="@/landingZones/lz1.parameters.json" # This would be changed to the specific file per landing zone.
TEMPLATEFILE="/main.bicep" # Set this to the path where you have checked out this repo to.

az deployment mg create --name ${DEPLOYMENTNAME:0:63} --parameters $TEMPLATEPARAMETERFILE --location $LOCATION --management-group-id $MANAGEMENTGROUPID --template-file $TEMPLATEFILE

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Details on contributing to this repo can be found here in the wiki 👍

Telemetry

When you deploy the Bicep landing zone vending module for Azure module, Microsoft can identify the installation of said module/s with the deployed Azure resources. Microsoft can correlate these resources used to support the software. Microsoft collects this information to provide the best experiences with their products and to operate their business. The telemetry is collected through customer usage attribution. The data is collected and governed by Microsoft's privacy policies.

If you don't wish to send usage data to Microsoft, details on how to turn it off can be found here..

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.