Skip to content

Commit 05e4f66

Browse files
author
sdeguchi
committed
feat: Adding updates for slz/fsi
Fixing linting
1 parent 9146b52 commit 05e4f66

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+1941
-2747
lines changed

‎templates/microsoft_cloud_for_industry/financial_services_landing_zone/README.md

+164-30
Original file line numberDiff line numberDiff line change
@@ -28,25 +28,6 @@ starter module during Phase 2. A copy of the `inputs.yaml` file to use can be fo
2828

2929
The description of inputs for this module are found in ALZ Accelerator documentation [here](https://aka.ms/fsi/terraform/inputs).
3030

31-
## Custom Compliance
32-
33-
### Custom Policy Sets
34-
35-
An example of the format for the `customer_policy_sets` map is as follows:
36-
37-
```yaml
38-
customer_policy_sets: {
39-
assignment1: {
40-
policySetDefinitionId: "/providers/Microsoft.Authorization/policySetDefinitions/d5264498-16f4-418a-b659-fa7ef418175f",
41-
policySetAssignmentName: "FedRAMPHigh",
42-
policySetAssignmentDisplayName: "FedRAMP High",
43-
policySetAssignmentDescription: "FedRAMP High",
44-
policySetManagementGroupAssignmentScope: "/providers/Microsoft.management/managementGroups/<MG-ID-SCOPE>",
45-
policyParameterFilePath: "./policy_parameters/policySetParameterSampleFile.json"
46-
}
47-
}
48-
```
49-
5031
### Policy Exemptions
5132

5233
An example of the format for the `policy_exemptions` map is as follows:
@@ -64,7 +45,83 @@ policy_exemptions: {
6445
}
6546
```
6647

67-
## Customize Application Landing Zones
48+
## Customize Management Group Configuration
49+
50+
### Default Management Group Configuration
51+
52+
NOTE - management_group_configuration archetypes array can be used for including non-ALZ archetypes.
53+
ALZ archetypes can be toggled using input variable apply_alz_archetypes_via_architecture_definition_template.
54+
55+
All archetypes(ALZ/FSI) can be found [here](https://github.com/Azure/Azure-Landing-Zones-Library/blob/main/platform/fsi/README.md).
56+
57+
The default format for the `management_group_configuration` map is as follows:
58+
59+
```yaml
60+
management_group_configuration: {
61+
root: {
62+
id: "${default_prefix}${optional_postfix}",
63+
display_name: "FSI Landing Zone",
64+
archetypes: ["fsi_root", "tr_01_logging", "re_01_zonal_residency", "so_04_cmk", "so_01_data_residency"]
65+
},
66+
platform: {
67+
id: "${default_prefix}-platform${optional_postfix}",
68+
display_name: "Platform",
69+
archetypes: []
70+
},
71+
landingzones: {
72+
id: "${default_prefix}-landingzones${optional_postfix}",
73+
display_name: "Landing Zones",
74+
archetypes: []
75+
},
76+
decommissioned: {
77+
id: "${default_prefix}-decommissioned${optional_postfix}",
78+
display_name: "Decommissioned",
79+
archetypes: []
80+
},
81+
sandbox: {
82+
id: "${default_prefix}-sandbox${optional_postfix}",
83+
display_name: "Sandbox",
84+
archetypes: []
85+
},
86+
management: {
87+
id: "${default_prefix}-platform-management${optional_postfix}",
88+
display_name: "Management",
89+
archetypes: []
90+
},
91+
connectivity: {
92+
id: "${default_prefix}-platform-connectivity${optional_postfix}",
93+
display_name: "Connectivity",
94+
archetypes: []
95+
},
96+
identity: {
97+
id: "${default_prefix}-platform-identity${optional_postfix}",
98+
display_name: "Identity",
99+
archetypes: []
100+
},
101+
corp: {
102+
id: "${default_prefix}-landingzones-corp${optional_postfix}",
103+
display_name: "Corp",
104+
archetypes: []
105+
},
106+
online: {
107+
id: "${default_prefix}-landingzones-online${optional_postfix}",
108+
display_name: "Online",
109+
archetypes: []
110+
},
111+
confidential_corp: {
112+
id: "${default_prefix}-landingzones-confidential-corp${optional_postfix}",
113+
display_name: "Confidential Corp",
114+
archetypes: ["confidential"]
115+
},
116+
confidential_online: {
117+
id: "${default_prefix}-landingzones-confidential-online${optional_postfix}",
118+
display_name: "Confidential Online",
119+
archetypes: ["confidential"]
120+
}
121+
}
122+
```
123+
124+
## Customize Application Platform/Landing Zones
68125

69126
### Landing Zone Management Group Children
70127

@@ -73,8 +130,23 @@ An example of the format for the `landing_zone_management_group_children` map is
73130
```yaml
74131
landing_zone_management_group_children: {
75132
child1: {
76-
id: "child1",
77-
display_name: "Landing zone child one"
133+
id: "${default_prefix}-landingzones-child1${optional_postfix}",
134+
display_name: "Landing zone child one",
135+
archetypes: []
136+
}
137+
}
138+
```
139+
140+
### Platform Management Group Children
141+
142+
An example of the format for the `platform_management_group_children` map is as follows:
143+
144+
```yaml
145+
platform_management_group_children: {
146+
security: {
147+
id: "${default_prefix}-platform-security${optional_postfix}",
148+
display_name: "Security",
149+
archetypes: ["confidential"]
78150
}
79151
}
80152
```
@@ -155,17 +227,24 @@ Any updates should be made to the `inputs.yaml` and run the ALZ powershell & rer
155227

156228
There is no validation done to ensure subnets fall within the hub network CIDR or that subnets do not overlap. These issues will be uncovered during apply.
157229

158-
### Unable to Build Authorizer for Resource Manager API
159-
160-
It is necessary to rerun `az login` after creating subscriptions for terraform to pick up that they exist.
161-
162-
### Unable to Update Address Prefixes
230+
### Unable to update the bastion subnet
163231

164-
Updating the address prefix on either the hub network or subnets is not supported at this time.
232+
Workaround:
233+
Set deploy_bastion= false in inputs file
234+
Run deployAccelerator command
235+
Run .\scripts\deploy-local.ps1
236+
Set deploy_bastion= true in inputs file, update AzureBastionSubnet address_prefix
237+
Run deployAccelerator command
238+
Run .\scripts\deploy-local.ps1
165239

166-
### Unable to Change Top Level or Sub Level Management Group Names
240+
### Unable to update the firewall subnet
167241

168-
Modifying the Top Level or Sub Level Management Group name is not supported at this time.
242+
Work around:
243+
Set deploy_bastion= false and enable_firewall = false in inputs file
244+
Run deployAccelerator command
245+
Run .\scripts\deploy-local.ps1
246+
Set deploy_bastion= true and enable_firewall = true in inputs file, update AzureFirewallSubnet address_prefix
247+
Run deployAccelerator command
169248

170249
### Tags are Not Applied to All Resources
171250

@@ -174,3 +253,58 @@ Certain resources are not receiving the default tags. This will be addressed in
174253
### Default Compliance Score is not 100%
175254

176255
Certain resources will show as being out of compliance by default. This will be addressed in a future release.
256+
257+
## Notes about Policy Remediations
258+
259+
1. Policy Definition [migrateToMdeTvm](/providers/Microsoft.Authorization/policyDefinitions/766e621d-ba95-4e43-a6f2-e945db3d7888) will be excluded from remediation as customers must [enable MDFC](https://learn.microsoft.com/en-us/azure/defender-for-cloud/connect-azure-subscription?WT.mc_id=Portal-HubsExtension) on their subscriptions for this policy and then run remediation via Azure portal.
260+
261+
2. Log analytics polices deploy-diag-logscat, deploy-azactivity-log, and tr-01-logging(included with FSI) will be skipped for remediation until customer has set the log_analytics_workspace_resource_id(output after successful deployment of LZ) input and re-run deploy-accelerator/deploy-local.ps1.
262+
263+
3. Updating assignment policies or management group configuration will trigger recreation of azapi policy remediation resources -
264+
Because customers have the option to include custom policies with built-in policy set definitions, and remediations require the policyReferenceId for policy definitions in policy sets, the policyReferenceId must be queried dynamically and due to Terraform's limitations on creating resources in a for_each, remediations will get recreated as the result of a workaround for allowing this dynamic query.
265+
Remediation tasks will only be created if a policy is not in compliance.
266+
267+
There is an experimental feature that would allow the dynamic creation of resources in a for_each, but work on this is on-going.
268+
269+
## Notes running on non-global admin service principal
270+
271+
To deploy with lowered permissions using a service principal with "Owner" role assignment at the tenant root management group, set the following environment variable in powershell:
272+
273+
```powershell
274+
$env:AZAPI_RETRY_GET_AFTER_PUT_MAX_TIME="30m"
275+
```
276+
277+
## Notes on required permissions for optional security group creation
278+
279+
The following permissions are needed for [security group creation](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/group#api-permissions)
280+
281+
Security group creation can be disabled by setting input `management_security_groups = []`. Also, security groups in management_security_groups are case-sensitive.
282+
283+
## Instructions for using custom policies and updating parameter values for ALZ or FSI policies
284+
285+
Custom policies can be added to the `lib` directory in the root of the starter module. Here is an example in the [AVM terraform-azurerm-avm-ptn-alz](https://github.com/Azure/terraform-azurerm-avm-ptn-alz/tree/main/examples/policy-assignment-modification-with-custom-lib/lib) repo.
286+
287+
NOTE - Customers can also include custom [policy set definition](https://github.com/Azure/Azure-Landing-Zones-Library/blob/main/platform/fsi/policy_set_definitions/SO-01-Data-Residency.alz_policy_set_definition.json) and
288+
[policy definition](https://github.com/Azure/Azure-Landing-Zones-Library/blob/main/platform/alz/policy_definitions/Append-AppService-latestTLS.alz_policy_definition.json) ARM templates into the `lib` directory.
289+
File names must contain the same format as in the given examples.
290+
291+
Customers can also update policy parameter values for ALZ or FSI policies by including an updated copy of the policy file in the `lib` directory. The new file will overwrite the existing policy file in the module. The new file must contain the same format as the original policy file.
292+
293+
## Instructions updating policy default values
294+
295+
In the starter module locals.tf, customers can update the fsi_policy_default_values for any of the parameters set in this [example](https://github.com/Azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/management/main.tf#L43C4-L50).
296+
297+
```terraform
298+
fsi_policy_default_values = {
299+
fsi_policy_effect = jsonencode({ value = var.policy_effect })
300+
allowed_locations_for_confidential_computing = jsonencode({ value = var.allowed_locations_for_confidential_computing })
301+
allowed_locations = jsonencode({ value = var.allowed_locations })
302+
ddos_protection_plan_id = jsonencode({ value = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder/providers/Microsoft.Network/ddosProtectionPlans/placeholder" })
303+
ddos_protection_plan_effect = jsonencode({ value = var.deploy_ddos_protection ? "Audit" : "Disabled" })
304+
email_security_contact = jsonencode({ value = var.ms_defender_for_cloud_email_security_contact })
305+
ama_user_assigned_managed_identity_id = jsonencode({ value = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder/providers/Microsoft.ManagedIdentity/userAssignedIdentities/${local.uami_name}" })
306+
ama_user_assigned_managed_identity_name = jsonencode({ value = local.uami_name })
307+
log_analytics_workspace_id = jsonencode({ value = var.log_analytics_workspace_resource_id })
308+
tr_01_log_analytics_workspace_id = jsonencode({ value = var.log_analytics_workspace_resource_id })
309+
}
310+
```

‎templates/microsoft_cloud_for_industry/financial_services_landing_zone/examples/bootstrap/inputs-azure-devops.yaml

+73-9
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,8 @@ architecture_definition_name: "fsi"
3333
apply_alz_archetypes_via_architecture_definition_template: true
3434

3535
# Starter Module Specific Variables
36-
allowed_locations: []
37-
allowed_locations_for_confidential_computing: []
36+
allowed_locations: ["<region-1>"]
37+
allowed_locations_for_confidential_computing: ["<region-1>"]
3838
az_firewall_policies_enabled: true
3939
bastion_outbound_ssh_rdp_ports: ["22", "3389"]
4040
custom_subnets: {
@@ -58,29 +58,93 @@ custom_subnets: {
5858
}
5959
}
6060
customer: "Country/Region"
61-
customer_policy_sets: {}
62-
default_postfix: ""
61+
optional_postfix: ""
6362
default_prefix: "fsi"
6463
deploy_bastion: true
64+
deploy_bootstrap: true
65+
deploy_dashboard: true
6566
deploy_ddos_protection: true
6667
deploy_hub_network: true
6768
deploy_log_analytics_workspace: true
69+
deploy_platform: true
6870
enable_firewall: true
6971
enable_telemetry: true
7072
express_route_gateway_config: {name: "noconfigEr"}
7173
hub_network_address_prefix: "10.20.0.0/16"
7274
landing_zone_management_group_children: {}
75+
log_analytics_workspace_resource_id: "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder/providers/Microsoft.OperationalInsights/workspaces/placeholder-la"
7376
log_analytics_workspace_retention_in_days: "365"
77+
management_group_configuration: {
78+
root: {
79+
id: "${default_prefix}${optional_postfix}",
80+
display_name: "FSI Landing Zone",
81+
archetypes: ["fsi_root", "tr_01_logging", "re_01_zonal_residency", "so_04_cmk", "so_01_data_residency"]
82+
},
83+
platform: {
84+
id: "${default_prefix}-platform${optional_postfix}",
85+
display_name: "Platform",
86+
archetypes: []
87+
},
88+
landingzones: {
89+
id: "${default_prefix}-landingzones${optional_postfix}",
90+
display_name: "Landing Zones",
91+
archetypes: []
92+
},
93+
decommissioned: {
94+
id: "${default_prefix}-decommissioned${optional_postfix}",
95+
display_name: "Decommissioned",
96+
archetypes: []
97+
},
98+
sandbox: {
99+
id: "${default_prefix}-sandbox${optional_postfix}",
100+
display_name: "Sandbox",
101+
archetypes: []
102+
},
103+
management: {
104+
id: "${default_prefix}-platform-management${optional_postfix}",
105+
display_name: "Management",
106+
archetypes: []
107+
},
108+
connectivity: {
109+
id: "${default_prefix}-platform-connectivity${optional_postfix}",
110+
display_name: "Connectivity",
111+
archetypes: []
112+
},
113+
identity: {
114+
id: "${default_prefix}-platform-identity${optional_postfix}",
115+
display_name: "Identity",
116+
archetypes: []
117+
},
118+
corp: {
119+
id: "${default_prefix}-landingzones-corp${optional_postfix}",
120+
display_name: "Corp",
121+
archetypes: []
122+
},
123+
online: {
124+
id: "${default_prefix}-landingzones-online${optional_postfix}",
125+
display_name: "Online",
126+
archetypes: []
127+
},
128+
confidential_corp: {
129+
id: "${default_prefix}-landingzones-confidential-corp${optional_postfix}",
130+
display_name: "Confidential Corp",
131+
archetypes: ["confidential"]
132+
},
133+
confidential_online: {
134+
id: "${default_prefix}-landingzones-confidential-online${optional_postfix}",
135+
display_name: "Confidential Online",
136+
archetypes: ["confidential"]
137+
}
138+
}
139+
default_security_groups: []
74140
ms_defender_for_cloud_email_security_contact: "[email protected]"
75-
policy_assignment_enforcement_mode: "Default"
141+
platform_management_group_children: {}
76142
policy_effect: "Deny"
77143
policy_exemptions: {}
78-
subscription_billing_scope: ""
79-
tags: {}
80-
top_level_management_group_name: "Financial Services Landing Zone"
144+
tags: {serviceName: "fsi"}
81145
use_premium_firewall: true
82146
vpn_gateway_config: {name: "noconfigVpn"}
83147

84148
# Advanced Inputs
85-
bootstrap_module_version: "v4.1.8"
149+
bootstrap_module_version: "v4.3.4"
86150
starter_module_version: "latest"

0 commit comments

Comments
 (0)