Skip to content

Commit 05bc6b6

Browse files
mbender-msmbender-ms
committed
new terraform article wip
1 parent 826ba00 commit 05bc6b6

File tree

6 files changed

+364
-0
lines changed

6 files changed

+364
-0
lines changed

‎quickstart/201-virtual-network-manager-cross-tenant/cross-tenant-hns.tf

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
/*
2+
* This template will create a network manager + Hub&Spoke configuration in the 'home' tenant
3+
* It will also create a vnet under a subscription in the 'away' tenant
4+
* It will then establish a cross-tenant connection, and add the vnet in the 'away' tenant to a network group managed by the connect config
5+
*/
6+
variable "home_tenant" {
7+
type = string
8+
description = "The tenant (guid) the network manager is in."
9+
}
10+
variable "home_sub" {
11+
type = string
12+
description = "The subscription (guid) the network manager is created under."
13+
}
14+
variable "away_tenant" {
15+
type = string
16+
description = "The tenant (guid) the cross-tenant vnet is in."
17+
}
18+
variable "away_sub" {
19+
type = string
20+
description = "The subscription (guid) the cross-tenant vnet is created under."
21+
}
22+
23+
# Azure Provider source and version being used
24+
terraform {
25+
required_providers {
26+
azurerm = {
27+
source = "hashicorp/azurerm"
28+
# 3.83.0 or higher is required to retrieve aux tokens correctly
29+
version = ">=4.15.0"
30+
}
31+
}
32+
}
33+
34+
# Setup initial 'home' tenant resources:
35+
# Resource group, network manager, network group, vnet, static member, connectivity configuration
36+
provider "azurerm" {
37+
features {}
38+
use_cli = true
39+
subscription_id = var.home_sub
40+
tenant_id = var.home_tenant
41+
auxiliary_tenant_ids = [var.away_tenant]
42+
}
43+
44+
data "azurerm_subscription" "home" {
45+
subscription_id = var.home_sub
46+
}
47+
48+
resource "azurerm_resource_group" "home" {
49+
name = "anm-resources"
50+
location = "East US"
51+
}
52+
53+
resource "azurerm_network_manager" "home" {
54+
name = "terraform-network-manager"
55+
location = azurerm_resource_group.home.location
56+
resource_group_name = azurerm_resource_group.home.name
57+
scope_accesses = ["Connectivity"]
58+
scope {
59+
subscription_ids = [data.azurerm_subscription.home.id]
60+
}
61+
description = "Network manager for cross-tenant management."
62+
}
63+
resource "azurerm_network_manager_network_group" "home" {
64+
name = "network-group"
65+
network_manager_id = azurerm_network_manager.home.id
66+
description = "Network group for cross-tenant static members."
67+
}
68+
69+
resource "azurerm_virtual_network" "home" {
70+
name = "home-tenant-vnet"
71+
resource_group_name = azurerm_resource_group.home.name
72+
location = azurerm_resource_group.home.location
73+
address_space = ["10.0.0.0/16"]
74+
subnet {
75+
name = "subnet1"
76+
address_prefixes = ["10.0.1.0/24"]
77+
default_outbound_access_enabled = "false"
78+
}
79+
}
80+
81+
# Connectivity configuration referencing in-tenant vnet as hub
82+
resource "azurerm_network_manager_connectivity_configuration" "home" {
83+
name = "cross-tenant-connectivity-conf"
84+
network_manager_id = azurerm_network_manager.home.id
85+
connectivity_topology = "HubAndSpoke"
86+
applies_to_group {
87+
group_connectivity = "DirectlyConnected"
88+
network_group_id = azurerm_network_manager_network_group.home.id
89+
}
90+
91+
hub {
92+
resource_id = azurerm_virtual_network.home.id
93+
resource_type = "Microsoft.Network/virtualNetworks"
94+
}
95+
}
96+
97+
# Setup initial 'away' tenant resources:
98+
# Resource group, vnet
99+
provider "azurerm" {
100+
features {}
101+
alias = "away"
102+
use_cli = true
103+
subscription_id = var.away_sub
104+
tenant_id = var.away_tenant
105+
}
106+
107+
data "azurerm_subscription" "away" {
108+
provider = azurerm.away
109+
subscription_id = var.away_sub
110+
}
111+
112+
resource "azurerm_resource_group" "away" {
113+
provider = azurerm.away
114+
name = "away-tenant-resources"
115+
location = "East US"
116+
}
117+
118+
resource "azurerm_virtual_network" "away" {
119+
provider = azurerm.away
120+
name = "away-tenant-vnet"
121+
resource_group_name = azurerm_resource_group.away.name
122+
location = azurerm_resource_group.away.location
123+
address_space = ["192.168.1.0/24"]
124+
}
125+
126+
# Create the cross-tenant connection resources
127+
resource "azurerm_network_manager_scope_connection" "home" {
128+
name = "scope-connection"
129+
network_manager_id = azurerm_network_manager.home.id
130+
tenant_id = var.away_tenant
131+
target_scope_id = data.azurerm_subscription.away.id
132+
description = "Used to manage cross-tenant subscription."
133+
}
134+
135+
resource "azurerm_network_manager_subscription_connection" "away" {
136+
provider = azurerm.away
137+
name = "subscription-connection"
138+
subscription_id = data.azurerm_subscription.away.id
139+
network_manager_id = azurerm_network_manager.home.id
140+
description = "Used to approve management from cross-tenant network manager."
141+
}
142+
143+
# Wait to ensure connection has been established async
144+
resource "time_sleep" "wait" {
145+
depends_on = [azurerm_network_manager_scope_connection.home, azurerm_network_manager_subscription_connection.away]
146+
create_duration = "30s"
147+
}
148+
149+
# Create a static member for the vnet in the 'away' tenant after connection is established
150+
resource "azurerm_network_manager_static_member" "home" {
151+
name = "cross-tenant-static-member"
152+
network_group_id = azurerm_network_manager_network_group.home.id
153+
target_virtual_network_id = azurerm_virtual_network.away.id
154+
depends_on = [time_sleep.wait]
155+
}

‎quickstart/201-virtual-network-manager-cross-tenant/main.tf

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
/*
2+
* This template will create a network manager + Hub&Spoke configuration in the 'home' tenant
3+
* It will also create a vnet under a subscription in the 'away' tenant
4+
* It will then establish a cross-tenant connection, and add the vnet in the 'away' tenant to a network group managed by the connect config
5+
*/
6+
7+
resource "random_pet" "rg_name_home" {
8+
prefix = var.resource_group_name_prefix
9+
}
10+
11+
resource "random_pet" "rg_name_away" {
12+
prefix = var.resource_group_name_prefix
13+
}
14+
15+
16+
resource "azurerm_resource_group" "rg_home" {
17+
location = var.resource_group_location
18+
name = random_pet.rg_name.id
19+
}
20+
21+
resource "azurerm_resource_group" "rg_away" {
22+
location = var.resource_group_location
23+
name = random_pet.rg_name.id
24+
}
25+
# Create three virtual networks
26+
resource "random_string" "prefix" {
27+
length = 4
28+
special = false
29+
upper = false
30+
}
31+
32+
resource "random_pet" "virtual_network_name" {
33+
prefix = "vnet-${random_string.prefix.result}"
34+
}
35+
36+
resource "azurerm_network_manager" "home" {
37+
name = "terraform-network-manager"
38+
location = azurerm_resource_group.home.location
39+
resource_group_name = azurerm_resource_group.home.name
40+
scope_accesses = ["Connectivity"]
41+
scope {
42+
subscription_ids = [data.azurerm_subscription.home.id]
43+
}
44+
description = "Network manager for cross-tenant management."
45+
}
46+
resource "azurerm_network_manager_network_group" "home" {
47+
name = "network-group"
48+
network_manager_id = azurerm_network_manager.home.id
49+
description = "Network group for cross-tenant static members."
50+
}
51+
52+
resource "azurerm_virtual_network" "home" {
53+
name = "home-tenant-vnet"
54+
resource_group_name = azurerm_resource_group.home.name
55+
location = azurerm_resource_group.home.location
56+
address_space = ["10.0.0.0/16"]
57+
subnet {
58+
name = "subnet1"
59+
address_prefixes = ["10.0.1.0/24"]
60+
default_outbound_access_enabled = "false"
61+
}
62+
}
63+
64+
# Connectivity configuration referencing in-tenant vnet as hub
65+
resource "azurerm_network_manager_connectivity_configuration" "home" {
66+
name = "cross-tenant-connectivity-conf"
67+
network_manager_id = azurerm_network_manager.home.id
68+
connectivity_topology = "HubAndSpoke"
69+
applies_to_group {
70+
group_connectivity = "DirectlyConnected"
71+
network_group_id = azurerm_network_manager_network_group.home.id
72+
}
73+
74+
hub {
75+
resource_id = azurerm_virtual_network.home.id
76+
resource_type = "Microsoft.Network/virtualNetworks"
77+
}
78+
}
79+
80+
# Setup initial 'away' tenant resources:
81+
# Resource group, vnet
82+
provider "azurerm" {
83+
features {}
84+
alias = "away"
85+
use_cli = true
86+
subscription_id = var.away_sub
87+
tenant_id = var.away_tenant
88+
}
89+
90+
data "azurerm_subscription" "away" {
91+
provider = azurerm.away
92+
subscription_id = var.away_sub
93+
}
94+
95+
resource "azurerm_resource_group" "away" {
96+
provider = azurerm.away
97+
name = "away-tenant-resources"
98+
location = "East US"
99+
}
100+
101+
resource "azurerm_virtual_network" "away" {
102+
provider = azurerm.away
103+
name = "away-tenant-vnet"
104+
resource_group_name = azurerm_resource_group.away.name
105+
location = azurerm_resource_group.away.location
106+
address_space = ["192.168.1.0/24"]
107+
}
108+
109+
# Create the cross-tenant connection resources
110+
resource "azurerm_network_manager_scope_connection" "home" {
111+
name = "scope-connection"
112+
network_manager_id = azurerm_network_manager.home.id
113+
tenant_id = var.away_tenant
114+
target_scope_id = data.azurerm_subscription.away.id
115+
description = "Used to manage cross-tenant subscription."
116+
}
117+
118+
resource "azurerm_network_manager_subscription_connection" "away" {
119+
provider = azurerm.away
120+
name = "subscription-connection"
121+
subscription_id = data.azurerm_subscription.away.id
122+
network_manager_id = azurerm_network_manager.home.id
123+
description = "Used to approve management from cross-tenant network manager."
124+
}
125+
126+
# Wait to ensure connection has been established async
127+
resource "time_sleep" "wait" {
128+
depends_on = [azurerm_network_manager_scope_connection.home, azurerm_network_manager_subscription_connection.away]
129+
create_duration = "30s"
130+
}
131+
132+
# Create a static member for the vnet in the 'away' tenant after connection is established
133+
resource "azurerm_network_manager_static_member" "home" {
134+
name = "cross-tenant-static-member"
135+
network_group_id = azurerm_network_manager_network_group.home.id
136+
target_virtual_network_id = azurerm_virtual_network.away.id
137+
depends_on = [time_sleep.wait]
138+
}

‎quickstart/201-virtual-network-manager-cross-tenant/outputs.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
output "resource_group_name" {
2+
value = azurerm_resource_group.rg.name
3+
}

‎quickstart/201-virtual-network-manager-cross-tenant/providers.tf

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
terraform {
2+
required_providers {
3+
azurerm = {
4+
source = "hashicorp/azurerm"
5+
# 3.83.0 or higher is required to retrieve aux tokens correctly
6+
version = ">=4.15.0"
7+
}
8+
random = {
9+
source = "hashicorp/random"
10+
version = "~>3.0"
11+
}
12+
}
13+
}
14+
15+
provider "azurerm" {
16+
features {}
17+
use_cli = true
18+
subscription_id = var.home_sub
19+
tenant_id = var.home_tenant
20+
auxiliary_tenant_ids = [var.away_tenant]
21+
}

‎quickstart/201-virtual-network-manager-cross-tenant/readme.md

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Azure resource group
2+
3+
This template deploys an Azure resource group with a random name beginning with "rg-".
4+
5+
## Terraform resource types
6+
7+
- [random_pet](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet)
8+
- [azurerm_resource_group](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group)
9+
10+
## Variables
11+
12+
| Name | Description | Default |
13+
|-|-|-|
14+
| `resource_group_name_prefix` | Prefix of the resource group name that's combined with a random ID so name is unique in your Azure subscription. | rg |
15+
| `resource_group_location` | Location of the resource group. | eastus |
16+
17+
## Example
18+
19+
To see how to run this example, see [Create an Azure resource group using Terraform](https://docs.microsoft.com/azure/developer/terraform/create-resource-group).

‎quickstart/201-virtual-network-manager-cross-tenant/variables.tf

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
variable "resource_group_location" {
2+
type = string
3+
default = "eastus"
4+
description = "Location of the resource group."
5+
}
6+
7+
variable "resource_group_name_prefix" {
8+
type = string
9+
default = "rg"
10+
description = "Prefix of the resource group name that's combined with a random ID so name is unique in your Azure subscription."
11+
}
12+
13+
variable "home_tenant" {
14+
type = string
15+
description = "The tenant (guid) the network manager is in."
16+
}
17+
variable "home_sub" {
18+
type = string
19+
description = "The subscription (guid) the network manager is created under."
20+
}
21+
variable "away_tenant" {
22+
type = string
23+
description = "The tenant (guid) the cross-tenant vnet is in."
24+
}
25+
variable "away_sub" {
26+
type = string
27+
description = "The subscription (guid) the cross-tenant vnet is created under."
28+
}

0 commit comments

Comments
 (0)