Skip to content

Commit 47984f4

Browse files
jfaurskovjfaurskov
authored
Merge branch 'Azure:main' into main
2 parents a58fbe7 + f9ba35d commit 47984f4

File tree

264 files changed

+38048
-6450
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

264 files changed

+38048
-6450
lines changed

‎.github/ISSUE_TEMPLATE/Policy_Submission.yml

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
name: Policy Submission
2+
description: Submit an Azure policy/initiative for Azure Landing Zone
3+
title: "[Policy]: "
4+
labels: ["policy"]
5+
projects: []
6+
assignees:
7+
- springstone
8+
body:
9+
- type: markdown
10+
attributes:
11+
value: Thanks for taking the time to fill out this policy submission!
12+
- type: dropdown
13+
id: policytype
14+
attributes:
15+
label: Policy Definition or Initiative
16+
description: Are you proposing a policy definition or initiative definition?
17+
options:
18+
- Definition
19+
- Initiative
20+
- Not sure
21+
default: 0
22+
validations:
23+
required: true
24+
- type: dropdown
25+
id: builtincustom
26+
attributes:
27+
label: Built-in/Custom
28+
description: Is the policy definition or initiative built-in or are you proposing a custom one?
29+
options:
30+
- Built-in
31+
- Custom
32+
- Not sure
33+
default: 0
34+
validations:
35+
required: true
36+
- type: input
37+
id: resourceid
38+
attributes:
39+
label: Built-in policy definition or initiative ID
40+
description: If this is for a built in policy definition or initiative, please provide the resource ID
41+
value: "<GUID>"
42+
validations:
43+
required: false
44+
- type: textarea
45+
id: description
46+
attributes:
47+
label: Custom policy definition or initiative description
48+
description: If this is a custom policy definition or initiative, please provide a description of what it should do.
49+
placeholder: A policy that
50+
value: "A policy that does ..."
51+
validations:
52+
required: true
53+
- type: dropdown
54+
id: assignmentscope
55+
attributes:
56+
label: Scope
57+
description: What scope (Management Group) should the policy definition or initiative be assigned to?
58+
options:
59+
- Intermediate Root
60+
- Platform
61+
- Connectivity
62+
- Management
63+
- Identity
64+
- Landing Zones
65+
- Corp
66+
- Online
67+
- Decommissioned
68+
- Sandbox
69+
- Multiple / Other
70+
default: 0
71+
validations:
72+
required: true
73+
- type: checkboxes
74+
id: defaultassignment
75+
attributes:
76+
label: Default Assignment
77+
description: Should the policy definition or initiative be assigned by default to the scope above in Azure Landing Zone?
78+
options:
79+
- label: "Yes"
80+
- type: textarea
81+
id: Comments
82+
attributes:
83+
label: Comments/thoughts
84+
description: Do you have any additional comments/thoughts?

‎.github/actions-pester/PTF-TestPolicies.ps1

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
Import-Module -Name $PSScriptRoot\PolicyPesterTestHelper.psm1 -Force -Verbose
2+
Import-Module Pester -Force
3+
4+
function RunPester
5+
{
6+
param (
7+
[Parameter()]
8+
[String]$PolicyTest
9+
)
10+
11+
$pesterConfiguration = @{
12+
Run = @{
13+
Container = New-PesterContainer -Path $PolicyTest
14+
PassThru = $true
15+
}
16+
Output = @{
17+
Verbosity = 'Detailed'
18+
CIFormat = 'Auto'
19+
}
20+
}
21+
$result = Invoke-Pester -Configuration $pesterConfiguration
22+
#exit $result.FailedCount
23+
}
24+
25+
$ModifiedFiles = @(Get-PolicyFiles -DiffFilter "M")
26+
if ([String]::IsNullOrEmpty($ModifiedFiles))
27+
{
28+
Write-Warning "These are the modified policies: $($ModifiedFiles)"
29+
}
30+
else
31+
{
32+
Write-Warning "There are no modified policies"
33+
}
34+
35+
$AddedFiles = @(Get-PolicyFiles -DiffFilter "A")
36+
if ([String]::IsNullOrEmpty($AddedFiles))
37+
{
38+
Write-Warning "These are the added policies: $($AddedFiles)"
39+
}
40+
else
41+
{
42+
Write-Warning "There are no added policies"
43+
}
44+
45+
$ModifiedAddedFiles = $ModifiedFiles + $AddedFiles
46+
47+
$ModifiedAddedFiles | ForEach-Object {
48+
49+
$PolicyFile = Split-Path $_ -Leaf
50+
$PolicyFileClean = $PolicyFile -replace ".json", ""
51+
52+
$testPath = "tests/policy/$($PolicyFileClean).Tests.ps1"
53+
54+
if (Test-Path $testPath)
55+
{
56+
Write-Warning "Running pester tests on $PolicyFileClean"
57+
RunPester($testPath)
58+
}
59+
else
60+
{
61+
Write-Warning "There are no tests for $PolicyFileClean"
62+
}
63+
}

‎.github/workflows/test-portal.yml

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ env:
2525
GITHUB_PR_ID: ${{ github.event.pull_request.id }}
2626
TEMP_SUBSCRIPTIONS_JSON_PATH: "./src/data/subscriptions.json"
2727
TEMP_DEPLOYMENT_OBJECT_PATH: "./src/data/eslzArm.test.deployment.json"
28+
POLICY_DIR: "src/resources/Microsoft.Authorization/policyDefinitions"
29+
POLICYSET_DIR: "src/resources/Microsoft.Authorization/policySetDefinitions"
2830

2931
permissions:
3032
contents: read
@@ -65,6 +67,7 @@ jobs:
6567
- name: Check out repository
6668
uses: actions/checkout@v3
6769
with:
70+
fetch-depth: 0
6871
ref: ${{ github.event.pull_request.head.sha }}
6972
persist-credentials: false
7073

@@ -149,21 +152,10 @@ jobs:
149152
Update-AzConfig -DisplayBreakingChangeWarning $false
150153
151154
- name: Pester Test for Policies
152-
shell: pwsh
153-
run: |
154-
Import-Module Pester -Force
155-
$pesterConfiguration = @{
156-
Run = @{
157-
Path = "tests/*.tests.ps1"
158-
PassThru = $true
159-
}
160-
Output = @{
161-
Verbosity = 'Detailed'
162-
CIFormat = 'Auto'
163-
}
164-
}
165-
$result = Invoke-Pester -Configuration $pesterConfiguration
166-
exit $result.FailedCount
155+
uses: azure/powershell@v1
156+
with:
157+
inlineScript: ./.github/actions-pester/PTF-TestPolicies.ps1
158+
azPSVersion: "latest"
167159
env:
168160
SUBSCRIPTION_ID: ${{ secrets.AZURE_POLICY_SUBSCRIPTION1_ID }}
169161
SUBSCRIPTION2_ID: ${{ secrets.AZURE_POLICY_SUBSCRIPTION2_ID }} #Used for policy tests that require a second subscription (e.g. cross subscription peering)

‎.github/workflows/update-alz-tools.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ jobs:
8181
run: |
8282
mapfile -t CHECK_GIT_STATUS < <(git status -s)
8383
printf "%s\n" "${CHECK_GIT_STATUS[@]}"
84-
echo "::set-output name=changes::${#CHECK_GIT_STATUS[@]}"
84+
echo "changes=${#CHECK_GIT_STATUS[@]}" >> "$GITHUB_OUTPUT"
8585
8686
- name: Add files, commit and push
8787
if: steps.git_status.outputs.changes > 0

‎.github/workflows/update-portal.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,9 @@ jobs:
8080
- name: Update policies
8181
run: bicep build ./src/templates/policies.bicep --outfile ./eslzArm/managementGroupTemplates/policyDefinitions/policies.json
8282

83+
- name: Update policy set definitions (initiatives)
84+
run: bicep build ./src/templates/initiatives.bicep --outfile ./eslzArm/managementGroupTemplates/policyDefinitions/initiatives.json
85+
8386
- name: Update roles
8487
run: bicep build ./src/templates/roles.bicep --outfile ./eslzArm/managementGroupTemplates/roleDefinitions/customRoleDefinitions.json
8588

‎.github/workflows/wiki-sync.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@ jobs:
2323
name: Sync docs/wiki to Wiki
2424
if: github.repository == 'Azure/Enterprise-Scale' || github.event_name == 'workflow_dispatch'
2525
runs-on: ubuntu-latest
26+
permissions:
27+
contents: write
28+
2629
steps:
2730
- name: Checkout Source Repo
2831
uses: actions/checkout@v2

‎README.md

Lines changed: 15 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Enterprise-Scale - Reference Implementation
1+
# Azure Landing Zones (Enterprise-Scale) - Reference Implementation
22

33
[![Average time to resolve an issue](http://isitmaintained.com/badge/resolution/azure/enterprise-scale.svg)](http://isitmaintained.com/project/azure/enterprise-scale "Average time to resolve an issue")
44
[![Percentage of issues still open](http://isitmaintained.com/badge/open/azure/enterprise-scale.svg)](http://isitmaintained.com/project/azure/enterprise-scale "Percentage of issues still open")
@@ -11,21 +11,21 @@ To find out more about the Azure landing zones reference implementation, please
1111

1212
## Objective
1313

14-
The Enterprise-Scale architecture provides prescriptive guidance coupled with Azure best practices, and it follows design principles across the critical design areas for organizations to define their Azure architecture. It will continue to evolve alongside the Azure platform and is ultimately defined by the various design decisions that organizations must make to define their Azure journey.
14+
The Azure Landing Zones (Enterprise-Scale) architecture provides prescriptive guidance coupled with Azure best practices, and it follows design principles across the critical design areas for organizations to define their Azure architecture. It will continue to evolve alongside the Azure platform and is ultimately defined by the various design decisions that organizations must make to define their Azure journey.
1515

16-
The Enterprise-Scale architecture is modular by design and allows organizations to start with foundational landing zones that support their application portfolios, and the architecture enables organizations to start as small as needed and scale alongside their business requirements regardless of scale point.
16+
The Azure Landing Zones (Enterprise-Scale) architecture is modular by design and allows organizations to start with foundational landing zones that support their application portfolios, and the architecture enables organizations to start as small as needed and scale alongside their business requirements regardless of scale point.
1717

1818
![Animated image showing the modularity of Azure landing zones](./docs/wiki/media/ESLZ.gif)
1919

2020
---
2121

22-
_The Enterprise-Scale architecture represents the strategic design path and target technical state for your Azure environment._
22+
_The Azure Landing Zones (Enterprise-Scale) architecture represents the strategic design path and target technical state for your Azure environment._
2323

2424
---
2525

2626
Not all enterprises adopt Azure in the same way, so the Enterprise-Scale architecture may vary between customers. Ultimately, the technical considerations and design recommendations of the Enterprise-Scale architecture may lead to different trade-offs based on the customer's scenario. Some variation is expected, but if core recommendations are followed, the resulting target architecture will put the customer on a path to sustainable scale.
2727

28-
The Enterprise-Scale reference implementations in this repository are intended to support Enterprise-Scale Azure adoption and provides prescriptive guidance based on authoritative design for the Azure platform as a whole.
28+
The Azure Landing Zones (Enterprise-Scale) reference implementations in this repository are intended to support Enterprise-Scale Azure adoption and provides prescriptive guidance based on authoritative design for the Azure platform as a whole.
2929

3030
| Key customer landing zone requirement | Enterprise-Scale reference implementations |
3131
|----------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
@@ -42,26 +42,24 @@ The Enterprise-Scale reference implementations in this repository are intended t
4242

4343
## Conditions for success
4444

45-
To fully leverage this reference implementation in this repository, readers must have a collaborative engagement with key customer stakeholders across critical technical domains, such as identity, security, and networking. Ultimately, the success of cloud adoption hinges on cross-discipline cooperation within the organization, since key requisite Enterprise-Scale design decisions are cross cutting, and to be authoritative must involve domain Subject Matter Expertise (SME) and stakeholders within the customer. It is crucial that the organization has defined their [Enterprise-Scale Architecture](./docs/EnterpriseScale-Architecture.md) following the design principles and critical design areas.
45+
To fully leverage this reference implementation in this repository, readers must have a collaborative engagement with key customer stakeholders across critical technical domains, such as identity, security, and networking. Ultimately, the success of cloud adoption hinges on cross-discipline cooperation within the organization, since key requisite Enterprise-Scale design decisions are cross cutting, and to be authoritative must involve domain Subject Matter Expertise (SME) and stakeholders within the customer. It is crucial that the organization has defined their [Azure Landing Zones (Enterprise-Scale) Architecture](./docs/EnterpriseScale-Architecture.md) following the design principles and critical design areas.
4646

47-
It is also assumed that readers have a broad understanding of key Azure constructs and services in order to fully contextualize the prescriptive recommendations contained within Enterprise-Scale.
47+
It is also assumed that readers have a broad understanding of key Azure constructs and services in order to fully contextualize the prescriptive recommendations contained within Azure Landing Zones (Enterprise-Scale).
4848
<!--
4949
![Enterprise-Scale ](./docs/wiki/media/ES-process.png)
5050
-->
5151

52-
## Deploying Enterprise-Scale Architecture in your own environment
52+
## Deploying Azure Landing Zones (Enterprise-Scale Architecture) in your own environment
5353

54-
The Enterprise-Scale architecture is modular by design and allows customers to start with foundational Landing Zones that support their application portfolios, regardless of whether the applications are being migrated or are newly developed and deployed to Azure. The architecture can scale alongside the customer's business requirements regardless of scale point. In this repository we are providing the following five templates representing different scenarios composed using ARM templates.
54+
The Azure Landing Zones (Enterprise-Scale Architecture) is modular by design and allows customers to start with foundational Landing Zones that support their application portfolios, regardless of whether the applications are being migrated or are newly developed and deployed to Azure. The architecture can scale alongside the customer's business requirements regardless of scale point. In this repository we are providing the following five templates representing different scenarios composed using ARM templates.
5555

56-
| Reference implementation | Description | ARM Template | Link |
57-
|:-------------------------|:-------------|:-------------|------|
58-
| Contoso | On-premises connectivity using Azure vWAN |[![Deploy To Azure](https://learn.microsoft.com/en-us/azure/templates/media/deploy-to-azure.svg)](https://portal.azure.com/#blade/Microsoft_Azure_CreateUIDef/CustomDeploymentBlade/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FEnterprise-Scale%2Fmain%2FeslzArm%2FeslzArm.json/uiFormDefinitionUri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FEnterprise-Scale%2Fmain%2FeslzArm%2Feslz-portal.json) | [Detailed description](./docs/reference/contoso/Readme.md) |
59-
| AdventureWorks | On-premises connectivity with Hub & Spoke |[![Deploy To Azure](https://learn.microsoft.com/en-us/azure/templates/media/deploy-to-azure.svg)](https://portal.azure.com/#blade/Microsoft_Azure_CreateUIDef/CustomDeploymentBlade/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FEnterprise-Scale%2Fmain%2FeslzArm%2FeslzArm.json/uiFormDefinitionUri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FEnterprise-Scale%2Fmain%2FeslzArm%2Feslz-portal.json) | [Detailed description](./docs/reference/adventureworks/README.md) |
60-
| WingTip | Azure without hybrid connectivity |[![Deploy To Azure](https://learn.microsoft.com/en-us/azure/templates/media/deploy-to-azure.svg)](https://portal.azure.com/#blade/Microsoft_Azure_CreateUIDef/CustomDeploymentBlade/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FEnterprise-Scale%2Fmain%2FeslzArm%2FeslzArm.json/uiFormDefinitionUri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FEnterprise-Scale%2Fmain%2FeslzArm%2Feslz-portal.json) | [Detailed description](./docs/reference/wingtip/README.md) |
61-
| Trey Research | On-premises connectivity with Hub and Spoke for small Enterprises | [![Deploy To Azure](https://learn.microsoft.com/en-us/azure/templates/media/deploy-to-azure.svg)](https://portal.azure.com/#blade/Microsoft_Azure_CreateUIDef/CustomDeploymentBlade/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FEnterprise-Scale%2Fmain%2Fdocs%2Freference%2Ftreyresearch%2FarmTemplates%2Fes-lite.json/createUIDefinitionUri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FEnterprise-Scale%2Fmain%2Fdocs%2Freference%2Ftreyresearch%2FarmTemplates%2Fportal-es-lite.json) | [Detailed description](./docs/reference/treyresearch/README.md) |
62-
| Azure Gov | Reference implementation that can be deployed to Azure gov and includes all options in a converged experience | [![Deploy To Azure](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.svg?sanitize=true)](https://portal.azure.us/#blade/Microsoft_Azure_CreateUIDef/CustomDeploymentBlade/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FEnterprise-Scale%2Fmain%2FeslzArm%2FeslzArm.json/uiFormDefinitionUri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FEnterprise-Scale%2Fmain%2FeslzArm%2Ffairfaxeslz-portal.json) | N/A
56+
[![Deploy To Azure](https://learn.microsoft.com/en-us/azure/templates/media/deploy-to-azure.svg)](https://aka.ms/alz/portal)
6357

64-
> The Bicep version is now available in Public Preview here: [https://github.com/Azure/ALZ-Bicep](https://github.com/Azure/ALZ-Bicep)
58+
You can find all of the implementation options for Azure Landing Zones here: [aka.ms/alz/aac](https://aka.ms/alz/aac#platform)
59+
60+
## Azure Landing Zones Roadmap
61+
62+
The Azure Landing Zones (Enterprise-Scale) architecture is continuously updated to align with advancements in the Azure platform and insights from customer feedback. For detailed information on future updates, please refer to the roadmap at: [Azure Landing Zones Roadmap](https://aka.ms/alz/roadmap)
6563

6664
## Contributing
6765

‎docs/reference/adventureworks/README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,10 @@ Please refer to the [Enterprise-Scale Landing Zones User Guide](https://github.c
2525

2626
If customer started with a Enterprise-Scale foundation deployment, and if the business requirements changes over time, such as migration of on-premise applications to Azure that requires hybrid connectivity, you will simply create the **Connectivity** Subscription, place it into the **Platform > Connectivity** Management Group and assign Azure Policy for the hub and spoke network topology.
2727

28-
## Pre-requisites
28+
## Prerequisites
2929

30-
To deploy this ARM template, your user/service principal must have Owner permission at the Tenant root.
31-
See the following [instructions](../../EnterpriseScale-Setup-azure.md) on how to grant access.
30+
To deploy this ARM template, there are a number of prerequisites that must be met.
31+
See [here](../../wiki/Deploying-ALZ-Pre-requisites.md) for more details.
3232

3333
### Optional prerequisites
3434

‎docs/reference/contoso/Readme.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,10 @@ Please refer to [Enterprise-Scale Landing Zones User Guide](https://github.com/A
2222

2323
If customer started with a Enterprise-Scale foundation deployment, and if the business requirements changes over time, such as migration of on-prem applications to Azure that requires hybrid connectivity, you will simply create the **Connectivity** Subscription and place it into the **Platform > Connectivity** Management Group and assign Azure Policy for the VWAN network topology.
2424

25-
## Pre-requisites
25+
## Prerequisites
2626

27-
To deploy this ARM template, your user/service principal must have Owner permission at the Tenant root.
28-
See the following [instructions](../../EnterpriseScale-Setup-azure.md) on how to grant access.
27+
To deploy this ARM template, there are a number of prerequisites that must be met.
28+
See [here](../../wiki/Deploying-ALZ-Pre-requisites.md) for more details.
2929

3030
### Optional prerequisites
3131

0 commit comments

Comments
 (0)