We would like to inform you that this repository has been archived and the Bicep landing zone vending module for Azure now has a new home in the Bicep public registry and is now a pattern module in the Azure Verified Modules initiative.
- This repository is now in a read-only state.
- No further issues, pull requests, or updates will be maintained on this repository.
- All future releases, fixes and improvements will be managed in the new AVM pattern module hosted on the Bicep public registry.
- We will continue to leverage the Wiki in this repository as the module's additional documentation and guidance location.
We are converting this module to be an Azure Verified pattern module to better align with the Azure Verified Modules initiative. This will help us align with the Well-architected framework guidance, have improved module support and provide you with a consistent experience consuming AVM Bicep modules.
📒 If you are not familiar with Azure Verified Modules, you can watch the following Youtube videos for a quick overview:
- An Introduction to Azure Verified Modules (AVM) by the Customer Architecture & Engineering team 📽️🎬🎞️
- Azure Verified Modules Overview by John Savill 📽️🎬🎞️
If I'm already using the Bicep Subscription vending module from the Bicep public registry, what do I need to change?
We tried as much as possible to have a smooth transition path with minimal breaking changes. To switch to the new module:
- Review the documentation for the new AVM module.
- Change the module reference in your code to reference
br/public:avm/ptn/lz/sub-vending:x.x.xinstead ofbr/public:lz/sub-vending:x.x.x - If you have a preference on sharing deployment elemetry for this module, the parameter
disableTelemetryhas been changed toenableTelemetry. This change is due to AVM modules mandate the use of this parameter.
NOTE: After the migration to Azure Verified Modules, version
1.5.2of the Subscription Vending module is now0.1.0in the Bicep public registry.
For any issues, suggestions or feedback for this module, please open an issue on the Bicep public registry.
Thank you for your understanding and continued support.
__________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________;
ℹ️ This module requires the usage of Bicep version
v0.11.1or later. For details on installing/upgrading Bicep see: Install Bicep tools ℹ️ℹ️ This module is also available on the Bicep Module Registry here. Examples also included in our wiki examples. ℹ️
The landing zone Bicep modules are designed to accelerate deployment of the individual landing zones (aka Subscriptions) within an Microsoft Entra Tenant.
See the different types of landing zones in the Azure Landing Zones documentation here: What is an Azure landing zone? - Platform vs. application landing zones
The modules are designed to be instantiated many times, once for each desired landing zone.
This is currently split logically into the following capabilities:
- Subscription creation and management group placement
- Networking - deploy a Virtual Network with, optional:
- Hub & spoke connectivity (peering to a hub Virtual Network)
- Virtual WAN connectivity (peering to a Virtual Hub via a Virtual Hub Connection)
- Including support for connections to Virtual WAN Hubs with Routing Intent configured
- Link to existing DDoS Network Protection Plan
- Specify Custom DNS Servers
- Role assignments
- Tags
- Resource providers and resource providers features registration
When creating Virtual Network peerings, be aware of the limit of peerings per Virtual Network.
We would like feedback on what's missing in the module. Please raise an issue if you have any suggestions.
Please see this repositories GitHub releases for information on the latest changes and releases.
Please see the content in the wiki for more detailed information about the module and various other pieces of documentation.
Please see the Known Issues in the wiki.
Parameters documented here: main.bicep.parameters.md.
Details on each of the parameters, including examples and an example parameter file (this is not a valid parameter file as all parameters contain values, so you must remove the un-required parameters or set them back to their default value, as documented), for the main.bicep module can be found here: main.bicep.parameters.md.
These docs are automatically generated using PSDocs.Azure from the Bicep module file itself and this GitHub Action as part of PRs that amend this Bicep module.
We have a Consumer Guide available for guidance on how to consume this module.
For more examples please see the wiki and if you cannot find an example you are looking for please raise an issue on the repo 👍
Below is an example showing how to use this module.
Most commonly this module will be deployed using PowerShell, with the Azure Az Module, with a supporting .json parameters file, one per landing zone to create/vend. Or the same approach but using the Azure CLI.
IMPORTANT: The below example requires you have cloned/downloaded the entire repo and have it available at run-time on the machine running the below commands. It is also expected you are in the root of the cloned/extracted repository; otherwise paths will need to be changed in the below example.
$inputObject = @{
DeploymentName = 'lz-vend-{0}' -f (-join (Get-Date -Format 'yyyyMMddTHHMMssffffZ')[0..63])
ManagementGroupId = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' # Set this to the Management Group ID you wish to target the deployment against. NOTE: This isn't the Management Group that the Subscription will be moved to, that is specified via the parameters.
Location = 'uksouth' # Set this to the Azure Region you wish the deployment to be targeted against. NOTE: This isn't the Region that the Subscription's resources will be deployed to, that is specified via the parameters.
TemplateParameterFile = './landingZones/lz1.parameters.json' # This would be changed to the specific file per landing zone.
TemplateFile = "./main.bicep" # Set this to the path where you have checked out this repo to.
}
New-AzManagementGroupDeployment @inputObjectdateYMD=$(date +%Y%m%dT%H%M%S%NZ)
DEPLOYMENTNAME="lz-vend-${dateYMD}"
MANAGEMENTGROUPID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" # Set this to the Management Group ID you wish to target the deployment against. NOTE: This isn't the Management Group that the Subscription will be moved to, that is specified via the parameters.
LOCATION="uksouth" # Set this to the Azure Region you wish the deployment to be targeted against. NOTE: This isn't the Region that the Subscription's resources will be deployed to, that is specified via the parameters.
TEMPLATEPARAMETERFILE="@/landingZones/lz1.parameters.json" # This would be changed to the specific file per landing zone.
TEMPLATEFILE="/main.bicep" # Set this to the path where you have checked out this repo to.
az deployment mg create --name ${DEPLOYMENTNAME:0:63} --parameters $TEMPLATEPARAMETERFILE --location $LOCATION --management-group-id $MANAGEMENTGROUPID --template-file $TEMPLATEFILEThis project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.
When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.
This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.
Details on contributing to this repo can be found here in the wiki 👍
When you deploy the Bicep landing zone vending module for Azure module, Microsoft can identify the installation of said module/s with the deployed Azure resources. Microsoft can correlate these resources used to support the software. Microsoft collects this information to provide the best experiences with their products and to operate their business. The telemetry is collected through customer usage attribution. The data is collected and governed by Microsoft's privacy policies.
If you don't wish to send usage data to Microsoft, details on how to turn it off can be found here..
This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.