DOCSEARCHbyAlgolia
Submit Docs

ALZ-Bicep (Classic)

repository·main·Indexed 21 days ago

https://github.com/azure/alz-bicep

A repository of Bicep modules designed to implement the core platform capabilities of the Azure Landing Zones (ALZ) conceptual architecture. It provides a structured approach to deploying landing zone architectures, including modules for Container Registry, Subscription Alias, and Custom Role Definitions. This project is currently in a deprecation phase as users migrate to Azure Verified Modules (AVM).

Tokens
129.5K
Snippets
222
Records
402
Agent score
74%

What's inside ALZ-Bicep

  2. Overview of the Spoke Networking module

    main

    The Spoke Networking module defines spoke networking based on Azure Landing Zone Conceptual Architecture recommendations. If enabled, the spoke will route traffic to a Hub Network via a Network Virtual Appliance (NVA).

    Key Resources Deployed:

    • Virtual Network (Spoke VNet)
    • Route Table with route to NVA (only if Firewall is enabled)
    IMPORTANT

    It is recommended to use the Bicep Landing Zone Vending Module instead of this module. The vending module handles spoke networking along with other foundational application landing zone components that are out of scope for this specific module.

    NOTE

    This module only deploys a skeleton of a virtual network. It does not create or support subnet declarations. This is intended to be a blank VNet that workload teams can then use to create their own subnets. To add subnets, you should use Azure Verified Modules (AVM), fork this repository to customize it, or write your own custom module.

  3. Overview of the Hub-Networking module

    main

    The hubNetworking module defines hub networking infrastructure based on Azure Landing Zone (ALZ) Conceptual Architecture recommendations. It is designed to be deployed into the Platform connectivity subscription.

    Resources deployed by this module:

    • Virtual Network (VNet) and Subnets
    • VPN Gateway or ExpressRoute Gateway
    • Azure Firewall and Azure Firewall Policies
    • Private DNS Zones
    • DDoS Network Protection Plan
    • Bastion
    • Route Table

    Prerequisites: If deploying as a standalone module (without the Accelerator), you must have the required permissions as specified in the Enterprise-Scale pre-requisites.

  5. Overview of ALZ-Bicep (Classic)

    main

    The Azure Landing Zones Bicep repository provides Bicep modules for deploying and managing the core platform capabilities of the Cloud Adoption Framework (CAF) Azure Landing Zones conceptual architecture.

    Deployment Model: Currently, each module is designed to be deployed separately via the command line. While orchestration modules are planned for future releases, current Bicep and ARM limitations require manual or scripted individual module deployment.

  6. Overview of the hubPeeredSpoke orchestration module

    main

    The hubPeeredSpoke module is an orchestration module designed to create and configure a spoke network within an Azure Landing Zone architecture. It supports both traditional Hub & Spoke and Virtual WAN topologies.

    Key Capabilities:

    • Deploys a Resource Group and a Virtual Network (Spoke VNet).
    • Configures Hub-to-Spoke and Spoke-to-Hub peering (or Spoke-to-vWAN peering).
    • Deploys User Defined Routes (UDR) if a next hop IP and Hub VNet resource ID are provided.
    • Handles subscription placement in the Management Group hierarchy if parPeeredVnetSubscriptionMgPlacement is specified.

    Important Constraints:

    • Single Peering Type: You can only create one type of peering per deployment: either traditional Hub & Spoke OR Azure Virtual WAN.
    • Recommendation: For full application landing zone setup, it is recommended to use the Bicep Landing Zone Vending Module instead, as this module focuses specifically on networking and does not handle other foundational components.

  7. Overview of the Logging, Automation & Sentinel Module

    main

    The Logging, Automation & Sentinel module deploys a centralized logging infrastructure to an existing Resource Group. It provisions an Azure Log Analytics Workspace and an Automation Account, linking them together to enable integrated management features.

    Key Capabilities:

    • Integrated Management: Links the Automation Account to the Log Analytics Workspace to support Update Management, Change Tracking, Inventory, and scheduled Start/Stop VM operations.
    • Data Collection: Provisions Data Collection Rules (DCRs) for VM Insights, Change Tracking, and Defender for SQL.
    • Identity: Deploys a User-Assigned Managed Identity (UAMI) used alongside policies for deploying the Azure Monitor Agent (AMA).
    • Solutions: Deploys Log Analytics Workspace solutions by default, including SecurityInsights (Azure Sentinel).

    Important Constraints:

    • Region Support: Linking a Log Analytics Workspace and an Automation Account is only supported in certain regions. Refer to the Azure documentation for supported region mappings.
    • Mapping Limit: Only one mapping can exist between a Log Analytics Workspace and an Automation Account.

  9. Overview of the ALZ Bicep Accelerator

    main
    The ALZ Bicep Accelerator is a repository containing Bicep templates designed to implement Azure Landing Zones (ALZ). It provides a structured approach to deploying landing zone architectures using Bicep. For detailed documentation, implementation guides, and deep dives into the accelerator's components, refer to the official project Wiki.

  11. Assign policies to management groups

    main

    Use the policyAssignmentManagementGroup Bicep module to assign Azure policies to specific management groups. This module allows for detailed configuration of policy parameters, enforcement modes, and identity-based role assignments.

    {
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
    "contentVersion": "1.0.0.0",
    "metadata": {
        "template": "infra-as-code/bicep/modules/policy/assignments/policyAssignmentManagementGroup.json"
    },
    "parameters": {
        "parPolicyAssignmentName": { "value": "" },
        "parPolicyAssignmentDisplayName": { "value": "" },
        "parPolicyAssignmentDescription": { "value": "" },
        "parPolicyAssignmentDefinitionId": { "value": "" },
        "parPolicyAssignmentDefinitionVersion": { "value": "" }
    }
}

  12. Use the Subscription Alias module to deploy Azure Subscriptions

    main

    The Subscription Alias module automates the deployment of an Azure Subscription into an existing billing scope (EA, MCA, or MPA).

    ⚠️ IMPORTANT: It is highly recommended to use the Bicep Subscription Vending Module instead of this module for new implementations.

    Key Behaviors

    • Placement: The created subscription is placed under the Tenant Root Group by default, unless the default management group has been modified.
    • Permissions: To use this in a pipeline, you must create and assign permissions to a Service Principal (SPN) that allows it to create subscriptions as per Azure documentation.

    Outputs

    OutputTypeExample
    outSubscriptionNamestringsub-example-001
    outSubscriptionIdstring5583f55f-65b2-4a3a-87c9-e499c1c587c0