repository·main·Indexed 21 days ago
https://github.com/azure/terraform-azurerm-caf-enterprise-scaleAn Azure landing zones Terraform module designed to accelerate the deployment of platform resources based on the Azure landing zones conceptual architecture. It includes sub-modules for management groups, connectivity, identity, and management subscriptions, as well as an archetypes sub-module for applying specific configurations to a given scope.
The terraform-azurerm-caf-enterprise-scale module provides an opinionated approach for deploying and managing core platform capabilities of Azure landing zones architecture. It focuses on the central resource hierarchy and allows for the deployment of specific resource sets based on selected capabilities.
Supported capability sets include:
The v2.0.0 release includes several enhancements:
Virtual WAN hub networks and extended Virtual Network Gateway configuration options for hub and spoke networks.Azure Firewall Policy resources to enable DNS Proxy settings and simplify configuration.generation value.vpn_auth_types attribute for vpn_client_configuration.asc_export_resource_group_name variable and logic to suppress Public IP creation when a custom ip_configuration is provided via the advanced block for azurerm_virtual_network_gateway and azurerm_firewall.The core capability of this module implements the foundations of the Azure landing zones conceptual architecture, specifically focusing on central resource organization.
When using the core capabilities, the module manages several key Azure resource types via Terraform. The exact number of resources created depends on your specific configuration; for a default configuration, approximately 180 resources are typically created.
| Resource | Azure resource type | Terraform resource type |
|---|---|---|
| Management groups | Microsoft.Management/managementGroups | azurerm_management_group |
| Management group subscriptions | Microsoft.Management/managementGroups/subscriptions | azurerm_management_group or azurerm_management_group_subscription_association |
| Policy assignments | Microsoft.Authorization/policyAssignments | azurerm_management_group_policy_assignment |
| Policy definitions | Microsoft.Authorization/policyDefinitions | azurerm_policy_definition |
| Policy set definitions | Microsoft.Authorization/policySetDefinitions | azurerm_policy_set_definition |
| Role assignments | Microsoft.Authorization/roleAssignments | azurerm_role_assignment |
| Role definitions | Microsoft.Authorization/roleDefinitions | azurerm_role_definition |
The module allows for the deployment of network topology and connectivity resources into the current subscription context, specifically targeting the connectivity subscription. It ensures the subscription is placed in the correct management group and supports multiple hub networks using either traditional hub-and-spoke or Microsoft-managed Virtual WAN topologies.
Key capabilities include:
Note on Spoke Management: The module currently focuses on configuring the hub network and dependent resources for the connectivity subscription. While outbound peering from hub to spoke can be enabled, users must still manually initiate peering from the spoke to the hub due to AzureRM provider limitations regarding subscription targeting.
The Azure landing zones Terraform module accelerates the deployment of platform resources based on the Azure landing zones conceptual architecture. The module is logically split into several capabilities:
| Module capability | Scope | Design area |
|---|---|---|
| Core Resources | Management group and subscription organization | Resource organization |
| Management Resources | Management subscription | Management |
| Connectivity Resources | Connectivity subscription | Network topology and connectivity |
| Identity Resources | Identity subscription | Identity and access management |
management and connectivity), you must configure a Provider Configuration block.The module accelerates the deployment of platform resources based on the Azure landing zones conceptual architecture. It is logically split into the following capabilities:
| Module capability | Scope | Design area |
|---|---|---|
| Core Resources | Management group and subscription organization | Resource organization |
| Management Resources | Management subscription | Management |
| Connectivity Resources | Connectivity subscription | Network topology and connectivity |
| Identity Resources | Identity subscription | Identity and access management |
The module can deploy a management group hierarchy including a governance baseline (Azure Policy and IAM) at the management group scope. While resources are logically grouped, the modular design allows them to be deployed using different Terraform workspaces to manage large state files or enforce granular permissions.
In the Azure landing zone conceptual architecture, an archetype is a template-driven definition used to transform Management Groups and Subscriptions into functional Landing Zones.
An archetype defines the necessary Azure Policy and Access control (IAM) settings required to secure and configure a Landing Zone for safe handover to its owner. This includes:
This mechanism allows application teams to operate with autonomy while ensuring organizational security policies and standards are strictly enforced.
The module can deploy DDoS Network Protection and link Virtual Networks to the plan.
Constraints and Recommendations:
Managed resource types:
azurerm_resource_groupazurerm_network_ddos_protection_planTo handle errors caused by Azure API caching or eventual consistency, you can use create_duration_delay and destroy_duration_delay to set custom wait periods after resource operations.
Use create_duration_delay to set delays for:
azurerm_management_group (default: 30s)azurerm_policy_assignment (default: 30s)azurerm_policy_definition (default: 30s)azurerm_policy_set_definition (default: 30s)azurerm_role_assignment (default: 0s)azurerm_role_definition (default: 60s)Use destroy_duration_delay to set delays for the same resource types (defaults are 0s).
Custom policy definitions are stored as JSON files in your custom library directory. It is recommended to organize them in a policy_definitions subdirectory within your library folder.
Each JSON file must follow the Azure Microsoft.Authorization/policyDefinitions schema. Key properties include:
name: The unique name of the policy.properties.policyType: Should be set to Custom.properties.mode: Can be All or Indexed.properties.policyRule: The logic defining the policy condition and effect.properties.parameters: The input parameters for the policy.The management sub-module is currently in extended support mode.
Support Schedule:
By default, the module creates private DNS zones for all services supporting private endpoints.
Virtual Network Links:
virtual network links to connect each private DNS zone.