feat: multi-region support for terraform

.gitignore

@@ -36,4 +36,5 @@ templates/basic/terraform.tfvars
 templates/test_*
 .vscode/settings.json
 .vs
-.alzlib
+.alzlib
+terraform.tfvars

templates/.config/ALZ-Powershell.config.json

@@ -1,5 +1,10 @@
 {
     "starter_modules": {
+        "complete_multi_region": {
+            "location": "complete_multi_region",
+            "short_name": "Complete Multi-Region",
+            "description": "Complete Azure Landing Zones Configurable Deployment with Multi-Region Support"
+        },
         "complete": {
             "location": "complete",
             "short_name": "Complete",

templates/complete_multi_region/config-hub-and-spoke-vnet.yaml

@@ -0,0 +1,164 @@
+# This file contains templated variables to avoid repeating the same hard-coded values.
+# Templated variables are denoted by the dollar curly braces token. The following details each templated variable that you can use:
+# `starter_location_01`: This the primary an Azure location sourced from the `starter_locations` variable. This can be used to set the location of resources.
+# `starter_location_02` to `starter_location_10`: These are the secondary Azure locations sourced from the `starter_locations` variable. This can be used to set the location of resources.
+# `starter_location_01_availability_zones` to `starter_location_10_availability_zones`: These are the availability zones for the Azure locations sourced from the `starter_locations` variable. This can be used to set the availability zones of resources.
+# `default_postfix`: This is a string sourced from the variable `default_postfix`. This can be used to append to resource names for consistency.
+# `root_parent_management_group_id`: This is the id of the management group that the ALZ hierarchy will be nested under.
+# `subscription_id_identity`: The subscription ID of the subscription to deploy the identity resources to, sourced from the variable `subscription_id_identity`.
+# `subscription_id_connectivity`: The subscription ID of the subscription to deploy the connectivity resources to, sourced from the variable `subscription_id_connectivity`.
+# `subscription_id_management`: The subscription ID of the subscription to deploy the management resources to, sourced from the variable `subscription_id_management`.
+---
+management_groups: # `caf-enterprise-scale` module, add inputs as listed on the module registry where necessary.
+
+  # Base variables
+  root_name: alz
+  root_id: Azure-Landing-Zones
+  default_location: ${starter_location_01}
+  subscription_id_connectivity: ${subscription_id_connectivity}
+  subscription_id_identity: ${subscription_id_identity}
+  subscription_id_management: ${subscription_id_management}
+  root_parent_id: ${root_parent_management_group_id}
+  deploy_core_landing_zones: true
+  deploy_corp_landing_zones: true
+  deploy_online_landing_zones: true
+  deploy_management_resources: true
+  deploy_connectivity_resources: false # We are using the AVM patterns for connectivity
+  deploy_identity_resources: true
+
+  # Management resource settings
+  configure_management_resources:
+    location: ${starter_location_01}
+    settings:
+      log_analytics:
+        enabled: true
+        config:
+          retention_in_days: 50
+          enable_monitoring_for_vm: true
+          enable_monitoring_for_vmss: true
+          enabled_sentinel: true
+          enable_solution_for_change_tracking: true
+          enable_solution_for_vm_insights: true
+          enable_solution_for_container_insights: true
+          enable_sentinel: true
+      security_center:
+        config:
+          email_security_contact: "security_contact@replace_me"
+          enable_defender_for_app_services: true
+          enable_defender_for_arm: true
+          enable_defender_for_containers: true
+          enable_defender_for_cosmosdbs: true
+          enable_defender_for_cspm: true
+          enable_defender_for_key_vault: true
+          enable_defender_for_oss_databases: true
+          enable_defender_for_servers: true
+          enable_defender_for_servers_vulnerability_assessments: true
+          enable_defender_for_sql_servers: true
+          enable_defender_for_sql_server_vms: true
+          enable_defender_for_storage: true
+    advanced:
+      asc_export_resource_group_name: rg-asc-export-${starter_location_01}
+      custom_settings_by_resource_type:
+        azurerm_resource_group:
+          management:
+            name: rg-management-${starter_location_01}
+        azurerm_log_analytics_workspace:
+          management:
+            name: law-management-${starter_location_01}
+        azurerm_automation_account:
+          management:
+            name: aa-management-${starter_location_01}
+
+  # Configure Private DNS Zone Resource Ids for Policy Assignments
+  configure_connectivity_resources:
+    settings:
+      dns:
+        config:
+          location: ${starter_location_01}
+    advanced:
+      custom_settings_by_resource_type:
+        azurerm_resource_group:
+          dns:
+            ${starter_location_01}:
+              name: rg-private-dns-${starter_location_01}
+
+# Connectivity settings
+connectivity:
+  hub_and_spoke_vnet: # `avm-ptn-hubnetworking` module, add inputs as listed on the module registry where necessary.
+    hub_virtual_networks:
+      # Primary hub
+      primary:
+        name: vnet-hub-${starter_location_01}
+        resource_group_name: rg-connectivity-${starter_location_01}
+        location: ${starter_location_01}
+        address_space:
+          - 10.0.0.0/16
+        firewall:
+          name: fw-hub-${starter_location_01}
+          sku_name: AZFW_VNet
+          sku_tier: Standard
+          subnet_address_prefix: 10.0.1.0/24
+          zones: ${starter_location_01_availability_zones}
+          firewall_policy:
+            name: fwp-hub-${starter_location_01}
+            dns:
+              proxy_enabled: true
+          default_ip_configuration:
+            public_ip_config:
+              zones: ${starter_location_01_availability_zones}
+              name: pip-hub-fw-${starter_location_01}
+              ip_version: "IPv4"
+        virtual_network_gateway: # `avm-ptn-vnetgateway` module, add inputs as listed on the module registry where necessary.
+          name: vgw-hub-${starter_location_01}
+          subnet_address_prefix: 10.0.2.0/24
+          ip_configurations:
+            default:
+              name: default
+              public_ip:
+                name: pip-hub-vgw-${starter_location_01}
+                zones: ${starter_location_01_availability_zones}
+
+      # Secondary hub
+      secondary:
+        name: vnet-hub-${starter_location_02}
+        resource_group_name: rg-connectivity-${starter_location_02}
+        location: ${starter_location_02}
+        address_space:
+          - 10.1.0.0/16
+        firewall:
+          name: fw-hub-${starter_location_02}
+          sku_name: AZFW_VNet
+          sku_tier: Standard
+          subnet_address_prefix: 10.1.1.0/24
+          zones: ${starter_location_02_availability_zones}
+          firewall_policy:
+            name: fwp-hub-${starter_location_02}
+            dns:
+              proxy_enabled: true
+          default_ip_configuration:
+            public_ip_config:
+              zones: ${starter_location_02_availability_zones}
+              name: pip-hub-fw-${starter_location_02}
+              ip_version: "IPv4"
+        virtual_network_gateway: # `avm-ptn-vnetgateway` module, add inputs as listed on the module registry where necessary.
+          name: vgw-hub-${starter_location_02}
+          subnet_address_prefix: 10.1.2.0/24
+          ip_configurations:
+            ipconfig1:
+              name: ipconfig1
+              public_ip:
+                name: pip-hub-vgw-${starter_location_02}
+                zones: ${starter_location_02_availability_zones}
+
+  private_dns:
+    resource_group_name: rg-private-dns-${starter_location_01}
+    locations:
+      primary:
+        location: ${starter_location_01}
+        is_primary: true  # Deploys all zones
+      secondary:
+        location: ${starter_location_02}
+        is_primary: false  # Only deploys regional zones
+
+# Configure root module settings
+enable_telemetry: true

templates/complete_multi_region/config-virtual-wan.yaml

@@ -0,0 +1,140 @@
+# This file contains templated variables to avoid repeating the same hard-coded values.
+# Templated variables are denoted by the dollar curly braces token. The following details each templated variable that you can use:
+# `starter_location_01`: This the primary an Azure location sourced from the `starter_locations` variable. This can be used to set the location of resources.
+# `starter_location_02` to `starter_location_10`: These are the secondary Azure locations sourced from the `starter_locations` variable. This can be used to set the location of resources.
+# `starter_location_01_availability_zones` to `starter_location_10_availability_zones`: These are the availability zones for the Azure locations sourced from the `starter_locations` variable. This can be used to set the availability zones of resources.
+# `default_postfix`: This is a string sourced from the variable `default_postfix`. This can be used to append to resource names for consistency.
+# `root_parent_management_group_id`: This is the id of the management group that the ALZ hierarchy will be nested under.
+# `subscription_id_identity`: The subscription ID of the subscription to deploy the identity resources to, sourced from the variable `subscription_id_identity`.
+# `subscription_id_connectivity`: The subscription ID of the subscription to deploy the connectivity resources to, sourced from the variable `subscription_id_connectivity`.
+# `subscription_id_management`: The subscription ID of the subscription to deploy the management resources to, sourced from the variable `subscription_id_management`.
+---
+management_groups: # `caf-enterprise-scale` module, add inputs as listed on the module registry where necessary.
+
+  # Base variables
+  root_name: alz
+  root_id: Azure-Landing-Zones
+  default_location: ${starter_location_01}
+  subscription_id_connectivity: ${subscription_id_connectivity}
+  subscription_id_identity: ${subscription_id_identity}
+  subscription_id_management: ${subscription_id_management}
+  root_parent_id: ${root_parent_management_group_id}
+  deploy_core_landing_zones: true
+  deploy_corp_landing_zones: true
+  deploy_online_landing_zones: true
+  deploy_management_resources: true
+  deploy_connectivity_resources: false # We are using the AVM patterns for connectivity
+  deploy_identity_resources: true
+
+  # Management resource settings
+  configure_management_resources:
+    location: ${starter_location_01}
+    settings:
+      log_analytics:
+        enabled: true
+        config:
+          retention_in_days: 50
+          enable_monitoring_for_vm: true
+          enable_monitoring_for_vmss: true
+          enabled_sentinel: true
+          enable_solution_for_change_tracking: true
+          enable_solution_for_vm_insights: true
+          enable_solution_for_container_insights: true
+          enable_sentinel: true
+      security_center:
+        config:
+          email_security_contact: "security_contact@replace_me"
+          enable_defender_for_app_services: true
+          enable_defender_for_arm: true
+          enable_defender_for_containers: true
+          enable_defender_for_cosmosdbs: true
+          enable_defender_for_cspm: true
+          enable_defender_for_key_vault: true
+          enable_defender_for_oss_databases: true
+          enable_defender_for_servers: true
+          enable_defender_for_servers_vulnerability_assessments: true
+          enable_defender_for_sql_servers: true
+          enable_defender_for_sql_server_vms: true
+          enable_defender_for_storage: true
+    advanced:
+      asc_export_resource_group_name: rg-asc-export-${starter_location_01}
+      custom_settings_by_resource_type:
+        azurerm_resource_group:
+          management:
+            name: rg-management-${starter_location_01}
+        azurerm_log_analytics_workspace:
+          management:
+            name: law-management-${starter_location_01}
+        azurerm_automation_account:
+          management:
+            name: aa-management-${starter_location_01}
+
+  # Configure Private DNS Zone Resource Ids for Policy Assignments
+  configure_connectivity_resources:
+    settings:
+      dns:
+        config:
+          location: ${starter_location_01}
+    advanced:
+      custom_settings_by_resource_type:
+        azurerm_resource_group:
+          dns:
+            ${starter_location_01}:
+              name: rg-private-dns-${starter_location_01}
+
+# Connectivity settings
+connectivity:
+  virtual_wan: # `avm-ptn-vwan` module, add inputs as listed on the module registry where necessary.
+    virtual_wan_name: vwan-hub-${starter_location_01}
+    resource_group_name: rg-connectivity-${starter_location_01}
+    location: ${starter_location_01}
+
+    virtual_hubs:
+      primary:
+        name: vnet-hub-${starter_location_01}
+        location: ${starter_location_01}
+        address_prefix: 10.0.0.0/16
+        private_dns_virtual_network_name: vnet-hub-private-dns-${starter_location_01}
+        private_dns_virtual_network_address_space: 10.0.0.0/24
+        private_dns_virtual_network_subnet_address_space: 10.0.0.0/28
+        dns_resolver_name: dpr-hub-${starter_location_01}
+      secondary:
+        name: vnet-hub-${starter_location_02}
+        location: ${starter_location_02}
+        address_prefix: 10.1.0.0/16
+        private_dns_virtual_network_name: vnet-hub-private-dns-${starter_location_02}
+        private_dns_virtual_network_address_space: 10.1.0.0/24
+        private_dns_virtual_network_subnet_address_space: 10.1.0.0/28
+        dns_resolver_name: dpr-hub-${starter_location_02}
+
+    firewalls:
+      primary:
+        virtual_hub_key: primary
+        name: fw-hub-${starter_location_01}
+        sku_name: AZFW_Hub
+        sku_tier: Standard
+        zones: ${starter_location_01_availability_zones}
+        firewall_policy:
+          name: fwp-hub-${starter_location_01}
+
+      secondary:
+        virtual_hub_key: secondary
+        name: fw-hub-${starter_location_02}
+        sku_name: AZFW_Hub
+        sku_tier: Standard
+        zones: ${starter_location_02_availability_zones}
+        firewall_policy:
+          name: fwp-hub-${starter_location_02}
+
+  private_dns:
+    resource_group_name: rg-private-dns-${starter_location_01}
+    locations:
+      primary:
+        location: ${starter_location_01}
+        is_primary: true  # Deploys all zones
+      secondary:
+        location: ${starter_location_02}
+        is_primary: false  # Only deploys regional zones
+
+# Configure root module settings
+enable_telemetry: true

templates/complete_multi_region/data.tf

@@ -0,0 +1,17 @@
+data "azurerm_client_config" "current" {}
+
+data "azapi_resource_action" "locations" {
+  type                   = "Microsoft.Resources/subscriptions@2022-12-01"
+  action                 = "locations"
+  method                 = "GET"
+  resource_id            = "/subscriptions/${data.azurerm_client_config.current.subscription_id}"
+  response_export_values = ["value"]
+}
+
+locals {
+  regions = { for region in jsondecode(data.azapi_resource_action.locations.output).value : region.name => {
+    display_name = region.displayName
+    zones        = try([for zone in region.availabilityZoneMappings : zone.logicalZone], [])
+    } if region.metadata.regionType == "Physical"
+  }
+}

templates/complete_multi_region/locals-config.tf

@@ -0,0 +1,42 @@
+locals {
+  config_file_extension = replace(lower(element(local.config_file_split, length(local.config_file_split) - 1)), local.const_yml, local.const_yaml)
+  config_file_name      = var.configuration_file_path == "" ? "config-hub-and-spoke-vnet.yaml" : basename(var.configuration_file_path)
+  config_file_split     = split(".", local.config_file_name)
+  const_yaml            = "yaml"
+  const_yml             = "yml"
+
+  is_yaml             = local.config_file_extension == local.const_yaml || local.config_file_extension == local.const_yml
+  config_file_content = templatefile("${path.module}/${local.config_file_name}", local.config_template_file_variables)
+  config = (local.is_yaml ?
+    yamldecode(local.config_file_content) :
+    jsondecode(local.config_file_content)
+  )
+
+  config_template_file_variables = {
+    starter_location_01                    = var.starter_locations[0]
+    starter_location_02                    = try(var.starter_locations[1], null)
+    starter_location_03                    = try(var.starter_locations[2], null)
+    starter_location_04                    = try(var.starter_locations[3], null)
+    starter_location_05                    = try(var.starter_locations[4], null)
+    starter_location_06                    = try(var.starter_locations[5], null)
+    starter_location_07                    = try(var.starter_locations[6], null)
+    starter_location_08                    = try(var.starter_locations[7], null)
+    starter_location_09                    = try(var.starter_locations[8], null)
+    starter_location_10                    = try(var.starter_locations[9], null)
+    starter_location_01_availability_zones = jsonencode(local.regions[var.starter_locations[0]].zones)
+    starter_location_02_availability_zones = jsonencode(try(local.regions[var.starter_locations[1]].zones, null))
+    starter_location_03_availability_zones = jsonencode(try(local.regions[var.starter_locations[2]].zones, null))
+    starter_location_04_availability_zones = jsonencode(try(local.regions[var.starter_locations[3]].zones, null))
+    starter_location_05_availability_zones = jsonencode(try(local.regions[var.starter_locations[4]].zones, null))
+    starter_location_06_availability_zones = jsonencode(try(local.regions[var.starter_locations[5]].zones, null))
+    starter_location_07_availability_zones = jsonencode(try(local.regions[var.starter_locations[6]].zones, null))
+    starter_location_08_availability_zones = jsonencode(try(local.regions[var.starter_locations[7]].zones, null))
+    starter_location_09_availability_zones = jsonencode(try(local.regions[var.starter_locations[8]].zones, null))
+    starter_location_10_availability_zones = jsonencode(try(local.regions[var.starter_locations[9]].zones, null))
+    default_postfix                        = var.default_postfix
+    root_parent_management_group_id        = var.root_parent_management_group_id == "" ? data.azurerm_client_config.current.tenant_id : var.root_parent_management_group_id
+    subscription_id_connectivity           = var.subscription_id_connectivity
+    subscription_id_identity               = var.subscription_id_identity
+    subscription_id_management             = var.subscription_id_management
+  }
+}

templates/complete_multi_region/locals-hub-and-spoke-vnet.tf

@@ -0,0 +1,3 @@
+locals {
+  vnet_gateway_default_skus = { for key, value in local.module_virtual_network_gateway : key => length(local.regions[value.location].zones) == 0 ? "Standard" : "ErGw1AZ" }
+}