Skip to content

Home

Jump to bottom
github-actions edited this page Jan 10, 2024 · 16 revisions

Welcome to the Azure landing zones Terraform accelerator!

The Azure landing zones Terraform module provides an opinionated approach for deploying and managing the core platform capabilities of Azure landing zones architecture using Terraform, with a focus on the central resource hierarchy:

This accelerator provides an opinionated approach for configuring and securing that module in a continuous delivery pipeline. It has end to end automation for bootstrapping the module and it also provides guidance on branching strategies.

Supported Version Control Systems (VCS)

The accelerator supports both Azure DevOps and GitHub as a VCS. We are only able to support the hosted versions of these services as we use the Terraform providers to configure the environment, which do not support self-hosted versions of these services.

If you are using self-hosted versions of these services, you can still use the accelerator to produce the landing zone code by using the -c "local" flag option, but you will need to configure the VCS manually or with your own automation.

Accelerator features

The accelerator bootstraps a continuous delivery environment for you. It supports both the Azure DevOps and GitHub version control system (VCS). It uses the PowerShell module ALZ to gather required user input and apply a Terraform module to configure the bootstrap environment.

The accelerator follows a 3 phase approach:

  1. Pre-requisites: Instructions to configure credentials and subscriptions.
  2. Bootstrap: Run the PowerShell script to generate the continuous delivery environment.
  3. Run: Update the module (if needed) to suit the needs of your organisation and deploy via continuous delivery.

Azure landing zone accelerator process

The components of the environment are similar, but differ depending on your choice of VCS and authentication:

Components

GitHub

We only support federated credentials for GitHub as a best practice.

  • Azure:

    • Resource Group for State
    • Storage Account and Container for State
    • Resource Group for Identity
    • User Assigned Managed Identities (UAMI) with Federated Credentials for Plan and Apply
    • Permissions for the UAMI on state storage container, subscriptions and management groups

  • GitHub

    • Repository for the Module
    • Repository for the Action Templates
    • Starter Terraform module with tfvars
    • Branch policy
    • Action for Continuous Integration
    • Action for Continuous Delivery
    • Environment for Plan
    • Environment for Apply
    • Action Variables for Backend and Plan / Apply
    • Team and Members for Apply Approval
    • Customised OIDC Token Subject for governed Actions

Azure DevOps with Workload identity federation (WIF / OIDC)

This is the recommended authentication method for Azure DevOps.

  • Azure:

    • Resource Group for State
    • Storage Account and Container for State
    • Resource Group for Identity
    • User Assigned Managed Identities (UAMI) with Federated Credentials for Plan and Apply
    • Permissions for the UAMI on state storage container, subscriptions and management groups

  • Azure DevOps

    • Project (can be supplied or created)
    • Repository for the Module
    • Repository for the Pipeline Templates
    • Starter Terraform module with tfvars
    • Branch policy
    • Pipeline for Continuous Integration
    • Pipeline for Continuous Delivery
    • Environment for Plan
    • Environment for Apply
    • Variable Group for Backend
    • Service Connections with Workload identity federation for Plan and Apply
    • Service Connection Approvals, Template Validation and Concurrency Control
    • Group and Members for Apply Approval

Azure DevOps with Managed identity and self-hosted agents

We include this option as Workload identity federation (WIF) is still in preview, but it will be removed once WIF is generally available to simplify the accelerator and promote best practice.

  • Azure:

    • Resource Group for State
    • Storage Account and Container for State
    • Resource Group for Identity
    • User Assigned Managed Identities (UAMI) for Plan and Apply
    • Permissions for the UAMI on state storage container, subscriptions and management groups
    • Resource Group for Agents
    • 2 Container Instances with UAMI hosting Azure DevOps Agents

  • Azure DevOps

    • Project (can be supplied or created)
    • Repository for the Module
    • Repository for the Pipeline Templates
    • Starter Terraform module with tfvars
    • Branch policy
    • Pipeline for Continuous Integration
    • Pipeline for Continuous Delivery
    • Environment for Plan
    • Environment for Apply
    • Variable Group for Backend
    • Service Connections with Managed identity for Plan and Apply
    • Service Connection Approvals, Template Validation and Concurrency Control
    • Group and Members for Apply Approval
    • Agent Pool

Local File System

This outputs the ALZ module files to the file system, so you can apply them manually or with your own VCS / automation.

  • Azure:

    • Resource Group for State
    • Storage Account and Container for State
    • Resource Group for Identity
    • User Assigned Managed Identities (UAMI) for Plan and Apply
    • Permissions for the UAMI on state storage container, subscriptions and management groups

  • Local File System

    • Starter Terraform module with tfvars

Next steps

Check out the User Guide.

Terraform landing zones

The following diagram and links detail the Azure landing zone, but you can learn a lot more about the Azure landing zones enterprise scale module here.

Azure landing zone conceptual architecture

Clone this wiki locally