Skip to content

Commit 95fb185

Browse files
richeneyRichard Cheney
richeney
and
Richard Cheney
authored
ALZ Custom (#4)
* Test switch to alz_custom with no overrides * Backend as well --------- Co-authored-by: Richard Cheney <[email protected]>
1 parent 8c32c3e commit 95fb185

21 files changed

Lines changed: 443 additions & 6 deletions

‎create-backend-config.sh‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
vars=$(gh variable list --json name,value | jq 'map({(.name): .value}) | add')
2+
sub="$(jq -r .AZURE_SUBSCRIPTION_ID <<< $vars)"
3+
rg="$(jq -r .BACKEND_AZURE_RESOURCE_GROUP_NAME <<< $vars)"
4+
sa="$(jq -r .BACKEND_AZURE_STORAGE_ACCOUNT_NAME <<< $vars)"
5+
container="$(jq -r .BACKEND_AZURE_STORAGE_ACCOUNT_CONTAINER_NAME <<< $vars)"
6+
7+
cat > terraform_override.tf << EOF
8+
# Overrides to enable local terraform plan
9+
10+
terraform {
11+
backend "azurerm" {
12+
use_azuread_auth = true
13+
subscription_id = "$sub"
14+
resource_group_name = "$rg"
15+
storage_account_name = "$sa"
16+
container_name = "$container"
17+
key = "terraform.tfstate"
18+
}
19+
}
20+
21+
provider "azurerm" {
22+
subscription_id = "$(jq -r .AZURE_SUBSCRIPTION_ID <<< $vars)"
23+
}
24+
EOF
25+
echo "Created terraform_override.tf using the GitHub Actions variables"
26+
27+
# Add Blob Reader role
28+
id="/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Storage/storageAccounts/$sa"
29+
scope="$id/blobServices/default/containers/$container"
30+
az role assignment create --role "Storage Blob Data Reader" --scope $scope --assignee $(az ad signed-in-user show --query id -otsv)
31+
32+
# Allow my public IP
33+
public_ip=$(curl -s ipinfo.io/ip)
34+
az storage account update --ids "$id" --public-network-access Enabled --default-action Deny
35+
az storage account network-rule add --subscription "$sub" --resource-group "$rg" --account-name "$id" --ip-address "$public_ip"
36+
37+
address_space=$(curl -s ipinfo.io/ip | cut -d. -f1-2).0.0/16
38+
az storage account update --ids "$id" --public-network-access Enabled --default-action Deny
39+
az storage account network-rule add --subscription "$sub" --resource-group "$rg" --account-name "$sa" --ip-address "$address_space"
40+
41+
# terraform init -reconfigure
42+
# terraform plan -lock=false
43+
# Update terraform.tf
44+
45+
# provider "alz" {
46+
# library_overwrite_enabled = true
47+
# library_references = [
48+
# {
49+
# path = "platform/alz"
50+
# ref = "2025.09.3"
51+
# },
52+
# {
53+
# custom_url = "${path.root}/lib"
54+
# }
55+
# ]
56+
# }
57+
58+
# ~/git/alz-mgmt (main) $ ll -d ./.alzlib/*/*
59+
# drwxr-xr-x 9 richeney richeney 4096 Dec 10 15:50 ./.alzlib/769917479/886ca76d4870965724e41c9252e7a75fb9eca3fb344838088f95f084
60+
# lrwxrwxrwx 1 richeney richeney 31 Dec 10 15:50 ./.alzlib/769917479/97a0913ff236482dbc5bfba9a9e8c81f1f2c883ef66f22fa680d019d -> /home/richeney/git/alz-mgmt/lib
61+
# first level is generated, second is possibly a hash - predictable value regardless
62+
63+
# Update management_groups module with architecture_name = "alz_custom"
64+
# Plan and undo
65+
66+
# <https://azure.github.io/Azure-Landing-Zones/accelerator/startermodules/terraform-platform-landing-zone/options/slz>
67+
# I have copied the original and manually renamed the new one created in as lib/architecture_definitions/slz_custom.alz_architecture_definition.yaml

‎lib/alz_library_metadata.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"$schema": "https://raw.githubusercontent.com/Azure/Azure-Landing-Zones-Library/main/schemas/library_metadata.json",
3+
"name": "local",
4+
"display_name": "ALZ Accelerator - Azure Verified Modules for SLZ Platform Landing Zone",
5+
"description": "This library allows overriding policies, archetypes, and management group architecture in the ALZ Accelerator.",
6+
"dependencies": [
7+
{
8+
"path": "platform/slz",
9+
"ref": "2025.10.1"
10+
}
11+
]
12+
}

‎lib/archetype_definitions/confidential_corp_custom.alz_archetype_override.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
base_archetype: confidential_corp
2+
name: confidential_corp_custom
3+
policy_assignments_to_add: []
4+
policy_assignments_to_remove: [
5+
# To remove the private DNS zones policy for private endpoints
6+
# Deploy-Private-DNS-Zones,
7+
]
8+
policy_definitions_to_add: []
9+
policy_definitions_to_remove: []
10+
policy_set_definitions_to_add: []
11+
policy_set_definitions_to_remove: []
12+
role_definitions_to_add: []
13+
role_definitions_to_remove: []

‎lib/archetype_definitions/confidential_online_custom.alz_archetype_override.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
base_archetype: confidential_online
2+
name: confidential_online_custom
3+
policy_assignments_to_add: []
4+
policy_assignments_to_remove: []
5+
policy_definitions_to_add: []
6+
policy_definitions_to_remove: []
7+
policy_set_definitions_to_add: []
8+
policy_set_definitions_to_remove: []
9+
role_definitions_to_add: []
10+
role_definitions_to_remove: []

‎lib/archetype_definitions/connectivity_custom.alz_archetype_override.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
base_archetype: connectivity
2+
name: connectivity_custom
3+
policy_assignments_to_add: []
4+
policy_assignments_to_remove: [
5+
# To remove the DDOS modify policy, uncomment the following line:
6+
# Enable-DDoS-VNET,
7+
]
8+
policy_definitions_to_add: []
9+
policy_definitions_to_remove: []
10+
policy_set_definitions_to_add: []
11+
policy_set_definitions_to_remove: []
12+
role_definitions_to_add: []
13+
role_definitions_to_remove: []

‎lib/archetype_definitions/corp_custom.alz_archetype_override.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
base_archetype: corp
2+
name: corp_custom
3+
policy_assignments_to_add: []
4+
policy_assignments_to_remove: [
5+
# To remove the private DNS zones policy for private endpoints
6+
# Deploy-Private-DNS-Zones,
7+
]
8+
policy_definitions_to_add: []
9+
policy_definitions_to_remove: []
10+
policy_set_definitions_to_add: []
11+
policy_set_definitions_to_remove: []
12+
role_definitions_to_add: []
13+
role_definitions_to_remove: []

‎lib/archetype_definitions/decommissioned_custom.alz_archetype_override.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
base_archetype: decommissioned
2+
name: decommissioned_custom
3+
policy_assignments_to_add: []
4+
policy_assignments_to_remove: []
5+
policy_definitions_to_add: []
6+
policy_definitions_to_remove: []
7+
policy_set_definitions_to_add: []
8+
policy_set_definitions_to_remove: []
9+
role_definitions_to_add: []
10+
role_definitions_to_remove: []

‎lib/archetype_definitions/identity_custom.alz_archetype_override.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
base_archetype: identity
2+
name: identity_custom
3+
policy_assignments_to_add: []
4+
policy_assignments_to_remove: []
5+
policy_definitions_to_add: []
6+
policy_definitions_to_remove: []
7+
policy_set_definitions_to_add: []
8+
policy_set_definitions_to_remove: []
9+
role_definitions_to_add: []
10+
role_definitions_to_remove: []

‎lib/archetype_definitions/landing_zones_custom.alz_archetype_override.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
base_archetype: landing_zones
2+
name: landing_zones_custom
3+
policy_assignments_to_add: []
4+
policy_assignments_to_remove: [
5+
# To remove AMA policies, uncomment the following lines:
6+
# Deploy-MDFC-DefSQL-AMA,
7+
# Deploy-VM-ChangeTrack,
8+
# Deploy-VM-Monitoring,
9+
# Deploy-vmArc-ChangeTrack,
10+
# Deploy-vmHybr-Monitoring,
11+
# Deploy-VMSS-ChangeTrack,
12+
# Deploy-VMSS-Monitoring,
13+
# To remove the DDOS modify policy, uncomment the following line:
14+
# Enable-DDoS-VNET,
15+
]
16+
policy_definitions_to_add: []
17+
policy_definitions_to_remove: []
18+
policy_set_definitions_to_add: []
19+
policy_set_definitions_to_remove: []
20+
role_definitions_to_add: []
21+
role_definitions_to_remove: []

‎lib/archetype_definitions/management_custom.alz_archetype_override.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
base_archetype: management
2+
name: management_custom
3+
policy_assignments_to_add: []
4+
policy_assignments_to_remove: []
5+
policy_definitions_to_add: []
6+
policy_definitions_to_remove: []
7+
policy_set_definitions_to_add: []
8+
policy_set_definitions_to_remove: []
9+
role_definitions_to_add: []
10+
role_definitions_to_remove: []

0 commit comments

Comments
 (0)