>> Welcome to another episode of the Azure Enablement Show.
Today we're going to have a look
at subscription vending and how you can
use that to provide Azure environments within your organization.
>> [MUSIC]
>> Welcome back. My name is Thomas and I'm here with Matt and
Jack from the Cloud Adoption Framework team to talk
about subscription vending and how you can use
that to provide Azure environments within your organization.
Matt and Jack, it's great to have you here.
Matt can you quickly talk about what
subscription vending is and what problems it solves?
>> Sure, it's a good question.
Ultimately it's about defining and optimizing the process that
an organization goes through in order to
issue Azure subscriptions to the teams that need them.
If you think about the approvals that you might need,
the teams you might need to speak to including
finance and networking team for IP addresses,
there's a lot going on there.
It's really about making as efficient and as quick as possible.
>> Awesome. We talked about that this obviously can
provide value to our organization and different teams and so on.
But who should consider using
subscription vending and what
are the benefits they get out of that?
>> Sure, another good question.
Really any customer should look at
the subscription vending process in their organization.
But especially those with
an EA, and MCA, or an MPA agreement with Microsoft,
because those customers can automate the process end to end.
That's what we're really after here,
is delivering compliant subscriptions
to application teams as quickly as possible.
>> Fantastic. Jack,
usually we talk about Azure landing zones
and how we can provide
these different environments for customers,
so if I'm an organization today and I don't use
Azure landing zones can I still use
subscription vending or do I need to move first to landing zones?
>> No, another good question.
We designed the subscription vending modules that
we've created to be agnostic to ALZ.
So if you have Azure landing zones
you absolutely can use these modules and they
help accelerate delivering those subscriptions
to your application teams even faster.
But if you don't and you have
your own landing zone organization set up,
you can absolutely use these modules as well.
There is no dependency
on anything because your landing zones [inaudible]
>> That's fantastic. That's great to hear.
There are obviously different types of landing zones.
What types of landing zones can subscription vending be used for?
>> Another great question. We can typically use these modules,
as we said they're agnostics,
so you can use them to deliver both platform
and application landing zones.
We've got a diagram here,
you've got the typical Azure landing zones hierarchy.
Now as I said, you don't need this,
but to use a diagram as an example,
you can provision any of the subscriptions shown in
the yellow boxes via the subscription vending modules.
But you just need to be careful if you're provisioning
your platform subscriptions via automation that
you don't get stuck in a circular loop and
dependency logic where you
need the platform subscriptions to exist before you
can deploy your management group hierarchy and your policies and
the things that need platform subscriptions
and you end up just going round in a loop.
So typically we would see customers
create those platforms subscriptions manually and actually
use the subscription vending modules that we provide for
the application landing zones
that you see in the right-hand side of the diagram.
>> That makes actually sense.
So we build all the structure then for
the more landing zones you need you're going to use that.
Now we've got another question come actually up.
Who in the organization or what team does actually
run and implement the subscription vending service?
>> Yeah. Again,
as you probably imagine,
this is something that the platform team will
provide to the rest of the organization.
So people within your Cloud center of
excellence or your Cloud platform team,
they'll be the one setting up
this subscription vending request
process end to end from capturing
the request through to the vending and using the modules to
create subscriptions to the rest of the business.
You as an application owner can then you go to your tool of choice,
request the subscription from a catalog,
and follow nice,
easy GUI based experience and something you're familiar with once
the platform team handle
the complexities of automating this behind the scenes.
>> Perfect. You actually will have
another important point here and I
want to talk to Matt about this.
In the technical part,
do we have any technical elements
which are helping to implement subscription vending?
>> Yeah, we certainly do.
I mentioned before about EA,
MPA, and MCA customers began to automate this end-to-end.
Well, we've actually written to
infrastructure as code modules to help do just that.
We've got one written in
Bicep and we've got another written in Terraform.
>> Nice. Is there a chance you can show us a little bit on that?
>> Yeah, absolutely. Let me
bring up a demo now of the Terraform module.
Here is my demo environment.
You can see that I've got some management groups
configured in my Azure tenant.
If I scroll down, you can see I've got my ALZ root group of MW-Demo.
I scroll down you'll see that I've got
the standard ALZ management group structure,
landing zones, corp, and online.
What I'm going to do now is show you
the Git repo that is used to deploy this stuff.
This is a demo repository but I'm
using the ALZ infrastructure as code module together
with the subscription vending module
working together to demonstrate how you can
deploy not only the core infrastructure but
also your application landing zones at the same time.
If we look at Pull requests,
we can see that I've got
a new pull request to create a new landing zone.
Now if I look at the files that have changed in this pull request,
you'll see that there's
a simple YAML file which describes a new landing zone.
It's a production workload.
It's going to go into this management group ID
called online and it's going to have
one virtual network with
an address space and it's going to be
peered to the hub virtual network.
Let's go back to here and the merge this pull request.
When I click "Merge" what will
happen is GitHub Actions will start,
it will create a Terraform plan,
and then it will require an approval to deploy to production.
Now what we're going to do is look at GitHub Actions.
If we go to our Actions,
you can see that because that pull
request got merged into our main branch,
that this ci-cd pipeline has kicked off and
the first stage of that is
a Terraform plan which runs under the ci job.
Let's have a look. What we're
going to do now is look at the output of that plan
to see what Terraform is going to do.
I'm going to scroll down to the end and we can see here
that Terraform is going to create nine resources and change one.
That's cool. Some of the resources we're going
to create are a virtual network that we defined in our YAML file.
That's awesome. They all look great.
Why don't we now approve this job for
production and see what that looks like in production.
Fantastic. Let's have a look
in the Azure portal for our new landing zone.
If we go back to our management groups view,
if you remember in our YAML file,
we said we wanted the subscription in the online management group.
So let's click "Refresh" now. Let's see what we've got.
To expand MW-Demo under landing zones,
under online we have our new lz with its new subscription ID.
We can go into new lz, we can select Resource groups,
and we can see that we have
a networking resource script
that's been provisioned by the module.
If we look, we've got
our spoke network with the address space that we configured.
Finally, if we look at
the peering we can see that it's peered to the hub network.
This shows how the Terraform module for subscription vending can
automate the end-to-end provisioning of
your subscription and your core networking
as well as many other things.
Check out the wiki and
the module page and HashiCorp registry for more information.
>> Great demo. Excellent stuff here.
One question from this.
How do application or workload owners initiate actually
a request to have a new subscription deployed?
>> Our customers typically use
a various number of ITSM tools already in their estate.
There's lots of them out there and we didn't really today want
to get caught up in the business logic side and handling approval,
this person in finance needs to approve this,
so we've created these modules to be more on
the business process and
the business approval side has been already handled
in their existing ITSM tool and then that
triggers the creation process into
Azure DevOps using GitHub Action workflows and using
more importantly the modules that we've created
to deliver the subscription as an output.
But that request process and that initiation
should be handled in an existing tool that
the business is already familiar with so that it's
it's a common place that they go to make
service requests to get things they need and it's
not another tool they have to go and learn about and use.
>> It's perfect. I love that it integrates in
the existing environment and I know that most companies or
larger organizations out there they already have ITSM tools
or tools which they use to make service requests in place.
So that's fantastic. One last thing.
If I'm now excited and want to actually try
out subscription vending, where do I go?
>> You can head to the short links of
aka.ms/sub-vending and you'll find everything you need to from
there starting in the Cloud Adoption Framework
talking around the process.
That will then link you on to
our Azure Architecture Center page that talks a bit more in
detail around the technical steps and
the integration points between these different systems,
and more importantly provide you links
to the modules that are hosted in
GitHub and on the respective registries for Bicep and Terraform.
>> Awesome. Thank you very much
Matt and Jack for being on the show today.
I definitely going to try this out.
Also thank you very much for everyone watching.
If you want to learn more about
the Cloud Adoption Framework make sure you check out aka.ms/adopt.
>> [MUSIC]