>> Welcome to another episode of the Azure enablement show.
This is the second episode of our series
on how you can deploy your Azure landing zones using bicep.
Make sure you subscribe to the channel and check out
all the resources and links in the description below.
[MUSIC]
>> Welcome back. My name is Thomas and I'm joined by
Jack and Jan from the Azure landing zone bicep team.
This is the second episode about how you
actually deploy your landing zones using biceps.
It's great to have you both on again.
In the last episode,
we talked about how you can actually go
and deploy the Azure landing zones using bicep.
We got a little bit of an introduction into the repo
and we actually deployed the management group structure.
What is next to enable the platform services, Jack?
>> Yeah. A great question.
You're correct, we deploy those management groups.
We now need to deploy platform services.
Things like the hub-net working,
maybe the Log Analytics workspace,
and the Automation account in the management subscription.
Also some policy definitions and
policy assignments which are not ready platform resources,
but they are supporting the rest of
the platform so we need to get those in place.
Yeah. That's what we've got left to do.
Hopefully, we'll show you how to get those done in this episode.
>> Awesome. That's great.
Jan, you're already deployed or pre-deployed a couple of
these things in advance into our demo tenant.
Can you show us what we've got now?
>> If you notice where we went with the deployment flow,
the deployment management group module last time,
then off to the side I deployed the policy definitions,
I deploy role definitions,
I deploy logging and security like hub network module,
role assignments, and subscription placement.
Just to show what looks like,
I'll go to the management group here.
You can see that if we go to the Azure enablement show,
we have all policy definitions in here and the pseudo route,
where we have a number of your policies now.
Also, we have an access control.
We have these roles.
Also included application, network management,
security operations, and so on.
Then if we go down and look at the connectivity by pushing
in a couple of subscription for
connectivity, for identity management.
Interconnectivity subscription, I deployed hub networking.
That contains Azure Firewall,
hub network obviously,
Azure Bastion, a number of private DNS zones,
and express route gateway.
Go into the management subscription, I deploy it.
Log analytics, a number of log analytic solutions,
and an Automation account.
>> Fantastic. I'm just imagining right
now how long this would take if I do all of this manually.
First of all, I would obviously need to know
all the best practices and how to
set up the structure and everything.
Then secondly, again, until I set this up
properly will take me days to do that manually,
and even then it will not be consistent what I actually want.
How long did it take to actually deploy all these now using Bicep?
>> Most of these things take only 5-10 minutes.
Like the policy definition, role definitions,
and so on and so forth, it doesn't really take all that long.
The one which does take a bit longer is hub networking,
which can take anywhere from 40-90 minutes,
30 minutes sometimes if we're lucky, so to speak.
It depends on really how much you put into the perimeters file.
If you're trying to deploy everything, hub networking,
Azure firewall, DDoS, private DNS zones,
and so on and so forth,
it can take up to 90 minutes.
But when you think about it,
it is really a lot that is applied,
so there's no real cause for concern.
>> Absolutely. Again, I'm just like
that's not something you do probably every single day.
It definitely saves you a lot of time.
We already deployed our couple of things.
What is left for us to deploy any Azure landing zone
set up to support application workloads in the subscriptions?
>> To answer that question,
I'll go back to the deployment flow here.
As you can see,
we did the subscription placement module.
What's missing right now is that policy assignments.
What I'll do is I'll roll down
to policy assignments, which is here.
Then I'll go down to command line and
since I'm still using PowerShell,
I'm going to go with the command line for PowerShell.
Copy that, go back to portal,
stop my slideshow,
and I'll copy that in.
Then I am going to the perimeter file for this
which is this here alzDefaultPolicyAssignments parameters all.
As you'll notice, I already filled that
in with the number of values to save time basically.
I have AES as the top-level management group prefix.
I put it in the resource IT for the Log Analytics workspace,
put it in the correct Automation account name,
and put in the resource ID for the DDoS protection plan.
All that's needed for me now is to change the prefix to
AES since that's where we're going to explain and off again.
>> What is policy assignments are created?
Can you explain limit how
all these policies are actually got that check?
>> Yeah. Absolutely. If I just share
my screen, I just talked through this.
We've documented this in Wiki on the ALZ Bicep repo.
On the right-hand side and the navigation,
you'll see that there's this.
How does ALZ Bicep implement Azure policies?
This will take you to this document.
We talk through how these all get there.
These are all stored in the upstream enterprise scale
repo where the portal experience lives and its home.
We pull all of those policies out of the portal experience and
we share them across
the Bicep rotation and a Terraform module as well,
so that they're consistent.
Whatever implementation option you choose,
you get the same set of policies and the same effects.
In terms of the ones that we assign,
we actually have a number of
default assignments that Jan is now
making with our default assignments module.
Actually what we can do is I'll show you here we've got
another document inside of the enterprise scale repository,
that talks about what policies are
included in the Azure landing zones reference implementation.
We've got this lovely diagram and this has been
worked on by some people in
the community for us that talks about what's assigned where.
If we scroll down during this document a little bit more,
you'll see at the intermediate root level,
it tells you, hey, this five policy sets
here and three definitions and it tells you what they are.
We step through that for each of
the management group scopes
and tell you what's deployed at each of those scopes.
>> Fantastic. That's really helpful to have all these resources.
By now, I guess the policy assignments
should have been deployed and created.
Jan, can we go back and see what actually happened?
>> Now the policy assignments has deployed.
Let's go to the management group
hierarchy and see what it looks like.
I go here to the Azure enablement show, go to policy.
You'll notice that now there are a number of
policy assignments here which weren't there before, basically.
If I further go up and look
at the scopes such as for instance the landing zones,
I can see even more policy assignments on the landing zones scope.
The same goes for different
platform scopes and so on and so forth.
>> Awesome. This pretty really prepares
our landing zones for
the resources we're going to deploy into this.
Jack, can you tell us a little bit
where we should go if you want to learn more and again,
get started with the repo?
>> Absolutely. Well, first of all,
I'll say go and check out the first episode.
Go back in the series and watch the first one.
Then if you want to just get jump straight into it,
go and check out the short link of aka.ms/alz/bicep.
>> Fantastic. Obviously,
we have the third episode ready.
Can you tell me a little bit what we can expect from that episode?
>> Yeah. Absolutely. We've now
set up the management group hierarchy,
put our policies in place,
deployed those core platform utility services so the hub network,
logging all of the security elements.
Now we're actually ready to deploy
landing zone subscriptions and place them in the hierarchy beneath
either corporate online to support our applications and
workloads which are also
supported by the rest of the ALZ platform.
>> Fantastic. Thank you very much,
Jack and Jan. Was again pleasure to have you on this one,
and looking forward to the next one.
Thank you for everyone watching.
Make sure you check out ak.ms/.
[MUSIC]