>> Welcome back to another episode of the Azure Enablement Show.
This is part of a short series about
the Azure landing zone Terraform module and
how it can help you to not just accelerate,
your deployments of landing zones,
but also help you operate your Cloud resources at scale.
[MUSIC]
>> Welcome back. My name is Thomas and I'm here with
Kevin and Matt from the Azure landing zone team.
We're going to talk about the Azure landing zone Terraform module.
Matt, can you tell us how customers can get
started deploying Azure landing zones
in their own environment using Terraform.
>> Sure Thomas that's not a problem,
you've actually got a series of implementational options
documented on the calf documentation site in the ready section.
If we bring the up now,
you can see this page here,
landings zone implementation options.
If I go to the section in question,
you see we've got a number of ways of doing it,
including using arm and Bicep.
At the bottom, here, you've got
the Azure landing zones Terraform module.
If we click on that link,
it takes us to this page here,
which describes how to use
the module and it has a link to some of the prerequisites.
>> I can see there are a couple of
options there for customers to use.
Can you tell me a little bit more how that
works and how customers can use those?
>> Yeah, of course. In addition to
the ALZ Terraform module is also
a community solution which acts as a wrapper
around it and also enables other deployment options.
You can find more information
about the differences between these two approaches.
At this page here, which is on the screen.
If you scroll down, there's a selecting the right approach for
Terraform option where we give
prescriptive guidance on which options might be best for you.
>> Now perfect. That's very good.
It's great to have that documentation.
Kevin, if I'm now interested,
I'm a customer and I'm now interested of
using the Terraform module. How do I get started?
>> That's a great question and we're really
excited to be here today to tell you a bit more about that.
Basically the module can be found on the Terraform registry.
We've chosen to use the Terraform registry because we feel this is
a great way to make it available to all of our customers.
You can actually find this by,
one of our short links, aka.ms/alz/tf.
On here you can see some of
the reasons why we use the Terraform registry.
We've got information here about versions so customers
can get version control
when selecting which version of the module to use.
That in turn gives them some additional benefits
as well in terms of
being able to have options to stay up to
date with the latest versions of the module.
Because as we walk on
the Azure landing zone solutions we're off to making changes,
we're adding new features or we're fixing bugs.
Terraform really provides a great story around how a customer,
can keep their environments up-to-date through the module.
>> Now potassium, I believe that's absolutely a great approach.
Are there other ways to consume the module?
>> This is actually quite common question
we got from our customers.
There are customers who have concerns around security and
maybe don't want to consume directly from a public registry.
They'll come to us and ask us what
are the options available to them.
Generally, we'll try to recommend
always consume the module as a module,
I think some customers may be tried to take a copy of it so they
might clone the repository will take a forked copy,
and then they'll try and work on it locally and edit it.
We actually quite strongly advise against that.
The module was designed to be configured, not customized.
Terraform themselves, HashiCorp provide some options
through Terraform Enterprise and Terraform Cloud,
where you can create your own private registry.
We'd look at talking customers through the journey of
taking a copy of our module from the public registry,
taking it through their internal security vetting processes,
and then copying it onto
their own private registry for consumption within the business.
>> That make sense. That's a great way of life,
using it obviously in your private enterprise environment.
Matt, how would customers go
and learn how to actually customize their deployment?
We talked about it's not designed to be changed,
would like actually to use customize
the deployment itself with parameters and so on.
Can you tell us and show us how that works?
>> Sure, yeah. There's a lot of customization
available in Terraform modules that we've written.
We'll have a look here at the wiki a lot of effort in
here to this wiki which is hosted in the GitHub repo.
We start by showing you what type of resources
we deploy in the module,
and we're given a set of ever increasing complexity examples,
so we start with the basic stuff,
what we call level 100.
As we evolved through level 200 and 300,
we get to creating custom policies for
instance and deploying management resource with custom settings.
It's really a journey we want to take you on from deploying
the ALZ reference architecture as is,
to being able to customize a completely for your environment.
>> Now fantastic. I love how we have
these different levels and we start with the easy stuff.
If you get started and we'll start with
the easy thing and then you go deeper and deeper into
it and make them more complex but or
more customizable stuff as well, so that's great.
Obviously I want to see the module in action.
Kevin can you show us the module in action?
>> Of course. I've got some content here ready to show today.
We're going to start off within the example's page.
For today's session, we're going to look
specifically at one of the base configurations.
This really is your starting point
for how to get going with the module.
It talks through some of the basic concepts
and in the later videos in
this series will go into
a few more detailed configuration options for this.
But when you're first getting started with this,
this is a really great way to get started with this.
Within the wiki, you can see we've
got the examples that might just mentioned.
On the level 100 we've got the deploy default configuration.
Within here we've got a set of demo code.
Now to get started.
I mean, it really is as simple as taking a copy of this.
Move to your preferred editor,
paste it in, say that I'm
running it as per any other, Terraform module.
All of the information you should need to get
started is in this example code.
Now, to help us a little bit,
we've showing this in a real-world environment.
We've already deployed this and got it ready
so that we can show a customer what this looks like.
If we launch the Azure Cloud shell and have a look at this here,
what I've done is I've gone into
our demo one folder where we've actually
saved the contents of that main.tf file,
and you can see the code here.
Now in terms of the actual module declaration,
it's really simple starting point.
If I just quickly talk through some of the stuff we've done here,
just make it a little more personal for the customer.
We've taken the default client configuration.
This will just use the default context
that the users logged into the platform with at this point.
But what we have done is we've pulled in the Tenantid so that
we know that we're going to deploy
everything under that particular scope.
We've set a custom root id,
and this helps the customer to do a couple of things.
It gives them their own personal identity
when they're deploying your landing zones.
In our examples, you might see things like
Contoso on a lot about documentation.
This would be what you replace Contoso with.
Yeah, your own branding in here.
This root ID is really important
because this actually becomes a part
of the unique naming that is generated through the module as well.
I'll show you that in the Azure portal as well.
Then the root name. This is just used to
name the top-level management group.
Not to get going on this like any other Terraform module,
you would save this.
You would initialize your module and then run Terraform plan,
review the module on output,
and more resources are going to be created.
Then you'd run Terraform apply to actually go and create those.
This can take depending on your configuration.
Anything from 5-15 minutes
for a base configuration of more complex,
it can take well over an hour with
some of the networking resources.
It just helps speed this up.
As I mentioned, we've got the environment ready to deploy to.
You can have a look here and see how
some of this looks in practice.
Let's click into the Azure enablement showing management group.
Here you can see the aes
demo-1 prefix that we mentioned earlier on the root
id and each of the management groups
in the hierarchy have being given this prefix.
This is very similar to what you'll see through
the portal-based experience and if you are using bicep.
Why we've been slightly different with this is we've
paired back a little bit what you get out of the box.
That's because we recognize that all customers are
going to be different and because of
the way the module works is easier to
add on and build up your configuration,
rather than us throwing too much to the customer in one go.
You'll see we've placeholders here for connectivity,
identity, and management as part of the platform.
But for landing zones,
we've actually left this empty for today.
Again, we'll come back to this in
a future episode and we'll actually talk
about how you would start to move
subscriptions into this hierarchy,
and how you would start to customize and extends
the hierarchy to add your own custom management groups.
But before we do that, let's have a look at
some of the policy because this is
a really important part of what
the module does for you as a customer.
If I click over here in policy,
and we go down to definitions,
you can start to get an idea of the scale of some of
the stuff that we've actually implemented through this module.
As you can see on this page,
we've got a number of custom policies
that have been provisioned by the module.
This will be a mix of policy definitions and initiatives.
These are all located in the intermediate root which is where
through the guidance we recommend putting your custom policies.
Now this will work throughout your environment now.
Because of the way resource hierarchy
works and the way you get to inheritance,
you can now consume all of
these policy definitions anywhere within
your hierarchy to create the assignments.
Everything you see in here would be
consistent with what you would get from
the portal-based experience which is built
along or the bicep experience.
>> Now, this is fantastic as always.
Again, just going way back it's
like it's always great to see what we can
do with this infrastructure as
code approach to actually
deploy all this when we figure out like hey,
when we learn over time and you need to write
all the automation by yourself or you
need to go and build all that by yourself,
and you can now make sure that you're actually
following the Cloud Adoption Framework.
Absolutely fantastic, and especially for
customers now who are very familiar with
Terraform they can do that super easy using the Terraform module.
One question I have is,
if I want to get started.
Do I need any special permissions or what are
the permissions I need to have to actually go out and deploy that?
>> That's a brilliant question and
one that we come up with quite often.
Matt I'll pass on over to you.
>> Thanks Kevin. We actually have this questions so
much that we've got a dedicated wiki page on it.
If we bring that up now,
you can see because of
the range of resources that we're deploying,
we're going to some into some detail
here about the permissions that
you need at the management group layer.
Before you get started with the module,
highly recommend that you review this page and make sure that
the identity that you're using to deploy
it has the permissions that it needs.
>> Now, perfect. Again, nothing better
than good documentation on that side.
Obviously, if I'm now
interested and I want to get started with this,
I would obviously watch
the other next episodes we're releasing on that topic.
But Kevin, where would people go to learn more about this?
>> I think the best place for our customers decide is
always going to be on our short link, aka.ms/alz/tf.
From here this will take you to the registry page.
From the registry page you can get to
the modules repository on GitHub,
and from there you can get to all of
the content that we've published through the wiki,
including our examples that we showed today.
>> Awesome. Thank you very much,
Matt and Kevin it was great to have you in this first episode.
For everyone watching, thanks for watching.
Make sure you check out the next episodes and
make sure you also check out aka.ms/adopt. [MUSIC]