>> Welcome back to another episode of the Azure Enablement Show.
Today we're going to have a look how you can
deploy your Azure Landing Zones using Bicep.
Make sure to check out the links in the description below,
as well as subscribe to the show so you don't miss any episodes.
[MUSIC] Welcome back.
My name is Thomas and I'm here with Jack and Jan from
the Azure Landing Zone Bicep team to talk about
the Azure Landing Zone Bicep tooling
and why it was created and why it's
there and how you actually can get started to
deploy your landing zones using Bicep.
Azure Landing Zones for those who are new are
obviously a great way for organizations to
build their platform in Azure to
make sure that everything is done using best practices.
Now, in this episode, again,
we're going to talk about how you can do that using Bicep.
I'm again happy to have Jack and Jan here from the team.
Before we dive into this and
you're obviously going to show us also a
bit about this in this episode and a couple of orders.
Can you tell me a little bit about what the difference is
between Azure Landing Zones and Enterprise Scale, for example.
>> That's a great question, Thomas.
Actually there is nothing different between them.
It's a simple thing where we are migrating it
through a marketing journey
where it was called Enterprise Scale originally,
and we're migrating that to become the Azure Landing Zone.
If you see Enterprise Scale,
or you see Azure Landing Zone,
know they are the same thing.
>> Thank you very much for clarifying this because we
used obviously both terms a lot.
Again, we're going to talk about Bicep today,
but obviously there are different options,
how you can deploy your landing zones.
What are the different implementation options organizations have?
>> Absolutely. We started with the initial portal accelerator.
Where you can go through a GUI based experience in
the Azure portal and fill out some radio buttons and text fields,
and you can deploy it that way.
We are obviously going to talk about Bicep today,
so I'll leave that for a little bit later.
But we also have the Azure Landing Zones Terraform module as well.
If you're a Terraform base customer,
you can choose to deploy
the Azure Landing Zones architecture
via a Terraform module as well.
>> Perfect. Great job like different options here.
Again, we're talking about Azure Landing Zone Bicep today.
Can you tell me a little bit why this was built?
>> Mainly based of customer feedback.
On the portal based accelerator,
we had a couple of issues raised saying, hey,
it'd be great if we could have this in Bicep when biceps was first
announced We were like yeah, that's a great idea.
That's the way the Azure Native
Infrastructure Code Tooling is progressing.
Let's take it on board and
start developing this in Bicep so that customers can
start with a recommended infrastructure code tooling
in Azure from day one.
>> Awesome. Jan,
I have a question for you here as well.
For customers who now want to start and working with
the Azure Landing Zone Bicep Tooling, where do they go?
>> That's an excellent question. Let me just share my screen.
As you can see, Azure Landing Zone Bicep lives in GitHub in
this GitHub repo that we've created with
our written file [inaudible] repo.
The base of the modules are in the info-as-code/biceps folder,
where we have CRML,
which are some modules that we leveraged
from another project and orchestration,
which I'll get back to in a later session.
Then we have the modules folder where we have
the different modules that we're using for
deploying landing zones with Bicep.
If we're going to look at
the management group's folder for instance,
you'll see the module for actually creating management groups.
That's the Bicep folder and root.
After the folder and then we have parameters
where we have two different flavors of parameter folders.
One is the parameters all folder,
which is basically containing
all the parameters which are required for that particular module.
Then we have minimum,
which are the minimum required parameters for
the module and the rest of them can be specified by default.
Also we have the Read Me here for the specific module,
considering a bit of information
about what is it that we're deploying.
Also a bit of information about parameters,
and especially about output and so on.
Also about how we actually deploy the module,
what are the clients that we need to run.
This is done for both CLI and PowerShell
and for Azure Local and for Azure China.
>> You mentioned that there are like these different modules.
Can you explain me like,
how would now identify
which different modules I actually need to deploy,
and is there a specific order for
me to keep in mind how to deploy these?
>> That's a very good question.
The modules were originally designed to be able to
be deployed individually but there are dependencies.
For instance, we have the management groups.
This is requirement to deploy
a policy definitions and role definitions and so on and so forth.
What we did was we created the deployment flow,
where we have this nice graphic showing that, first of all,
you need to deploy the management group module,
then the policy definition,
then role definitions, and then so on and
so forth with the specific or the way you want to do it in.
Also, we actually have the order down here in
table where we also obviously have it sorted in order.
We also provide a little description of what
the individual modules do concerning
specific prerequisites such as,
owner role permissions or something like that.
Then we have a link to the Read Me file that I showed just
before with the specific deployment instructions.
>> Perfect. Now I understand.
I know now where I need to go to
actually get all these modules and I
understand which one to choose,
and the order and where I find that information.
Now, if I actually wanted to deploy this, how do I start?
>> Excellent question. The first thing I'd need to do would
be to actually flow in the repo to blind somewhere.
Or I won't be able to do anything.
I'll just go here and get the clone here.
Then I'll start a PowerShell here and I will just go to repo.
Now I want to show you something because the first thing was,
as we just discussed, we
want to deploy the management groups first.
As you can see in this particular tenant,
we don't actually have any management groups
yet or we had only the tenant root group.
What I'm going to be doing is I'll be deploying that
particular management groups now to this tenant.
I'll go here and I'll go back to the deployment flow.
I'll go to management groups,
scroll down to the command line.
As you noticed, I opened a partial PowerShell.
I'll just use one.
Copy that and go here and copy that in.
Since we are doing the Azure enablement show,
what I'll be doing is I'll just open Visual Studio Code.
I'll go to Azure Learning for Biceps,
infra-as-code, modules, managementGroups, parameters.
Open the parameters old file and change this to aes,
and change the display name to Azure Enablement Show.
>> If I would be a company or organization,
I would put in my personal names and staff in for that.
>> Indeed. That is very much okay.
Absolutely. We go and saved it.
I can just wait.
I'm not sure it's running and it will
take a couple of minutes to be good.
That took about five minutes or so if we go to up here,
we can see that the deployment
succeeded and it's deployed everything.
Let's go and see what that looks like.
You'll notice that this was before and now just to refresh.
Now we have a nice Azure Enablement
Show management hierarchy here.
If we drill deeper into that,
we can see that we have,
so the prefix here, it goes into all the names.
Then we have a Azure Landing Zones,
we have platform, we have Sandbox.
If we drill further into it,
we have Corp and Online and we have
platform connectivity identity and management and Sandbox.
>> That is pretty cool. With these Bicep modules and templates,
we can really deploy the whole Azure Landing Zone Infrastructure.
We just saw right now, the managementGroups.
But there's obviously more like setting up
networking and other stuff as well.
Like pretty cool.
Again, we will talk more about,
in the next episodes about this.
But so check if
now people want to get started with this and they want to see,
for example, have a look at
this repo and to work with that, where do they go?
Absolutely.They can hit to the short link of
aka.ms/aoc@/bicep and that'll take
you to the root of the repository.
You can find the deployment flow page from there and get cracking.
>> Awesome. We have more episodes planned.
What do we expect?
What can we expect from the next episodes?
>> Absolutely. We're going to take you through pretty much
deploying the entire AOC Bicep repository.
As you said, deployment,
networking policies, some of the logging modules, the security,
everything you see in the big picture,
you should be deployed by the end of all of these episodes.
>> Awesome. That's fantastic.
Thank you very much Jan and Jack,
it was great to have you on this episode today and
thank you for everyone watching
and make sure you check out aka.ms/aoc.
>> [MUSIC]