Azure landing zones Terraform module

Azure provides native services for building your Azure landing zones. Other tools can also help with this effort. One tool that customers and partners often use to deploy landing zones is Terraform by HashiCorp.

Deployment of resources to application landing zones is outside the scope of the module. Decisions on the deployment method and tooling are for the team that's responsible for the application.

The Azure landing zones Terraform module provides a rapid implementation of the platform resources that you need to manage Azure landing zones at scale by using Terraform. The module is designed to simplify the deployment of the management group hierarchy, policies, and resources in the connectivity and management subscriptions.

Prerequisites

If you're new to Terraform and you want information about installing and using it, see the Install Terraform tutorial on HashiCorp Learn.

For information on how to set up the Terraform provider and authenticate with Azure, see the AzureRM provider guides on the Terraform website. To learn how to set up the provider for deploying across multiple subscriptions, see the Provider Configuration wiki page.

Importance of using standard modules

Reuse of components is a fundamental principle of infrastructure as code. Modules are instrumental in defining standards and consistency across resource deployment within and across environments.

The Azure landing zones Terraform module is published to the official Terraform Registry and is verified by HashiCorp.

Deploying the module from the Terraform Registry provides:

• An accelerated delivery of Azure landing zones in your environment.
• A tested upgrade path to the latest version of the module, along with strict version control.

Benefits of using the module

Benefits of using the Azure landing zones Terraform module include:

• A managed and extensible core resource hierarchy for subscription organization through management groups.
• Scalable security governance and compliance through Azure identity and access management (IAM) controls, with an extensive library of custom definitions ready to assign.
• Enforcement of policy across subscriptions through management group inheritance.
• Managed resources for management and connectivity landing zones. These resources provide:
  • Assured policy compliance through tight integration of resources managed by the module and corresponding policy assignments.
  • Integration between resources to reduce management overhead and provide an improved user experience, like automatic creation of virtual network links for Azure Private DNS.

Tip

The template library is updated programmatically from the Azure/Enterprise-Scale GitHub repository. To stay up to date with the latest archetype configuration, policies, and roles, make sure you're using the latest version of the module.

Resource deployment

You can configure the module to deploy sets of resources that align with the following critical design areas in Azure landing zones. Customize these resources to meet the requirements of your organization.

Resource category	Critical design area
Core resources	Resource organization Security Governance
Management resources	Management and monitoring
Connectivity resources	Network topology and connectivity
Identity resources	Identity and access management

Packaging these capabilities into a single Terraform module makes it easier to build and enforce consistency across the Azure platform when you're operating at scale.

These resources align with the Azure landing zones conceptual architecture:

You can deploy these resources, by capability, across multiple subscriptions by using the Provider Configuration on the module block.

The following sections outline the resource types and configuration options.

Core resources

The core capability of this module deploys the foundations of the conceptual architecture for Azure landing zones, with a focus on the central resource organization.

When you enable deployment of core resources (enabled by default), the module deploys and manages the following resource types:

Resource	Azure resource type	Terraform resource type
Management groups	Microsoft.Management/managementGroups	azurerm_management_group
Management group subscriptions	Microsoft.Management/managementGroups/subscriptions	azurerm_management_group
Policy assignments	Microsoft.Authorization/policyAssignments	azurerm_management_group_policy_assignment
Policy definitions	Microsoft.Authorization/policyDefinitions	azurerm_policy_definition
Policy set definitions	Microsoft.Authorization/policySetDefinitions	azurerm_policy_set_definition
Role assignments	Microsoft.Authorization/roleAssignments	azurerm_role_assignment
Role definitions	Microsoft.Authorization/roleDefinitions	azurerm_role_definition

The exact number of resources that the module creates depends on the module configuration. For a default configuration, you can expect the module to create approximately 180 resources.

Tip

None of these resources are deployed at the subscription scope, but Terraform still requires a subscription to establish an authenticated session with Azure. For more information on authenticating with Azure, see the Azure Provider: Authenticating to Azure documentation.

Management resources

The module provides an option to enable deployment of management and monitoring resources from the conceptual architecture for Azure landing zones into the specified subscription, as described on the Provider Configuration wiki page. The module also ensures that the specified subscription is placed in the right management group.

When you enable deployment of management resources, the module deploys and manages the following resource types (depending on configuration):

Resource	Azure resource type	Terraform resource type
Resource groups	Microsoft.Resources/resourceGroups	azurerm_resource_group
Log Analytics workspace	Microsoft.OperationalInsights/workspaces	azurerm_log_analytics_workspace
Log Analytics solutions	Microsoft.OperationsManagement/solutions	azurerm_log_analytics_solution
Automation account	Microsoft.Automation/automationAccounts	azurerm_automation_account
Log Analytics linked service	Microsoft.OperationalInsights/workspaces /linkedServices	azurerm_log_analytics_linked_service

In addition to deploying the above resources, the module provides native integration into the corresponding policy assignments to ensure full policy compliance.

For more information about how to use this capability, see the Deploy Management Resources wiki page.

Connectivity resources

The module provides an option to enable deployment of network topology and connectivity resources from the conceptual architecture for Azure landing zones into the current subscription context. It also ensures that the specified subscription is placed in the right management group.

This capability enables deployment of multiple hub networks based on any combination of traditional Azure networking topology (hub and spoke), and Virtual WAN network topology (Microsoft-managed).

The module can also create and link DDoS Network Protection to Virtual Networks, and manage centralized public and private DNS zones.

Note

We don't currently recommend DDoS IP Protection in Azure Landing Zones and recommend using this option in specific circumstances. Review the product documentation About Azure DDoS Protection SKU Comparison

Traditional Azure networking topology (hub and spoke)

The module can optionally deploy one or more hub networks based on the traditional Azure networking topology (hub and spoke).

Note

The module currently configures only the networking hub and dependent resources for the connectivity subscription. Although there's an option to enable outbound virtual network peering from hub to spoke, users still need to initiate peering from spoke to hub. This is due to limitations in how the AzureRM provider targets a specific subscription for deployment.

When you deploy resources based on a traditional Azure networking topology (hub and spoke), the module deploys and manages the following resource types (depending on configuration):

Resource	Azure resource type	Terraform resource type
Resource groups	Microsoft.Resources/resourceGroups	azurerm_resource_group
Virtual networks	Microsoft.Network/virtualNetworks	azurerm_virtual_network
Subnets	Microsoft.Network/virtualNetworks/subnets	azurerm_subnet
Virtual network gateways	Microsoft.Network/virtualNetworkGateways	azurerm_virtual_network_gateway
Azure firewalls	Microsoft.Network/azureFirewalls	azurerm_firewall
Public IP addresses	Microsoft.Network/publicIPAddresses	azurerm_public_ip
Virtual network peerings	Microsoft.Network/virtualNetworks/virtualNetworkPeerings	azurerm_virtual_network_peering

For more information about how to use this capability, see the Deploy Connectivity Resources wiki page.

Virtual WAN network topology (Microsoft-managed)

The module can optionally deploy one or more hub networks based on the Virtual WAN network topology (Microsoft-managed).

Note

Due to the different capabilities of Virtual WAN network resources over traditional, peering for Virtual WAN spokes is bi-directional when using this capability.

When you deploy resources based on a Virtual WAN network topology (Microsoft-managed), the module deploys and manages the following resource types (depending on configuration):

Resource	Azure resource type	Terraform resource type
Resource Groups	Microsoft.Resources/resourceGroups	azurerm_resource_group
Virtual WANs	Microsoft.Network/virtualWans	azurerm_virtual_wan
Virtual Hubs	Microsoft.Network/virtualHubs	azurerm_virtual_hub
Express Route Gateways	Microsoft.Network/expressRouteGateways	azurerm_express_route_gateway
VPN Gateways	Microsoft.Network/vpnGateways	azurerm_vpn_gateway
Azure Firewalls	Microsoft.Network/azureFirewalls	azurerm_firewall
Azure Firewall Policies	Microsoft.Network/firewallPolicies	azurerm_firewall_policy
Virtual Hub Connections	Microsoft.Network/virtualHubs/hubVirtualNetworkConnections	azurerm_virtual_hub_connection

For more information about how to use this capability, see the Deploy Virtual WAN Resources wiki page.

DDoS Protection plan

The module can optionally deploy DDoS Network Protection, and link Virtual Networks to the plan if needed.

Note

Due to platform limitations, DDoS Protection plans can only be enabled for traditional virtual networks. Virtual Hub support is not currently available.

Important

The Azure landing zones guidance recommends enabling DDoS Network Protection to increase protection of your Azure platform. To prevent unexpected costs in non-production and MVP deployments, this capability is disabled in the Azure landing zones Terraform module due to the cost associated with this resource.

For production environments, we strongly recommend enabling this capability.

When you enable deployment of deployment of DDoS Protection plan resources, the module deploys and manages the following resource types (depending on configuration):

Resource	Azure resource type	Terraform resource type
Resource groups	Microsoft.Resources/resourceGroups	azurerm_resource_group
DDoS Protection plans	Microsoft.Network/ddosProtectionPlans	azurerm_network_ddos_protection_plan

DNS

The module can optionally deploy Private DNS zones to support Private Endpoints and link them to hub and/or spoke Virtual Networks. User-specified public and private DNS zones can also be deployed and linked as needed.

When you enable deployment of deployment of DNS resources, the module deploys and manages the following resource types (depending on configuration):

Resource	Azure resource type	Terraform resource type
Resource Groups	Microsoft.Resources/resourceGroups	azurerm_resource_group
DNS Zones	Microsoft.Network/dnsZones	azurerm_dns_zone
Private DNS Zones	Microsoft.Network/privateDnsZones	azurerm_private_dns_zone
Private DNS Zone Virtual Network Link	Microsoft.Network/privatednszones/virtualnetworklinks	azurerm_private_dns_zone_virtual_network_link

Identity resources

The module provides an option to configure policies relating to the identity and access management landing zone. It also ensures that the specified subscription is placed in the right management group.

Note

This capability doesn't deploy any resources. If you want to update policy settings related to the identity management group, use the configure_identity_resources input variable.

For more information about how to use this capability, see the Deploy Identity Resources wiki page.

Getting started

Requirements for getting started with the module are documented on the Getting Started Wiki page.

To simplify getting started, the module has been published to the Terraform Registry. You can reference it directly within your code, as shown in the simple example later in this article. Running terraform init will automatically download the module and all dependencies.

You can view the latest module and provider dependencies on the Dependencies tab in the Terraform Registry.

Important

There are known issues with some Terraform and AzureRM provider version combinations. You can resolve some known issues by upgrading to the latest Terraform and AzureRM provider versions. Other known issues are transient errors that you can typically fix by rerunning your deployment.

We generally recommend pinning to specific versions, and testing thoroughly before upgrading.

We'll release new versions of the module when changes are needed. New releases will ensure compatibility with the latest Terraform and AzureRM provider versions. Please refer to our Module releases guidance for more information.

To get the latest features, ensure that the module version is set to the latest version. If you're upgrading to a later version of the module, run terraform init -upgrade.

Simple example

This example code deploys the minimum recommended management group and subscription organization from the enterprise-scale reference architecture. After you have this simple example up and running, you can start to customize your deployment.

Tip

Even though root_parent_id is the module's only mandatory variable, we also recommend setting root_id. Changing the root_id value will start a full redeployment of all resources that the module manages, including downstream dependencies.

The following code is a simple starting configuration for your main.tf root module:

# Configure Terraform to set the required AzureRM provider
# version and features{} block.

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 2.77.0"
    }
  }
}

provider "azurerm" {
  features {}
}

# Get the current client configuration from the AzureRM provider.
# This configuration is used to populate the root_parent_id variable with the
# current tenant ID used as the ID for the "Tenant Root Group"
# management group.

data "azurerm_client_config" "core" {}

# Use variables to customize the deployment

variable "root_id" {
  type    = string
  default = "es"
}

variable "root_name" {
  type    = string
  default = "Enterprise-Scale"
}

# Declare the Terraform Module for Cloud Adoption Framework
# Enterprise-scale and provide a base configuration.

module "enterprise_scale" {
  source  = "Azure/caf-enterprise-scale/azurerm"
  version = ">= 1.0.0"

  providers = {
    azurerm              = azurerm
    azurerm.connectivity = azurerm
    azurerm.management   = azurerm
  }

  root_parent_id = data.azurerm_client_config.core.tenant_id
  root_id        = var.root_id
  root_name      = var.root_name

}

Next steps

The Terraform module for Cloud Adoption Framework Enterprise-scale provides an accelerated path to building out your enterprise-scale landing zones. It also provides the flexibility to expand and customize your deployment while maintaining a simplified approach to managing the configuration of each landing zone.

To find out more, review the module on the Terraform Registry and explore the module documentation on GitHub. In the documentation, you find more examples and tutorials about how to customize your deployment.

Learn how to deploy the Azure landing zones Terraform module through HashiCorp Learn. From there, you can also discover how some parts of the module work.