Skip to content

Commit 983c068

Browse files
jaredfholgatejaredfholgate
authored
feat: security management group (#106)
* feat: security management group * formatting * fix bicep tests
1 parent c337a3b commit 983c068

7 files changed

Lines changed: 96 additions & 27 deletions

File tree

‎.github/workflows/end-to-end-test.yml‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -242,9 +242,21 @@ jobs:
242242
243243
$Inputs["apply_approvers"] = @()
244244
$Inputs["root_parent_management_group_id"] = ""
245-
$Inputs["subscription_id_connectivity"] = "${{ vars.ARM_SUBSCRIPTION_ID }}"
246-
$Inputs["subscription_id_identity"] = "${{ vars.ARM_SUBSCRIPTION_ID }}"
247-
$Inputs["subscription_id_management"] = "${{ vars.ARM_SUBSCRIPTION_ID }}"
245+
246+
if($infrastructureAsCode -eq "terraform") {
247+
$Inputs["subscription_ids"] = @{
248+
management = "${{ vars.ARM_SUBSCRIPTION_ID }}"
249+
connectivity = "${{ vars.ARM_SUBSCRIPTION_ID }}"
250+
identity = "${{ vars.ARM_SUBSCRIPTION_ID }}"
251+
security = "${{ vars.ARM_SUBSCRIPTION_ID }}"
252+
}
253+
}
254+
255+
if($infrastructureAsCode -eq "bicep") {
256+
$Inputs["subscription_id_connectivity"] = "${{ vars.ARM_SUBSCRIPTION_ID }}"
257+
$Inputs["subscription_id_identity"] = "${{ vars.ARM_SUBSCRIPTION_ID }}"
258+
$Inputs["subscription_id_management"] = "${{ vars.ARM_SUBSCRIPTION_ID }}"
259+
}
248260
249261
$Inputs["parent_management_group_display_name"] = "Tenant Root Group"
250262
$Inputs["child_management_group_display_name"] = "E2E Test"

‎alz/azuredevops/locals.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,8 @@ locals {
2929
}
3030

3131
locals {
32-
target_subscriptions = distinct([var.subscription_id_connectivity, var.subscription_id_identity, var.subscription_id_management])
32+
target_subscriptions_legacy = distinct([var.subscription_id_connectivity, var.subscription_id_identity, var.subscription_id_management])
33+
target_subscriptions = length(var.subscription_ids) > 0 ? distinct(values(var.subscription_ids)) : local.target_subscriptions_legacy
3334
}
3435

3536
locals {

‎alz/azuredevops/variables.tf‎

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14,30 +14,48 @@ variable "root_parent_management_group_id" {
1414
default = ""
1515
}
1616

17+
variable "subscription_ids" {
18+
description = "The list of subscription IDs to deploy the Platform Landing Zones into"
19+
type = map(string)
20+
default = {}
21+
nullable = false
22+
validation {
23+
condition = length(var.subscription_ids) == 0 || alltrue([for id in values(var.subscription_ids) : can(regex("^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$", id))])
24+
error_message = "All subscription IDs must be valid GUIDs"
25+
}
26+
validation {
27+
condition = length(var.subscription_ids) == 0 || alltrue([for id in keys(var.subscription_ids) : contains(["management", "connectivity", "identity", "security"], id)])
28+
error_message = "The keys of the subscription_ids map must be one of 'management', 'connectivity', 'identity' or 'security'"
29+
}
30+
}
31+
1732
variable "subscription_id_connectivity" {
18-
description = "The identifier of the Connectivity Subscription"
33+
description = "DEPRECATED (use subscription_ids instead): The identifier of the Connectivity Subscription"
1934
type = string
35+
default = null
2036
validation {
21-
condition = can(regex("^[0-9a-fA-F-]{36}$", var.subscription_id_connectivity))
22-
error_message = "The bootstrap subscription ID must be a valid GUID"
37+
condition = var.subscription_id_connectivity == null || can(regex("^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$", var.subscription_id_connectivity))
38+
error_message = "The subscription ID must be a valid GUID"
2339
}
2440
}
2541

2642
variable "subscription_id_identity" {
27-
description = "The identifier of the Identity Subscription"
43+
description = "DEPRECATED (use subscription_ids instead): The identifier of the Identity Subscription"
2844
type = string
45+
default = null
2946
validation {
30-
condition = can(regex("^[0-9a-fA-F-]{36}$", var.subscription_id_identity))
31-
error_message = "The bootstrap subscription ID must be a valid GUID"
47+
condition = var.subscription_id_identity == null || can(regex("^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$", var.subscription_id_identity))
48+
error_message = "The subscription ID must be a valid GUID"
3249
}
3350
}
3451

3552
variable "subscription_id_management" {
36-
description = "The identifier of the Management Subscription"
53+
description = "DEPRECATED (use subscription_ids instead): The identifier of the Management Subscription"
3754
type = string
55+
default = null
3856
validation {
39-
condition = can(regex("^[0-9a-fA-F-]{36}$", var.subscription_id_management))
40-
error_message = "The bootstrap subscription ID must be a valid GUID"
57+
condition = var.subscription_id_management == null || can(regex("^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$", var.subscription_id_management))
58+
error_message = "The subscription ID must be a valid GUID"
4159
}
4260
}
4361

‎alz/github/locals.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,8 @@ locals {
3636
}
3737

3838
locals {
39-
target_subscriptions = distinct([var.subscription_id_connectivity, var.subscription_id_identity, var.subscription_id_management])
39+
target_subscriptions_legacy = distinct([var.subscription_id_connectivity, var.subscription_id_identity, var.subscription_id_management])
40+
target_subscriptions = length(var.subscription_ids) > 0 ? distinct(values(var.subscription_ids)) : local.target_subscriptions_legacy
4041
}
4142

4243
locals {

‎alz/github/variables.tf‎

Lines changed: 24 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,29 +14,47 @@ variable "root_parent_management_group_id" {
1414
default = ""
1515
}
1616

17+
variable "subscription_ids" {
18+
description = "The list of subscription IDs to deploy the Platform Landing Zones into"
19+
type = map(string)
20+
default = {}
21+
nullable = false
22+
validation {
23+
condition = length(var.subscription_ids) == 0 || alltrue([for id in values(var.subscription_ids) : can(regex("^[0-9a-fA-F-]{36}$", id))])
24+
error_message = "All subscription IDs must be valid GUIDs"
25+
}
26+
validation {
27+
condition = length(var.subscription_ids) == 0 || alltrue([for id in keys(var.subscription_ids) : contains(["management", "connectivity", "identity", "security"], id)])
28+
error_message = "The keys of the subscription_ids map must be one of 'management', 'connectivity', 'identity' or 'security'"
29+
}
30+
}
31+
1732
variable "subscription_id_connectivity" {
18-
description = "The identifier of the Connectivity Subscription"
33+
description = "DEPRECATED (use subscription_ids instead): The identifier of the Connectivity Subscription"
1934
type = string
35+
default = null
2036
validation {
21-
condition = can(regex("^[0-9a-fA-F-]{36}$", var.subscription_id_connectivity))
37+
condition = var.subscription_id_connectivity == null || can(regex("^[0-9a-fA-F-]{36}$", var.subscription_id_connectivity))
2238
error_message = "The bootstrap subscription ID must be a valid GUID"
2339
}
2440
}
2541

2642
variable "subscription_id_identity" {
27-
description = "The identifier of the Identity Subscription"
43+
description = "DEPRECATED (use subscription_ids instead): The identifier of the Identity Subscription"
2844
type = string
45+
default = null
2946
validation {
30-
condition = can(regex("^[0-9a-fA-F-]{36}$", var.subscription_id_identity))
47+
condition = var.subscription_id_identity == null || can(regex("^[0-9a-fA-F-]{36}$", var.subscription_id_identity))
3148
error_message = "The bootstrap subscription ID must be a valid GUID"
3249
}
3350
}
3451

3552
variable "subscription_id_management" {
36-
description = "The identifier of the Management Subscription"
53+
description = "DEPRECATED (use subscription_ids instead): The identifier of the Management Subscription"
3754
type = string
55+
default = null
3856
validation {
39-
condition = can(regex("^[0-9a-fA-F-]{36}$", var.subscription_id_management))
57+
condition = var.subscription_id_management == null || can(regex("^[0-9a-fA-F-]{36}$", var.subscription_id_management))
4058
error_message = "The bootstrap subscription ID must be a valid GUID"
4159
}
4260
}

‎alz/local/locals.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,8 @@ locals {
1717
}
1818

1919
locals {
20-
target_subscriptions = distinct([var.subscription_id_connectivity, var.subscription_id_identity, var.subscription_id_management])
20+
target_subscriptions_legacy = distinct([var.subscription_id_connectivity, var.subscription_id_identity, var.subscription_id_management])
21+
target_subscriptions = length(var.subscription_ids) > 0 ? distinct(values(var.subscription_ids)) : local.target_subscriptions_legacy
2122
}
2223

2324
locals {

‎alz/local/variables.tf‎

Lines changed: 24 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,29 +14,47 @@ variable "root_parent_management_group_id" {
1414
default = ""
1515
}
1616

17+
variable "subscription_ids" {
18+
description = "The list of subscription IDs to deploy the Platform Landing Zones into"
19+
type = map(string)
20+
default = {}
21+
nullable = false
22+
validation {
23+
condition = length(var.subscription_ids) == 0 || alltrue([for id in values(var.subscription_ids) : can(regex("^[0-9a-fA-F-]{36}$", id))])
24+
error_message = "All subscription IDs must be valid GUIDs"
25+
}
26+
validation {
27+
condition = length(var.subscription_ids) == 0 || alltrue([for id in keys(var.subscription_ids) : contains(["management", "connectivity", "identity", "security"], id)])
28+
error_message = "The keys of the subscription_ids map must be one of 'management', 'connectivity', 'identity' or 'security'"
29+
}
30+
}
31+
1732
variable "subscription_id_connectivity" {
18-
description = "The identifier of the Connectivity Subscription"
33+
description = "DEPRECATED (use subscription_ids instead): The identifier of the Connectivity Subscription"
1934
type = string
35+
default = null
2036
validation {
21-
condition = can(regex("^[0-9a-fA-F-]{36}$", var.subscription_id_connectivity))
37+
condition = var.subscription_id_connectivity == null || can(regex("^[0-9a-fA-F-]{36}$", var.subscription_id_connectivity))
2238
error_message = "The bootstrap subscription ID must be a valid GUID"
2339
}
2440
}
2541

2642
variable "subscription_id_identity" {
27-
description = "The identifier of the Identity Subscription"
43+
description = "DEPRECATED (use subscription_ids instead): The identifier of the Identity Subscription"
2844
type = string
45+
default = null
2946
validation {
30-
condition = can(regex("^[0-9a-fA-F-]{36}$", var.subscription_id_identity))
47+
condition = var.subscription_id_identity == null || can(regex("^[0-9a-fA-F-]{36}$", var.subscription_id_identity))
3148
error_message = "The bootstrap subscription ID must be a valid GUID"
3249
}
3350
}
3451

3552
variable "subscription_id_management" {
36-
description = "The identifier of the Management Subscription"
53+
description = "DEPRECATED (use subscription_ids instead): The identifier of the Management Subscription"
3754
type = string
55+
default = null
3856
validation {
39-
condition = can(regex("^[0-9a-fA-F-]{36}$", var.subscription_id_management))
57+
condition = var.subscription_id_management == null || can(regex("^[0-9a-fA-F-]{36}$", var.subscription_id_management))
4058
error_message = "The bootstrap subscription ID must be a valid GUID"
4159
}
4260
}

0 commit comments

Comments
 (0)