Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Activity
  • Aug 03 15:17
    dsfrederic opened #280
  • Aug 03 08:43
    arnaudlh closed #181
  • Aug 03 08:43
    arnaudlh assigned #181
  • Aug 03 08:43
    arnaudlh labeled #181
  • Aug 03 08:41
    arnaudlh synchronize #181
  • Aug 03 08:41
    arnaudlh opened #181
  • Aug 03 08:33
    arnaudlh closed #180
  • Aug 03 08:16
    arnaudlh review_requested #180
  • Aug 03 08:13
    arnaudlh edited #180
  • Aug 03 08:12
    arnaudlh labeled #180
  • Aug 03 08:12
    arnaudlh assigned #180
  • Aug 03 08:11
    arnaudlh opened #180
  • Aug 03 07:51
    arnaudlh closed #176
  • Aug 03 07:51
    arnaudlh closed #177
  • Aug 02 08:44
    arnaudlh closed #279
  • Aug 02 08:30
    arnaudlh labeled #279
  • Aug 02 07:44
    LaurentLesle assigned #279
  • Aug 02 07:44
    LaurentLesle review_requested #279
  • Aug 02 07:44
    LaurentLesle opened #279
  • Aug 02 06:00
    arnaudlh labeled #177
Kieran
@kiebrew

Hi I'm trying to deploy the es_root archetype (https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/tree/main/modules/archetypes/lib). But when I do so, I keep getting the following error

Terraform returned errors:
╷
│ Error: reading Policy Set Definition "Deploy-ASC-Config": policy.SetDefinitionsClient#GetBuiltIn: Failure responding to request: StatusCode=404 -- Original Error: autorest/azure: Service returned an error. Status=404 Code="PolicySetDefinitionNotFound" Message="The policy set definition 'Deploy-ASC-Config' could not be found."
│ 
│   with module.enterprise_scale.data.azurerm_policy_set_definition.external_lookup["/providers/Microsoft.Management/managementGroups/im/providers/Microsoft.Authorization/policySetDefinitions/Deploy-ASC-Config"],
│   on /home/vscode/.terraform.cache/modules/enterprise_scale/locals.policy_assignments.tf line 90, in data "azurerm_policy_set_definition" "external_lookup":
│   90: data "azurerm_policy_set_definition" "external_lookup" {
│ 
╵
╷
│ Error: reading Policy Set Definition "Deploy-Diagnostics-LogAnalytics": policy.SetDefinitionsClient#GetBuiltIn: Failure responding to request: StatusCode=404 -- Original Error: autorest/azure: Service returned an error. Status=404 Code="PolicySetDefinitionNotFound" Message="The policy set definition 'Deploy-Diagnostics-LogAnalytics' could not be found."
│ 
│   with module.enterprise_scale.data.azurerm_policy_set_definition.external_lookup["/providers/Microsoft.Management/managementGroups/im/providers/Microsoft.Authorization/policySetDefinitions/Deploy-Diagnostics-LogAnalytics"],
│   on /home/vscode/.terraform.cache/modules/enterprise_scale/locals.policy_assignments.tf line 90, in data "azurerm_policy_set_definition" "external_lookup":
│   90: data "azurerm_policy_set_definition" "external_lookup" {

I can see that the policy definitions/assignment exist in that lib folder so i'm not sure what the issue is - has anyone else come across something like this?

3 replies
kgib
@kgibson-insight:matrix.org
[m]
Still getting error on level1 deploy with starter repo
│ Error: Invalid index
│ 
│   on /home/vscode/.terraform.cache/modules/solution/modules/security/keyvault_access_policies/policies.tf line 48, in module "azuread_group":
│   48:   object_id     = try(each.value.lz_key, null) == null ? var.azuread_groups[var.client_config.landingzone_key][each.value.azuread_group_key].id : var.azuread_groups[each.value.lz_key][each.value.azuread_group_key].id
│     ├────────────────
│     │ each.value.azuread_group_key is "keyvault_level1_rw"
│     │ each.value.lz_key is "launchpad"
│     │ var.azuread_groups is object with 4 attributes
│ 
│ The given key does not identify an element in this collection value.
Can someone help point me to where the issue might be? Not sure how to troubleshoot this error
kgib
@kgibson-insight:matrix.org
[m]
which key is message referencing?
Paul Matthews
@pmatthews05

Deployed all of Level0, using Sandpit as the example, which deploys diagnostics for the different resources. Now I'm working on ESLZ which deploys diagnostic policies and the remediation of those policies are failing because a diagnostic has already been deployed with a different name. I thought about passing in the profile name to match, however, as the "Deploy-Resource-Diag" is an initiative I can only pass in one profile name. Where some resources the diagnostics are called "operational_logs_and_metrics" or "operations" or "siem" or "storageAccountsDiagnosticsLogsToWorkspace" etc.

We have decided to remove all the diagnostics from our level0 deployment and just use Azure Policies going forward. Could the people who created this project comment on this please? Also interested in anyone elses thoughts on this.

1 reply
Tom Howarth
@TomHowarth

I banging my head against the wall with this at the moment. I have followed the documentation and I receive the following errors:


│ Error: Unsupported attribute

│ on dynamic_secrets.tf line 11, in module "dynamic_keyvault_secrets":
│ 11: keyvault = module.launchpad.keyvaults[each.key]
│ ├────────────────
│ │ module.launchpad is a object, known only after apply

│ This object does not have an attribute named "keyvaults".


│ Error: Unsupported attribute

│ on main.tf line 74, in locals:
│ 74: storage_account_name = module.launchpad.storage_accounts[var.launchpad_key_names.tfstates[0]].name
│ ├────────────────
│ │ module.launchpad is a object, known only after apply

│ This object does not have an attribute named "storage_accounts".


│ Error: Unsupported attribute

│ on main.tf line 75, in locals:
│ 75: container_name = module.launchpad.storage_accounts[var.launchpad_key_names.tfstates[0]].containers["tfstate"].name
│ ├────────────────
│ │ module.launchpad is a object, known only after apply

│ This object does not have an attribute named "storage_accounts".


│ Error: Unsupported attribute

│ on main.tf line 76, in locals:
│ 76: resource_group_name = module.launchpad.storage_accounts[var.launchpad_key_names.tfstates[0]].resource_group_name
│ ├────────────────
│ │ module.launchpad is a object, known only after apply

│ This object does not have an attribute named "storage_accounts".

my question is what are these lines expecting. this si attempting to deploy the launchpad 200 scenario
kgib
@kgibson-insight:matrix.org
[m]
can anyone explain how archetypes may be leverages for a CAF deployment?
2 replies
Tom Howarth
@TomHowarth
where can I find an explaination of error statuss from the rover?
Tom Howarth
@TomHowarth
  Does anybody actually monitor this community?                                                                                                          
kgib
@kgibson-insight:matrix.org
[m]
sure doesn't seem like it, no response to issues on github either
I'm extremely confused by this whole framework. In AWS, there are community supported modules. Is MSFT working on something similar? It would be much more useful to develop a framework of modules and offer guidance for implementing in a well architected framework. Or, as AWS did, develop an Azure product to enforce guardrails. Managing with code is extremely complex
Tom Howarth
@TomHowarth
the annoying thing is that he people behind this are MS employees
kgib
@kgibson-insight:matrix.org
[m]
archetypes are collections of policies?
kgib
@kgibson-insight:matrix.org
[m]
these things (policies, policy assignments, role definitions and rbac assignments) attached to a subscription is how I've interpreted a Landing Zone to be. Accurate?
3 replies
kgib
@kgibson-insight:matrix.org
[m]
can anyone explain the decision to use nested modules and how to prevent one module changes from breaking another?
Arnaud Lheureux
@arnaudlh
BACK FROM VACATION! --> For those wondering, yes we are back from vacation and will resume normal operations starting this week :)
Tanner Watson
@tannerwatson

BACK FROM VACATION! --> For those wondering, yes we are back from vacation and will resume normal operations starting this week :)

Welcome back :D

kgib
@kgibson-insight:matrix.org
[m]
I've been evaluating the unified the repo and have a pretty good grasp on the concept of separating configuration from logic, though I'm still missing possible configuration specs to reference.
for example this sandpit config for event hub namespaces (https://github.com/Azure/caf-terraform-landingzones-starter/blob/starter/configuration/sandpit/level0/launchpad/diagnostic_event_hub_namespaces.tfvars), are potential diagnostic_event_hub_namespace options posted anywhere?
2 replies
I'm still very unclear how to build out my own configuration specs
kgib
@kgibson-insight:matrix.org
[m]
I still don't follow
so If I want to define a resource group in CAF configuration, how do I reference this https://github.com/aztfmod/terraform-azurerm-caf/blob/master/resource_groups.tf
where is it specified which properties are available and possible values?
But in CAF config example, we have
    resource_groups = {
      level0 = {
        "Reader" = {
          azuread_groups = {
            keys = ["caf_launchpad_Reader"]
          }
        }
      }
kgib
@kgibson-insight:matrix.org
[m]
OK...here is the resource group module code
# naming convention
resource "azurecaf_name" "rg" {
  name          = var.resource_group_name
  resource_type = "azurerm_resource_group"
  prefixes      = var.global_settings.prefixes
  random_length = var.global_settings.random_length
  clean_input   = true
  passthrough   = var.global_settings.passthrough
  use_slug      = var.global_settings.use_slug
}

resource "azurerm_resource_group" "rg" {
  name     = azurecaf_name.rg.result
  location = var.global_settings.regions[lookup(var.settings, "region", var.global_settings.default_region)]
  tags = merge(
    var.tags,
    lookup(var.settings, "tags", {})
  )
}

having used many TF modules, it's pretty standard to do something like

module "resource_group" "rg" {
  source  = "git::https://github.com/aztfmod/terraform-azurerm-caf/blob/master/modules/resource_group/module.tf"
  version = "1.0.0"

  name      = var.rg_name
  location  = var.rg_location
  tags      = var.rg_tags
}

How is it better to use this round about way of specifying configs?

kgib
@kgibson-insight:matrix.org
[m]
@arnaudlh: would really love some help here
kgib
@kgibson-insight:matrix.org
[m]

if nothing else, it'd be nice to have things structured as something that matches the CAF config definition like

resource_group = {
  name = "Reader"
  azuread_groups = [group1, group2]
  caf_level = level0
}

My real confusion is how do I know which landing zone configs the resource group needs to specify. Where is the landing zone configuration spec?

1 reply
Ryan Bartram
@rdbartram
Hey Guys, first question in here...stuck at the beginning seemingly. I'm trying to deploy azure_devops_v1 and it requires the pat token. I noticed there was a bug where it was pulling from the secrets keyvault key and not the level0...problem is the pat token "azdo-pat-admin" isn't filled out. I know I can fill it out myself in the launchpad...but what is the purpose of "aad-user-devops-user-admin", username pat-rotation...should this be automatic some how? thanks!
1 reply
Ryan Bartram
@rdbartram
perhaps easier said, does someone have a working configuration for azure_devops v1 or otherwise
3 replies
Henry Dobson
@henrydobson
Hi @arnaudlh and all, I have recently switched from AWS to Azure and keen to adopt CAF. I've tried a couple of standalone module implementations and had varying levels of success. As a newcomer, I find the approach used for the tfvars a bit ambiguous at times. I couldn't find an explanation of the approach in the contribution guide or other docs. Is there a reference someone can point me to?
2 replies
kgib
@kgibson-insight:matrix.org
[m]
the AWS community modules are such a great resource, and I feel like that's what MSFT are attempting to build here, but the implementation is completely different than other TF modules and it's difficult to understand how to use the proprietary tfvars format
Henry Dobson
@henrydobson
Are the caf-terraform-landingzones-starter and caf-terraform-landingzones capable of replicating the Enterprise Scale conceptual architecture in multiple subscriptions or is it designed to be deployed to a single subscription? If multiple subs in Enterprise scale, are the landingzone layers used to target different subscriptions and therefore have a relationship to the connectivity (layer2) and management subs (layer1) etc?
7 replies
Luke Heidecke
@heidecke
This message was deleted
2 replies
Dominic Motuka
@daumie

Importing KeyVault with rover 🔐

Command used

rover   -lz /tf/caf/landingzones/caf_solution/  -tfstate example.tfstate -var-folder /tf/caf/configuration/example/level3/example-linux-vm -parallelism 30  -env example -level level3 -a import module.solution.module.keyvaults[\"example_vm_rg1\"].module.initial_policy[0].module.logged_in_user[\"logged_in_user\"].azurerm_key_vault_access_policy.policy /subscriptions/<subscription-id>/resourceGroups<example>-virtual-machine-rg1/providers/Microsoft.KeyVault/vaults/<vault-name>/objectId/<objectId>

I could use some help importing Keyvault. Seeing the following errors:

Terraform import return code: 1
Terraform returned errors:
╷
│ Error: Invalid index
│ 
│   on /home/vscode/.terraform.cache/modules/solution/modules/compute/virtual_machine/output.tf line 39, in output "ssh_keys":
│   39:     ssh_private_key_pem      = azurerm_key_vault_secret.ssh_private_key[local.os_type].name
│     ├────────────────
│     │ azurerm_key_vault_secret.ssh_private_key is object with no attributes
│     │ local.os_type is "linux"
│ 
│ The given key does not identify an element in this collection value.
╵

╷
│ Error: Invalid index
│ 
│   on /home/vscode/.terraform.cache/modules/solution/modules/compute/virtual_machine/output.tf line 40, in output "ssh_keys":
│   40:     ssh_public_key_open_ssh = azurerm_key_vault_secret.ssh_public_key_openssh[local.os_type].name
│     ├────────────────
│     │ azurerm_key_vault_secret.ssh_public_key_openssh is object with no attributes
│     │ local.os_type is "linux"
│ 
│ The given key does not identify an element in this collection value.
╵

╷
│ Error: Invalid index
│ 
│   on /home/vscode/.terraform.cache/modules/solution/modules/compute/virtual_machine/output.tf line 41, in output "ssh_keys":
│   41:     ssh_private_key_open_ssh = azurerm_key_vault_secret.ssh_public_key_openssh[local.os_type].name #for backard compat, wrong name, will be removed in future version.
│     ├────────────────
│     │ azurerm_key_vault_secret.ssh_public_key_openssh is object with no attributes
│     │ local.os_type is "linux"
│ 
│ The given key does not identify an element in this collection value.
╵

Error on or near line 573: Error running terraform import; exiting with status 2003
Paul Matthews
@pmatthews05

@arnaudlh following your youtube video https://www.youtube.com/watch?v=fqgv4Wsvo88 I'm doing nothing different from you apart from the location of UKSouth and my own password, and I get the below error message.

TASK [wait for the WinRM port to come online] *****************************************************************************************************************************
ok: [localhost]

PLAY [Setup the CAF development tools] ************************************************************************************************************************************

TASK [Gathering Facts] ****************************************************************************************************************************************************
fatal: [localhost]: UNREACHABLE! => {"changed": false, "msg": "ntlm: the specified credentials were rejected by the server", "unreachable": true}

PLAY RECAP ****************************************************************************************************************************************************************
localhost                  : ok=12   changed=0    unreachable=1    failed=0    skipped=0    rescued=0    ignored=0

I'm able to log into the VM using RDP with the king.admin and password I have set. Are you able to advise why its failing for me?

3 replies
kgib
@kgibson-insight:matrix.org
[m]
can anyone share an experience around why CAF is preferred over individual TF modules that create resources? I can see a benefit in using the enterprise scale repo to build out the management group structure, but using the CAF unified repo to deploy resources appears to be suicide at this point.
1 reply
Luke Heidecke
@heidecke
@LaurentLesle With the 5.4.1 patch release, a regression was introduced with next hop for routing tables.
Error: Error in function call

  on /home/vsts_azpcontainer/modules/solution/modules/networking/virtual_hub_route_tables/route_local.tf line 9, in locals:
   9:         nextHop = coalesce(
  10:           try(value.next_hop_id, ""),
  11:           try(var.remote_objects.virtual_hub_connections[value.next_hop.lz_key][value.next_hop.key].id, ""),
  12:           try(var.remote_objects.azurerm_firewalls[value.next_hop.lz_key][value.next_hop.key].id, ""),
  13:           try(var.resource_ids[value.next_hop.resource_type][value.next_hop.lz_key][value.next_hop.key].id, "")   # Note the virtual_hub_connection must come from a remote tfstate only. PB with circular reference in the object model of vhub tables and connections
  14:         )
    ├────────────────
    │ value.next_hop is object with 2 attributes
    │ value.next_hop.resource_type is "azurerm_firewall"var.remote_objects.azurerm_firewalls is object with 3 attributes
var.remote_objects.virtual_hub_connections is object with 3 attributes
var.resource_ids is object with 1 attribute "virtual_hub_connection"

Call to function "coalesce" failed: no non-null, non-empty-string arguments.
Terraform plan return code: 1
5 replies
Paul Matthews
@pmatthews05
Is there a way to assign a MSI, graph API permissions with CAF?
3 replies
Ryan Bartram
@rdbartram
can anyone help with the definition for the eslz custom_landing_zone subscriptions object...it requires lz_key and key...but what are they?
4 replies
nusrath432
@nusrath432
Hi, I am trying to create a front-door with 2nd Frontend Domain (custom) which depends on CNAME record of the format "record=<frontdoor-name>.azurefd.net". When using a random slug for resource names this becomes tricky - a chicken & egg problem. Could anyone help me understand the order/workflow for creating the "Frontdoor with custom domain, please"
Paul Matthews
@pmatthews05
Hopefully a quick answer for someone. The readme file for deploying LandingZones have export ARM_USE_AZUREAD=true just before calling Rover. What is this Export actual for?
3 replies
Henry Dobson
@henrydobson
@arnaudlh @LaurentLesle Can you confirm how the central_logs is intended to be used when using enterprise scale landing zones with multiple subscriptions. I have deployed management resources using caf-terraform-landingzones rather than the than enterprise-scale modules in the same way as https://github.com/Azure/caf-terraform-landingzones-starter/tree/AL-contoso/configuration/contoso/platform/demo/level1 however when this approach is used with multiple subscriptions the diagnostics settings blocks used for the landing zone fail with the correct resource names but incorrect subscription. I presume that with enterprise scale, the diagnostics settings should not be defined in the tfvars and instead should be managed with the enterprise scale deployifdoesnotexist policies. Is that correct or is there a way to target the correct subscription?
9 replies
Elgeario
@Elgeario
@arnaudlh @LaurentLesle Currently we are deploying the CAF code into our Azure environment. When we originally applied the Launchpad we deployed a log analytics workspace and a number of in built solutions as part of diagnostics_log_analytics. We are also using the enterprise scale code which again looks to deploy a log analytics workspace, with some new and overlapping solutions. We want to configure our environment to manage the Log analystics workspace from either the Launchpad or Enterprise scale code, but which is best so that we follow the diirection of travel for configuring log analytics?
Thanks
Tom Howarth
@TomHowarth
Is there an issue with the Latest Rover? I cannot get it to start and load the modules
Paul Matthews
@pmatthews05
Is there a way to selectively not add the prefix to an AD Group I want to create?
11 replies
richardf5
@richardf5
image.png