Skip to content

Commit 3b49f1b

Browse files
steritStephen Ritchie
andauthored
Update Getting Started Documentation (#1026)
* Update Getting Started Documentation * Fix sync --------- Co-authored-by: Stephen Ritchie <[email protected]>
1 parent 95abde5 commit 3b49f1b

File tree

14 files changed

+520
-348
lines changed

14 files changed

+520
-348
lines changed
6.8 KB
Loading
21.8 KB
Loading
11.6 KB
Loading

Docs/advanced-configuration.md

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Advanced Configuration Scenarios
2+
3+
The following sections cover various Advanced Configuration scenarios.
4+
5+
## Cloud Environment with Unsupported/Missing Policy Definitions
6+
7+
In some multi-tenant implementations, not all policies, policy sets, and/or assignments will function in all tenants, usually due to either built-in policies that don't exist in some tenant types or unavailable resource providers. In order to facilitate multi-tenant deployments in these scenarios, utilize the `epacCloudEnvironments` property to specify which cloud type a specific file should be considered in.
8+
9+
The allowed values are: "AzureCloud", "AzureChinaCloud" or "AzureUSGovernment".
10+
11+
### Example 1: Policy / PolicySet
12+
13+
To have a Policy or PolicySet definition deployed only to epacEnvironments that are China cloud tenants, add an "epacCloudEnvironments" property to the metadata section of the file like this:
14+
15+
```json
16+
{
17+
"displayName": "",
18+
"description": "",
19+
"metadata": {
20+
"epacCloudEnvironments": [
21+
"AzureChinaCloud"
22+
]
23+
}
24+
}
25+
```
26+
27+
### Example 2: Policy Assignment
28+
29+
To have a Policy Assignment deployed only to epacEnvironments that are China cloud tenants, add an "epacCloudEnvironments" property within the top section of the assignment file like this:
30+
31+
```json
32+
{
33+
"nodename": "/root",
34+
"epacCloudEnvironments": [
35+
"AzureChinaCloud"
36+
],
37+
"definitionEntry": {
38+
"policySetId": ""
39+
},
40+
"children": [
41+
]
42+
}
43+
```

Docs/manual-configuration.md

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# Manual Configuration Steps
2+
3+
This guide walks you through manually setting up EPAC when the Hydration Kit doesn't meet your specific requirements.
4+
5+
**When to use Manual Configuration:**
6+
- Complex multi-tenant scenarios
7+
- Custom folder structures or naming conventions
8+
- Advanced customization requirements
9+
- Specific compliance or organizational constraints
10+
11+
> [!TIP]
12+
> **Consider the Hydration Kit first** - Even for advanced scenarios, you might start with the Hydration Kit and then customize the generated configuration. This can save time and provide a solid foundation. If they Hydration Kit is lacking on specific functionality that prevents its use in your environment, please **[Open a GitHub Issue](https://github.com/Azure/enterprise-azure-policy-as-code/issues)** to provide feedback and feature requests.
13+
14+
## Prerequisites
15+
16+
- Review the [Start Implementing](./start-implementing.md) to ensure you are familiar with the core EPAC concepts, have the prerequisite software installed and have the required Azure permissions.
17+
18+
## Manual Configuration Steps
19+
### Prepare Your Environment
20+
21+
Set the location where you want EPAC files to be created. This could be a simple local directory, or a locally cloned repository.
22+
23+
```Powershell
24+
$myRepoRoot = "/Path/To/Local/EPAC/Repo"
25+
Set-Location $myRepoRoot
26+
```
27+
28+
### Create the Definitions Root folder
29+
Create a new EPAC `DefinitionsRootFolder` folder that contains the policy object subfolders and the `global-settings.jsonc` file. The `DefinitionsRootFolder` can have any name, however, we recommend `Definitions` and this is used through the documentation and starter kit.
30+
31+
#### Option A: Using EPAC PowerShell Module (Recommended)
32+
33+
```powershell
34+
New-HydrationDefinitionsFolder -DefinitionsRootFolder "Definitions"
35+
```
36+
#### Option B: Manual Creation:
37+
38+
Create a `DefinitionsRootFolder` with your preferred name that contains the required subfolders and `global-settings.jsonc` file. For an example, please see [StarterKit/Definitions-Common](https://github.com/Azure/enterprise-azure-policy-as-code/tree/main/StarterKit/Definitions-Common).
39+
40+
### Set Up Management Groups for epac-dev
41+
42+
Create a development Management Group hierarchy separate from your main production hierarchy. This isolated environment allows you to safely test policy changes without affecting production workloads.
43+
44+
The development environment should mirror your production Management Group structure to provide representative testing. This typically involves creating a parallel hierarchy under a dedicated parent Management Group (e.g., "epac-contoso" as a copy of "contoso").
45+
46+
For additional information on `epac-dev`, review the [EPAC Environments Overview](./start-implementing.md#epac-environments-overview)
47+
48+
### Global Settings File
49+
50+
Populate `global-settings.jsonc` with your [environment settings](./settings-global-setting-file.md#Define-EPAC-Environments-in-`pacEnvironments`) and [desired state strategy](settings-dfc-assignments.md)
51+
52+
A sample `global-settings.jsonc` file is available as part of the [starter kit](https://github.com/Azure/enterprise-azure-policy-as-code/tree/main/StarterKit/Definitions-Common) with basic options defined.
53+
54+
### Populate Policy Definitions
55+
56+
#### Option A: Import Existing Policies
57+
58+
Extract [existing Policy resources](start-extracting-policy-resources.md) from your Azure environment.
59+
60+
#### Option B: Start with Sample Policies
61+
62+
Use the [StarterKit](https://github.com/Azure/enterprise-azure-policy-as-code/tree/main/StarterKit/Definitions-GitHub-Flow) policies as an initial deployment.
63+
64+
#### Option C: Create Custom Policies Objects
65+
66+
Create custom [policy definitions](./policy-definitions.md), [policy set definitions](./policy-set-definitions.md) and/or [policy assignments](./policy-assignments.md) based on your organization's needs.
67+
68+
## Initial Test Deployment
69+
70+
You can test your deployment against the epac-dev Management Group hierarchy that was created as part of the deployment process.
71+
72+
```PowerShell
73+
Build-DeploymentPlans -PacEnvironmentSelector "epac-dev"
74+
Deploy-PolicyPlan -PacEnvironmentSelector "epac-dev"
75+
Deploy-RolesPlan -PacEnvironmentSelector "epac-dev"
76+
```
77+
78+
> [!NOTE]
79+
> Many scripts use parameters for input and output folders. They default to the current directory. We recommend that you do one of the following approaches instead of accepting the default to prevent your files being created in the wrong location:
80+
- [Preferred] Set the environment variables `PAC_DEFINITIONS_FOLDER`, `PAC_OUTPUT_FOLDER`, and `PAC_INPUT_FOLDER`.
81+
- [Alternative] Use the script parameters `-DefinitionsRootFolder`, `-OutputFolder`, and `-InputFolder`.
82+
83+
## Starter Kit Pipelines
84+
85+
Create a basic pipeline from the starter kit for CI/CD integration. For detailed pipeline configuration, review the [CI/CD Overview](ci-cd-overview.md).
86+
87+
### Using EPAC PowerShell Module (Recommended)
88+
89+
Run one of the following commands based on your pipeline tool of choice.
90+
```powershell
91+
### GitHub Actions
92+
New-PipelinesFromStarterKit -StarterKitFolder .\StarterKit -PipelinesFolder .\.github/workflows -PipelineType GitHubActions -BranchingFlow GitHub -ScriptType module
93+
94+
### Azure DevOps
95+
New-PipelinesFromStarterKit -StarterKitFolder .\StarterKit -PipelinesFolder .\pipelines -PipelineType AzureDevOps -BranchingFlow GitHub -ScriptType module
96+
```
97+
98+
## Next Steps
99+
100+
You now have the working basics of an EPAC deployment running through the CLI. To continue to expand and further customize your EPAC deployment, review the following guidance:
101+
102+
- Review additional settings available for configuration in the [global-settings file](./settings-global-setting-file.md)
103+
- Create additional policy objects such as custom policies, additional policy assignments, and exemptions.
104+
1. Integrate [Azure Landing Zones (ALZ)](integrating-with-alz.md)
105+
1. Create custom [Policy definitions](policy-definitions.md)
106+
1. Create custom [Policy Set definitions](policy-set-definitions.md)
107+
1. Create new [Policy Assignments](policy-assignments.md)
108+
1. Manage [Policy Exemptions](policy-exemptions.md)
109+
- [CI/CD Overview](ci-cd-overview.md) provides insight into how to continue with the configuration of your DevOps Platform for ongoing EPAC CI/CD deployment, which is the next major area of focus.
110+
- [Generate Documentation](./operational-scripts-documenting-policy.md) for Audit Purposes

0 commit comments

Comments
 (0)