|
| 1 | +# Manual Configuration Steps |
| 2 | + |
| 3 | +This guide walks you through manually setting up EPAC when the Hydration Kit doesn't meet your specific requirements. |
| 4 | + |
| 5 | +**When to use Manual Configuration:** |
| 6 | +- Complex multi-tenant scenarios |
| 7 | +- Custom folder structures or naming conventions |
| 8 | +- Advanced customization requirements |
| 9 | +- Specific compliance or organizational constraints |
| 10 | + |
| 11 | +> [!TIP] |
| 12 | +> **Consider the Hydration Kit first** - Even for advanced scenarios, you might start with the Hydration Kit and then customize the generated configuration. This can save time and provide a solid foundation. If they Hydration Kit is lacking on specific functionality that prevents its use in your environment, please **[Open a GitHub Issue](https://github.com/Azure/enterprise-azure-policy-as-code/issues)** to provide feedback and feature requests. |
| 13 | +
|
| 14 | +## Prerequisites |
| 15 | + |
| 16 | +- Review the [Start Implementing](./start-implementing.md) to ensure you are familiar with the core EPAC concepts, have the prerequisite software installed and have the required Azure permissions. |
| 17 | + |
| 18 | +## Manual Configuration Steps |
| 19 | +### Prepare Your Environment |
| 20 | + |
| 21 | +Set the location where you want EPAC files to be created. This could be a simple local directory, or a locally cloned repository. |
| 22 | + |
| 23 | +```Powershell |
| 24 | +$myRepoRoot = "/Path/To/Local/EPAC/Repo" |
| 25 | +Set-Location $myRepoRoot |
| 26 | +``` |
| 27 | + |
| 28 | +### Create the Definitions Root folder |
| 29 | +Create a new EPAC `DefinitionsRootFolder` folder that contains the policy object subfolders and the `global-settings.jsonc` file. The `DefinitionsRootFolder` can have any name, however, we recommend `Definitions` and this is used through the documentation and starter kit. |
| 30 | + |
| 31 | +#### Option A: Using EPAC PowerShell Module (Recommended) |
| 32 | + |
| 33 | +```powershell |
| 34 | +New-HydrationDefinitionsFolder -DefinitionsRootFolder "Definitions" |
| 35 | +``` |
| 36 | +#### Option B: Manual Creation: |
| 37 | + |
| 38 | +Create a `DefinitionsRootFolder` with your preferred name that contains the required subfolders and `global-settings.jsonc` file. For an example, please see [StarterKit/Definitions-Common](https://github.com/Azure/enterprise-azure-policy-as-code/tree/main/StarterKit/Definitions-Common). |
| 39 | + |
| 40 | +### Set Up Management Groups for epac-dev |
| 41 | + |
| 42 | +Create a development Management Group hierarchy separate from your main production hierarchy. This isolated environment allows you to safely test policy changes without affecting production workloads. |
| 43 | + |
| 44 | +The development environment should mirror your production Management Group structure to provide representative testing. This typically involves creating a parallel hierarchy under a dedicated parent Management Group (e.g., "epac-contoso" as a copy of "contoso"). |
| 45 | + |
| 46 | +For additional information on `epac-dev`, review the [EPAC Environments Overview](./start-implementing.md#epac-environments-overview) |
| 47 | + |
| 48 | +### Global Settings File |
| 49 | + |
| 50 | +Populate `global-settings.jsonc` with your [environment settings](./settings-global-setting-file.md#Define-EPAC-Environments-in-`pacEnvironments`) and [desired state strategy](settings-dfc-assignments.md) |
| 51 | + |
| 52 | +A sample `global-settings.jsonc` file is available as part of the [starter kit](https://github.com/Azure/enterprise-azure-policy-as-code/tree/main/StarterKit/Definitions-Common) with basic options defined. |
| 53 | + |
| 54 | +### Populate Policy Definitions |
| 55 | + |
| 56 | +#### Option A: Import Existing Policies |
| 57 | + |
| 58 | +Extract [existing Policy resources](start-extracting-policy-resources.md) from your Azure environment. |
| 59 | + |
| 60 | +#### Option B: Start with Sample Policies |
| 61 | + |
| 62 | +Use the [StarterKit](https://github.com/Azure/enterprise-azure-policy-as-code/tree/main/StarterKit/Definitions-GitHub-Flow) policies as an initial deployment. |
| 63 | + |
| 64 | +#### Option C: Create Custom Policies Objects |
| 65 | + |
| 66 | +Create custom [policy definitions](./policy-definitions.md), [policy set definitions](./policy-set-definitions.md) and/or [policy assignments](./policy-assignments.md) based on your organization's needs. |
| 67 | + |
| 68 | +## Initial Test Deployment |
| 69 | + |
| 70 | +You can test your deployment against the epac-dev Management Group hierarchy that was created as part of the deployment process. |
| 71 | + |
| 72 | +```PowerShell |
| 73 | +Build-DeploymentPlans -PacEnvironmentSelector "epac-dev" |
| 74 | +Deploy-PolicyPlan -PacEnvironmentSelector "epac-dev" |
| 75 | +Deploy-RolesPlan -PacEnvironmentSelector "epac-dev" |
| 76 | +``` |
| 77 | + |
| 78 | +> [!NOTE] |
| 79 | +> Many scripts use parameters for input and output folders. They default to the current directory. We recommend that you do one of the following approaches instead of accepting the default to prevent your files being created in the wrong location: |
| 80 | + - [Preferred] Set the environment variables `PAC_DEFINITIONS_FOLDER`, `PAC_OUTPUT_FOLDER`, and `PAC_INPUT_FOLDER`. |
| 81 | + - [Alternative] Use the script parameters `-DefinitionsRootFolder`, `-OutputFolder`, and `-InputFolder`. |
| 82 | + |
| 83 | +## Starter Kit Pipelines |
| 84 | + |
| 85 | +Create a basic pipeline from the starter kit for CI/CD integration. For detailed pipeline configuration, review the [CI/CD Overview](ci-cd-overview.md). |
| 86 | + |
| 87 | +### Using EPAC PowerShell Module (Recommended) |
| 88 | + |
| 89 | +Run one of the following commands based on your pipeline tool of choice. |
| 90 | +```powershell |
| 91 | +### GitHub Actions |
| 92 | +New-PipelinesFromStarterKit -StarterKitFolder .\StarterKit -PipelinesFolder .\.github/workflows -PipelineType GitHubActions -BranchingFlow GitHub -ScriptType module |
| 93 | +
|
| 94 | +### Azure DevOps |
| 95 | +New-PipelinesFromStarterKit -StarterKitFolder .\StarterKit -PipelinesFolder .\pipelines -PipelineType AzureDevOps -BranchingFlow GitHub -ScriptType module |
| 96 | +``` |
| 97 | + |
| 98 | +## Next Steps |
| 99 | + |
| 100 | +You now have the working basics of an EPAC deployment running through the CLI. To continue to expand and further customize your EPAC deployment, review the following guidance: |
| 101 | + |
| 102 | +- Review additional settings available for configuration in the [global-settings file](./settings-global-setting-file.md) |
| 103 | +- Create additional policy objects such as custom policies, additional policy assignments, and exemptions. |
| 104 | + 1. Integrate [Azure Landing Zones (ALZ)](integrating-with-alz.md) |
| 105 | + 1. Create custom [Policy definitions](policy-definitions.md) |
| 106 | + 1. Create custom [Policy Set definitions](policy-set-definitions.md) |
| 107 | + 1. Create new [Policy Assignments](policy-assignments.md) |
| 108 | + 1. Manage [Policy Exemptions](policy-exemptions.md) |
| 109 | +- [CI/CD Overview](ci-cd-overview.md) provides insight into how to continue with the configuration of your DevOps Platform for ongoing EPAC CI/CD deployment, which is the next major area of focus. |
| 110 | +- [Generate Documentation](./operational-scripts-documenting-policy.md) for Audit Purposes |
0 commit comments