This module deploys resources for the AMBA Azure Landing Zones pattern. Please review the examples, which provide details on various scenarios.
- Deployment of Resource Group.
- Deployment of User Assigned Managed Identity.
- Deployment of Monitoring Reader Role Assignment for the User Assigned Managed Identity.
We use the AzAPI provider to interact with the Azure APIs. The new features allow us to be more efficient and reliable, with orders of magnitude speed improvements and retry logic for transient errors.
The following requirements are needed by this module:
The following resources are used by this module:
- azapi_resource.role_assignments (resource)
- modtm_telemetry.telemetry (resource)
- random_uuid.telemetry (resource)
- azapi_client_config.telemetry (data source)
- modtm_module_source.telemetry (data source)
The following input variables are required:
Description: Azure region where the resource should be deployed.
Type: string
Description: The name (ID) of the management group.
Type: string
The following input variables are optional (have default values):
Description: The description used for the role assignment to identify the resource as deployed by AMBA.
Type: string
Default: "_deployed_by_amba"
Description: This variable controls whether or not telemetry is enabled for the module.
For more information see https://aka.ms/avm/telemetryinfo.
If it is set to false, then no telemetry will be collected.
Type: bool
Default: true
Description: Controls the Resource Lock configuration for this resource. The following properties can be specified:
kind- (Required) The type of lock. Possible values are\"CanNotDelete\"and\"ReadOnly\".name- (Optional) The name of the lock. If not specified, a name will be generated based on thekindvalue. Changing this forces the creation of a new resource.
Type:
object({
kind = string
name = optional(string, null)
})Default: null
Description: The resource group where the resources will be deployed.
Type: string
Default: "rg-amba-monitoring-001"
Description: The retry settings to apply to the CRUD operations. Value is a nested object, the top level keys are the resources and the values are an object with the following attributes:
error_message_regex- (Optional) A list of error message regexes to retry on. Defaults tonull, which will will disable retries. Specify a value to enable.interval_seconds- (Optional) The initial interval in seconds between retries. Defaults tonulland will fall back to the provider default value.max_interval_seconds- (Optional) The maximum interval in seconds between retries. Defaults tonulland will fall back to the provider default value.multiplier- (Optional) The multiplier to apply to the interval between retries. Defaults tonulland will fall back to the provider default value.randomization_factor- (Optional) The randomization factor to apply to the interval between retries. Defaults tonulland will fall back to the provider default value.
For more information please see the provider documentation here: https://registry.terraform.io/providers/Azure/azapi/azurerm/latest/docs/resources/resource#nestedatt--retry
Type:
object({
role_assignments = optional(object({
error_message_regex = optional(list(string), [
"AuthorizationFailed", # Avoids a eventual consistency issue where a recently created management group is not yet available for a GET operation.
"ResourceNotFound", # If the resource has just been created, retry until it is available.
])
interval_seconds = optional(number, null)
max_interval_seconds = optional(number, null)
multiplier = optional(number, null)
randomization_factor = optional(number, null)
}), {})
})Default: {}
Description: A map of role assignments to create on the resource group. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.
role_definition_id_or_name- The ID or name of the role definition to assign to the principal.principal_id- The ID of the principal to assign the role to.description- The description of the role assignment.skip_service_principal_aad_check- If set to true, skips the Azure Active Directory check for the service principal in the tenant. Defaults to false.condition- The condition which will be used to scope the role assignment.condition_version- The version of the condition syntax. Valid values are '2.0'.
Note: only set
skip_service_principal_aad_checkto true if you are assigning a role to a service principal.
Type:
map(object({
role_definition_id_or_name = string
principal_id = string
description = optional(string, null)
skip_service_principal_aad_check = optional(bool, false)
condition = optional(string, null)
condition_version = optional(string, null)
delegated_managed_identity_resource_id = optional(string, null)
principal_type = optional(string, null)
}))Default: {}
Description: The role definition ID to assign to the User Assigned Managed Identity. Defaults to Monitoring Reader.
Type: string
Default: "43d0d8ad-25c7-4714-9337-8ba259a9fe05"
Description: (Optional) Tags of the resource.
Type: map(string)
Default: null
Description: A map of timeouts to apply to the creation and destruction of resources.
If using retry, the maximum elapsed retry time is governed by this value.
The object has attributes for each resource type, with the following optional attributes:
create- (Optional) The timeout for creating the resource. Defaults to5mapart from policy assignments, where this is set to15m.delete- (Optional) The timeout for deleting the resource. Defaults to5m.update- (Optional) The timeout for updating the resource. Defaults to5m.read- (Optional) The timeout for reading the resource. Defaults to5m.
Each time duration is parsed using this function: https://pkg.go.dev/time#ParseDuration.
Type:
object({
role_assignment = optional(object({
create = optional(string, "5m")
delete = optional(string, "5m")
update = optional(string, "5m")
read = optional(string, "5m")
}), {}
)
})Default: {}
Description: The name of the user-assigned managed identity.
Type: string
Default: "id-amba-prod-001"
The following outputs are exported:
Description: The resource group name
Description: The resource id of the resource group
Description: The user assigned managed identity name
Description: The resource id of the user assigned managed identity
The following Modules are called:
Source: Azure/avm-res-resources-resourcegroup/azurerm
Version: 0.2.1
Source: Azure/avm-res-managedidentity-userassignedidentity/azurerm
Version: 0.3.3
The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at https://go.microsoft.com/fwlink/?LinkID=824704. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.