Core files settings reference

In this section, we will review the fundamental parameters to deploy customized stack and review the various parameters.

ignite.yaml

The ignite.yaml contains all core parameters that will be reused across all levels, entries in this file will be used to generate configuration files and the readme files to execute all the commands in the various levels. The root of this file is called caf_terraform: and contains the following sections:

top level variables

parameter	required	possible values	description
customer_name	yes	only lowercase with no spaces	Is used to create the folder name to store the definition and configuration files.
caf_environment	yes	any string	Name of the environment to use or to create. A caf_environment is used to discriminate multiple environments that could live on the same subscriptions.
default_email_address	yes	email format	Individual or distribution list to send subscription health alerts.
alz_mg_prefix	yes	between 2 and 10 characters	Azure landing zones management group prefix.
alz_mg_name	yes	any string	Azure Management group name.
azure_regions	yes	map (key=region key, value= region)	List of the Azure regions where services are authorized to be deployed. The region must be the small, lower-case with no space format (i.e: southeastasia)
prefix	yes	string	Use a prefix to put in front of all names generated.
deployment_mode	yes	'platform' or 'asvm'	Inform the rover ignite if the deployments are for the platform or for an application landing zone.
caf_landingzone_branch	yes	tag or branch name	Release number from the repo https://github.com/Azure/caf-terraform-landingzones/releases
caf_regions	yes	yaml list of objects	List of the Azure regions generated by the rover ignite from the azure_regions variable.
resources_allowed_regions	yes	yaml list of string	List of the region's key used by Azure policies to defined the Azure regions where services can be deployed.
resource_groups_allowed_regions	yes	yaml list of string	List of the region's key used by Azure policies to defined the Azure regions where the resource groups can be deployed.
default_region_key	yes	caf_regions key	Value of the region's key that will be used when a resource does not explicitly mention the region to use.
azuread_user_ea_account_owner	yes	user principal name	User Principal Name of the Azure AD principal deploying the platform landing zones.
ea_owner_object_id	yes	guid	GUID of the Azure AD principal deploying the platform landing zones.
azuread_identity_mode	yes	'service_principal'	Type of principal used to secure the levels in the Azure Terraform SRE landing zones.
enable_azuread_groups	yes	boolean	Enable the creation of the Azure AD groups required to set the operation model.
enable_azuread_applications	yes	boolean	Grant the identity principal the Azure AD API privilege to manage Azure AD applications.
enable_azure_subscription_vending_machine	yes	boolean	Enable the Azure Subscription Vending Machine to deploy Azure landing zone solutions accelerators.
subscription_deployment_mode	yes	'single_reuse'	'single_resuse' deploys all platform and application landing zones into the same existing Azure subscription.

caf_regions blocks will contain a structure of keys with name and short names (slug) as in the following example:

caf_regions:
  region1:
      # set the short form of the Azure region
    name: southeastasia  # Use the lower-case region's name, short version with no space
  region2:
    name: eastasia  # Use the lower-case region's name, short version with no space

parameter	required	possible values	description
key	yes	any string	region1 and region2 are the keys, they can be any string.
name	yes	any Azure region name	name of the region as in the Azure available regions list.

naming_convention

The section is used to describe how names are being created in the platform, in development phases, we often use part of the name to be automatically generated so we can integrate and test faster, once you are reaching production, you will use name as passthrough in order to apply your own naming convention.

parameter	required	possible values	description
passthrough	yes	true, false	When set to true, use the name as specified in the files after filtering. If set to false, will add generate names aligned to CAF guidance will prefixes if defined.
prefix	yes	string	Use a prefix to put in front of all names generated.
random_length	yes	integer	The number or randomly generated characters at the end of the resource name, if passthrough is set to false.
inherit_tags	yes	true, false	Define if resources will inherit the tags defined at the resource group level.

caf_launchpad

parameter	required	possible values	description
subscription_id	yes	string	GUID of the subscription to use to deploy launchpad.
subscription_name	yes	string	Name of the subscription to use to deploy launchpad.
tenant_id	yes	string	Home tenant of the subscription to use to deploy launchpad.
global_tags_propagated	yes	true, false	If set to true, the tags defined in launchpad will be propagated to all resources in this environment.
tags	yes	block of tags	A block of tags that will be added to the launchpad.

billing_subscription_role_delegations

This section defines settings for the subscription billing role delegation from and EA or MCA account.

If you are not planning to generate subscriptions automatically, you can define it to false, you will still need to input the azuread_user settings.

parameter	required	possible values	description
enable	yes	true, false	Enable the subscription billing account delegation functions.
azuread_user_ea_account_owner	yes	string	UPN of the user doing the manual deployment of the platform. Must be populated even if you are not using automatic subscription generation.
azuread_user_ea_account_owner_object_id	yes	string	GUID of the user doing the manual deployment of the platform. Must be populated even if you are not using automatic subscription generation. If that user is already loged-in to an azure cli session you can get the object_id by running: az ad signed-in-user show --query objectId -o tsv
billing_account_name	no	number	Billing account name (typically 8 digits)
enrollment_account_name	no	number	Enrollment account name (typically 6 digits)

configuration_folders

This section defines how and where the output files (Terraform configuration files) are going to be stored.

parameter	required	possible values	description
platform	yes	block	content of the block described below.

The platform block takes the following settings:

parameter	required	possible values	description
cleanup_destination	yes	true, false	true: forces the destination folder to be deleted and re-created before the files are created. false: create the target folder structure if it does not exist. On sub-sequent executions, the folder structure is reused as is.

management_groups

The settings in this section defines the core behavior of the environment including reference to the enterprise-scale architecture. It is following the structure:

management_groups:
  region1:    // key of the default region used by enterprise-scale.
    es:       // alz_mg_prefix.
      {{enterprise_scale}}    // block as defined bellow.

parameter	required	possible values	description
enterprise_scale	yes	block	content of the block described below.

The enterprise_scale block takes the following parameters:

parameter	required	possible values	description
management_group_name	yes	strings	The base path to generate the files.
management_group_prefix	yes	strings	The second part of the path where to generate the configuration files.
deploy_core_landing_zones	yes	True, False	true: forces the destination folder to be deleted and re-created before the files are created. false: create the target folder structure if it does not exist. On sub-sequent executions, the folder structure is reused as is.
clean_up_destination_folder	yes	True, False	The second part of the path where to generate the configuration files.
root_parent_id	no	strings	The name of the root parent id where you want to deploy the enterprise scale management groups hierarchy.
update_lib_folder	yes	True, False	Update your definition lib folder
version_to_deploy	yes	'v1.1.3', 'v1.1.1'	Set the enterprise-scale module version to deploy.

subscriptions

This settings defines the Azure subscriptions that will be created or re-used to deploy the platform landing zones.

It is following the structure:

subscriptions:
  launchpad:    # key of launchpad.   Do not rename the key
    {{subscription}}
  identity:    # key of launchpad.   Do not rename the key
    {{subscription}}
  connectivity:    # key of launchpad.   Do not rename the key
    {{subscription}}
  management:    # key of launchpad.   Do not rename the key
    {{subscription}}

parameter	required	possible values	description
subscription	yes	block	content of the block described below.

The subscription block takes the following parameters:

parameter	required	possible values	description
name	yes	true, false	Name of the subscription.
create_alias	no	true, false	When re-using an existing subscription by setting a value to subscription_id, create an alias if the principal has API subscription creation permissions.
subscription_id	no	guid	When set, reuse that subscription instead of creating a new one.

networking_topology

parameter	required	possible values	description
deployment_option	yes	virtual_wan	Currently supported mode is only virtual_wan, this might change in the future depending on customer requests.

platform_identity

parameter	required	possible values	description
tenant_name	yes	string	Name of the primary domain name of the Azure Active Directory tenant (*.onmicrosoft.com or custom domain name)
azuread_identity_mode	yes	logged_in_user, service_principal	Currently supported mode for production is service_principal, for lab and learning purposes, we support logged_in_user to run command from rover in interactive environment.
caf_platform_maintainers	yes	list of principal names	Ignored in logged in user mode, contains the list of UPN or groups to be added in the security group caf_platform_maintainers
caf_platform_contributors	yes	list of principal names	Only used in service_principal mode, contains the list of UPN or groups to be added in the security group caf_platform_contributors