Azure Bootstrap

Source code & Installation

The source code of this kit module can be found here

Run the following command to install the kit module:

collie kit import azure/bootstrap

This documentation is intended as a reference documentation for cloud foundation or platform engineers using this module.

Terraform State Storage

This module includes configuration to set up a state backend using Azure blob storage. You can activate this by configuring the terraform_state_storage variable.

Like all bootstrap modules published on collie hub, you will need to deploy this module twice to complete the bootstrap process. To migrate the state, it may be necessary to logout once from the Azure CLI az logout and then login again az login to obtain the newly created permissions for the storage container. Please see the bootstrap tutorial for more info.

If you're not using terraform_state_storage, please configure your own backend in platform.hcl

Platform Engineers Group

This module sets up an AAD group for managing platform engineers. This is required in conjunction with enabling access to terraform state storage but can also be used to grant administrative access to Azure resources.

UPN handling for AAD Guest users

Useful if you need to translate emails into UPNs (User Principal Names) as necessary, especially for guest users. You can add this code block to your terragrunt.hcl file instead of using inputs."

locals {
upn_domain = "#EXT#@devmeshithesheep.onmicrosoft.com"
  platform_engineers_emails = [
    "meshi@meshithesheep.io" # #TODO change, enter PLATFORM ENGINEERS here
  ]

# change the upn_domain value above
  platform_engineers_members = [
    for x in local.platform_engineers_emails : {
      email = x
      upn   = "${replace(x, "@", "_")}${local.upn_domain}"
    }
  ]
}

Remove Bootstrap (Unbootstraping)

The following sequence must be followed in order to remove the boostrap

Delete the tfstates-config file. The platform.hcl is using the local backend

rm foundations/<foundationname>/platforms/<platformname>/tfstates-config.yml

Migrate the state from the Storage account back to your local machine

collie foundation deploy --bootstrap -- init -migrate-state

Destroy the bootsrap

collie foundation deploy --bootstrap -- destroy

Requirements

Name	Version
terraform	>= 1.0
azuread	~> 2.46.0
azurerm	~> 3.81.0

Modules

Name	Source	Version
terraform_state	./terraform-state	n/a

Resources

Name	Type
azuread_directory_role.readers	resource
azuread_directory_role_assignment.validation_reader	resource
azuread_group.platform_engineers	resource
azurerm_federated_identity_credential.docs	resource
azurerm_federated_identity_credential.validation	resource
azurerm_role_assignment.cloudfoundation_deploy	resource
azurerm_role_assignment.docs_tfstate	resource
azurerm_role_assignment.tfstates_engineers	resource
azurerm_role_assignment.validation_reader	resource
azurerm_role_assignment.validation_tfstate	resource
azurerm_role_definition.cloudfoundation_deploy	resource
azurerm_role_definition.validation_reader	resource
azurerm_user_assigned_identity.docs	resource
azurerm_user_assigned_identity.validation	resource
azuread_client_config.current	data source
azuread_users.platform_engineers_members	data source
azurerm_management_group.parent	data source
azurerm_subscription.current	data source

Inputs

Name	Description	Type	Default	Required
aad_tenant_id	Id of the AAD Tenant. This is also the simultaneously the id of the root management group.	string	n/a	yes
documentation_uami	read-only UAMI with access to terraform states to generate documentation in CI pipelines	object({ name = string # note: it seems wildcards are not supported yet, see https://github.com/Azure/azure-workload-identity/issues/373 oidc_subject = string })	null	no
parent_management_group_name	Name of the management group you want to use as parent for your foundation.	string	n/a	yes
platform_engineers_group	the name of the cloud foundation platform engineers group	string	"cloudfoundation-platform-engineers"	no
platform_engineers_members	Set up a group of platform engineers. If enabled, this group will receive access to terraform_state_storage	list(object({ email = string, upn = string, }))	n/a	yes
terraform_state_storage	Configure this object to enable setting up a terraform state store in Azure Storage.	object({ location = string, name = string, config_file_path = string, resource_group_name = optional(string) })	n/a	yes
validation_uami	read-only UAMI with access to terraform states and read-only access on the landingzone architecture for validation of the deployment in CI pipelines	object({ name = string # note: it seems wildcards are not supported yet, see https://github.com/Azure/azure-workload-identity/issues/373 oidc_subject = string })	null	no

Outputs

Name	Description
documentation_md	n/a
documentation_uami_client_id	n/a
module_storage_account_resource_id	n/a
parent_management_group	n/a
platform_engineers_azuread_group_displayname	n/a
platform_engineers_azuread_group_id	n/a
platform_engineers_members	n/a
validation_uami_client_id	n/a