PowerShell deployment scripts

config/variables/CanadaESLZ-main.yml

@@ -58,7 +58,7 @@ variables:
     }
 
   # Logging
-  var-logging-region: $(deploymentRegion)
+  var-logging-region: canadacentral
   var-logging-managementGroupId: pubsecPlatformManagement
   var-logging-subscriptionId: bc0a4f9f-07fa-4284-b1bd-fbad38578d3a
   var-logging-configurationFileName: logging.parameters.json
@@ -67,7 +67,7 @@ variables:
   var-logging-diagnosticSettingsforNetworkSecurityGroupsStoragePrefix: pubsecnsg
 
   # Hub Networking
-  var-hubnetwork-region: $(deploymentRegion)
+  var-hubnetwork-region: canadacentral
   var-hubnetwork-managementGroupId: pubsecPlatformConnectivity
   var-hubnetwork-subscriptionId: ed7f4eed-9010-4227-b115-2a5e37728f27
 

scripts/deployments/E2E.ps1

@@ -0,0 +1,174 @@
+#Requires -Modules Az, powershell-yaml
+
+. ".\Functions\EnvironmentContext.ps1"
+. ".\Functions\ManagementGroups.ps1"
+. ".\Functions\Roles.ps1"
+. ".\Functions\Logging.ps1"
+. ".\Functions\Policy.ps1"
+. ".\Functions\HubNetworkWithNVA.ps1"
+. ".\Functions\HubNetworkWithAzureFirewall.ps1"
+. ".\Functions\Subscriptions.ps1"
+
+$EnvironmentName = "CanadaESLZ-main"
+$WorkingDirectory = Resolve-Path "../.."
+
+# Replace the Tenant ID with the GUID for your Azure Active Directory instance.
+# It can be found through https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview
+$AzureADTenantId = "343ddfdb-bef5-46d9-99cf-ed67d5948783"
+
+$Features = @{
+  # Prompt to login to Azure AD and set the context for Azure deployments
+  PromptForLogin = $false
+
+  # Resource Organization
+  DeployManagementGroups = $false
+
+  # Access Control
+  DeployRoles = $false
+
+  # Logging
+  DeployLogging = $false
+
+  # Guardrail & Compliance
+  DeployPolicy = $false
+
+  # Hub Networking - With Network Virtual Appliance
+  DeployHubNetworkWithNVA = $false
+
+  # Hub Networking - With Azure Firewall
+  DeployHubNetworkWithAzureFirewall = $false
+}
+
+Write-Output "Features configured for deployment:"
+$Features
+
+# Az Login
+if ($Features.PromptForLogin) {
+  Connect-AzAccount `
+    -UseDeviceAuthentication `
+    -TenantId $AzureADTenantId
+}
+
+# Set Azure Landing Zones Context
+$Context = New-EnvironmentContext -Environment $EnvironmentName -WorkingDirectory $WorkingDirectory
+
+# Deploy Management Groups
+if ($Features.DeployManagementGroups) {
+  Set-ManagementGroups `
+    -Context $Context `
+    -ManagementGroupHierarchy $Context.ManagementGroupHierarchy
+}
+
+# Deploy Roles
+if ($Features.DeployRoles) {
+  Set-Roles `
+    -Context $Context `
+    -RolesDirectory $Context.RolesDirectory `
+    -ManagementGroupId $Context.TopLevelManagementGroupId
+}
+
+# Deploy Logging
+if ($Features.DeployLogging) {
+  Set-Logging `
+    -Region $Context.Variables['var-logging-region'] `
+    -ManagementGroupId $Context.Variables['var-logging-managementGroupId'] `
+    -SubscriptionId $Context.Variables['var-logging-subscriptionId'] `
+    -ConfigurationFilePath "$($Context.LoggingDirectory)/$($Context.Variables['var-logging-configurationFileName'])"
+}
+
+# Deploy Policy
+if ($Features.DeployPolicy) {
+  # Get Logging information using logging config file
+  $LoggingConfiguration = Get-LoggingConfiguration `
+    -ConfigurationFilePath "$($Context.LoggingDirectory)/$($Context.Variables['var-logging-configurationFileName'])" `
+    -SubscriptionId $Context.Variables['var-logging-subscriptionId']
+
+  # Custom Policy Definitions
+  Set-Policy-Definitions `
+    -PolicyDefinitionsDirectory $Context.PolicyCustomDefinitionDirectory `
+    -ManagementGroupId $Context.TopLevelManagementGroupId
+
+  # Custom Policy Set Definitions
+  Set-PolicySet-Defintions `
+    -Context $Context `
+    -PolicySetDefinitionsDirectory $Context.PolicySetCustomDefinitionDirectory `
+    -ManagementGroupId $Context.TopLevelManagementGroupId `
+    -PolicySetDefinitionNames $('AKS', 'DefenderForCloud', 'LogAnalytics', 'Network', 'DNSPrivateEndpoints', 'Tags')
+
+  # Built In Policy Set Assignments
+  Set-PolicySet-Assignments `
+    -Context $Context `
+    -PolicySetAssignmentsDirectory $Context.PolicySetBuiltInAssignmentsDirectory `
+    -PolicySetAssignmentManagementGroupId $Context.TopLevelManagementGroupId `
+    -PolicySetAssignmentNames $('asb', 'nist80053r4', 'nist80053r5', 'pbmm', 'cis-msft-130', 'fedramp-moderate', 'hitrust-hipaa', 'location') `
+    -LogAnalyticsWorkspaceResourceGroupName $LoggingConfiguration.ResourceGroupName `
+    -LogAnalyticsWorkspaceResourceId $LoggingConfiguration.LogAnalyticsWorkspaceResourceId `
+    -LogAnalyticsWorkspaceId $LoggingConfiguration.LogAnalyticsWorkspaceId `
+    -LogAnalyticsWorkspaceRetentionInDays $LoggingConfiguration.LogRetentionInDays
+
+  # Custom Policy Sets Assignments
+  Set-PolicySet-Assignments `
+    -Context $Context `
+    -PolicySetAssignmentsDirectory $Context.PolicySetCustomAssignmentsDirectory `
+    -PolicySetAssignmentManagementGroupId $Context.TopLevelManagementGroupId `
+    -PolicySetAssignmentNames $('AKS', 'DefenderForCloud', 'LogAnalytics', 'Network', 'Tags') `
+    -LogAnalyticsWorkspaceResourceGroupName $LoggingConfiguration.ResourceGroupName `
+    -LogAnalyticsWorkspaceResourceId $LoggingConfiguration.LogAnalyticsWorkspaceResourceId `
+    -LogAnalyticsWorkspaceId $LoggingConfiguration.LogAnalyticsWorkspaceId `
+    -LogAnalyticsWorkspaceRetentionInDays $LoggingConfiguration.LogRetentionInDays
+}
+
+# Deploy Hub Networking with NVA
+if ($Features.DeployHubNetworkWithNVA) {
+  # Get Logging information using logging config file
+  $LoggingConfiguration = Get-LoggingConfiguration `
+    -ConfigurationFilePath "$($Context.LoggingDirectory)/$($Context.Variables['var-logging-configurationFileName'])" `
+    -SubscriptionId $Context.Variables['var-logging-subscriptionId']
+
+    Set-HubNetwork-With-NVA `
+      -Context $Context `
+      -Region $Context.Variables['var-hubnetwork-region'] `
+      -ManagementGroupId $Context.Variables['var-hubnetwork-managementGroupId'] `
+      -SubscriptionId $Context.Variables['var-hubnetwork-subscriptionId'] `
+      -ConfigurationFilePath "$($Context.NetworkingDirectory)/$($Context.Variables['var-hubnetwork-nva-configurationFileName'])" `
+      -LogAnalyticsWorkspaceResourceId $LoggingConfiguration.LogAnalyticsWorkspaceResourceId
+}
+
+# Hub Networking with Azure Firewall
+if ($Features.DeployHubNetworkWithAzureFirewall) {
+  # Get Logging information using logging config file
+  $LoggingConfiguration = Get-LoggingConfiguration `
+    -ConfigurationFilePath "$($Context.LoggingDirectory)/$($Context.Variables['var-logging-configurationFileName'])" `
+    -SubscriptionId $Context.Variables['var-logging-subscriptionId']
+
+  # Create Azure Firewall Policy
+  Set-AzureFirewallPolicy `
+    -Region $Context.Variables['var-hubnetwork-region'] `
+    -SubscriptionId $Context.Variables['var-hubnetwork-subscriptionId'] `
+    -ConfigurationFilePath "$($Context.NetworkingDirectory)/$($Context.Variables['var-hubnetwork-azfwPolicy-configurationFileName'])"
+
+  # Retrieve Azure Firewall Policy
+  $AzureFirewallPolicyConfiguration = Get-AzureFirewallPolicy `
+    -SubscriptionId $Context.Variables['var-hubnetwork-subscriptionId'] `
+    -ConfigurationFilePath "$($Context.NetworkingDirectory)/$($Context.Variables['var-hubnetwork-azfwPolicy-configurationFileName'])"
+
+  # Create Hub Networking with Azure Firewall
+  Set-HubNetwork-With-AzureFirewall `
+    -Context $Context `
+    -Region $Context.Variables['var-hubnetwork-region'] `
+    -ManagementGroupId $Context.Variables['var-hubnetwork-managementGroupId'] `
+    -SubscriptionId $Context.Variables['var-hubnetwork-subscriptionId'] `
+    -ConfigurationFilePath "$($Context.NetworkingDirectory)/$($Context.Variables['var-hubnetwork-azfw-configurationFileName'])" `
+    -AzureFirewallPolicyResourceId $AzureFirewallPolicyConfiguration.AzureFirewallPolicyResourceId `
+    -LogAnalyticsWorkspaceResourceId $LoggingConfiguration.LogAnalyticsWorkspaceResourceId
+}
+
+<#
+
+# Subscriptions
+Set-Subscriptions `
+  -Region "canadacentral" `
+  -SubscriptionIds $("4f9", "ec6") `
+  -LogAnalyticsWorkspaceResourceId $LoggingConfiguration.LogAnalyticsWorkspaceResourceId
+
+#>

scripts/deployments/Functions/EnvironmentContext.ps1

@@ -0,0 +1,48 @@
+#Requires -Modules powershell-yaml
+
+Import-Module powershell-yaml
+
+function New-EnvironmentContext {
+  param (
+    [Parameter(Mandatory = $true)]
+    [string] $WorkingDirectory,
+
+    [Parameter(Mandatory = $true)]
+    [string] $Environment
+  )
+
+  $EnvironmentConfigurationYamlFilePath = "$WorkingDirectory/config/variables/$Environment.yml"
+
+  # Load main environment variables file as YAML
+  $EnvironmentConfiguration = Get-Content $EnvironmentConfigurationYamlFilePath  | ConvertFrom-Yaml
+  $Variables = $EnvironmentConfiguration.variables
+
+  # Retrieve the management group hierarchy variable as JSON
+  $ManagementGroupHierarchy = $Variables['var-managementgroup-hierarchy'] | ConvertFrom-Json
+
+  $PolicyDirectory = "$WorkingDirectory/policy"
+
+  # Create a new context object
+  return [PSCustomObject]@{
+    WorkingDirectory = $WorkingDirectory
+
+    RolesDirectory = "$WorkingDirectory/roles"
+
+    PolicyCustomDefinitionDirectory = "$PolicyDirectory/custom/definitions/policy"
+    PolicySetCustomDefinitionDirectory = "$PolicyDirectory/custom/definitions/policyset"
+    PolicySetCustomAssignmentsDirectory = "$PolicyDirectory/custom/assignments"
+    PolicySetBuiltInAssignmentsDirectory = "$PolicyDirectory/builtin/assignments"
+
+    LoggingDirectory = "$WorkingDirectory/config/logging/$Environment"
+    NetworkingDirectory = "$WorkingDirectory/config/networking/$Environment"
+
+    Variables = $Variables
+    ManagementGroupHierarchy = $ManagementGroupHierarchy
+
+    # Identify the top level management group (the first child underneath Tenant Root Group)
+    TopLevelManagementGroupId = $ManagementGroupHierarchy.children[0].id
+
+    # TODO:  Retrieve from common.yml
+    DeploymentRegion = "canadacentral"
+  }
+}