Azure / Azure/Azure-Landing-Zones

Enable override on custom landing zone to Brownfield migration

Open
#522 2 comments 3 reactions 0 assignees View on GitHub
Transfer From: caf-enterprise-scale :arrow_right:
Dominant language
PowerShell
Stars
96
Forks
70
Avg merge
3d 1h
Merged PRs (30d)
7

Description

### Community Note

- Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment

### Description

In order to support brownfield solution migration, there is a need to support archetype_config_oveerides for custom landing zone.

This will allow customer to create a Staging custom landing zone and deploy the same policy assignment as root/landing zone where it is enforced, but use the override with 'DoNotEnforce' in the Staging management group.

This approach would simplify and reduce potential errors by avoiding creating / maintaining similar policy assignment

#### Is your feature request related to a problem?

The variable "archetype_config_overrides" does not work for management groups specified by the 'custom_landing_zones' input variable as documented [here](https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/blob/76a1c6dd1df2947d10ded7516cdbe1e6d0ed5294/variables.tf#L427).

#### Describe the solution you'd like

Enable "archetype_config_overrides" for 'custom_landing_zones'

A potential simple workaround would be to add a Staging management group at the same level as the Landing Zone in the core Mangement Group IDs.

#### Additional context

Contributor guide

Open the contributing guide

Research direction

Start with variables.tf and the custom_landing_zones input referenced in the issue, then trace how archetype_config_overrides is applied to standard landing zones. Compare that path with custom landing zone management groups. Done means custom landing zones can use archetype_config_overrides, including a DoNotEnforce override for a staging management group, without duplicating policy assignments.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, terraform
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.