Azure / Azure/Azure-Landing-Zones
Enable override on custom landing zone to Brownfield migration
- Dominant language
- PowerShell
- Stars
- 96
- Forks
- 70
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 7
Description
### Community Note
- Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment
### Description
In order to support brownfield solution migration, there is a need to support archetype_config_oveerides for custom landing zone.
This will allow customer to create a Staging custom landing zone and deploy the same policy assignment as root/landing zone where it is enforced, but use the override with 'DoNotEnforce' in the Staging management group.
This approach would simplify and reduce potential errors by avoiding creating / maintaining similar policy assignment
#### Is your feature request related to a problem?
The variable "archetype_config_overrides" does not work for management groups specified by the 'custom_landing_zones' input variable as documented [here](https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/blob/76a1c6dd1df2947d10ded7516cdbe1e6d0ed5294/variables.tf#L427).
#### Describe the solution you'd like
Enable "archetype_config_overrides" for 'custom_landing_zones'
A potential simple workaround would be to add a Staging management group at the same level as the Landing Zone in the core Mangement Group IDs.
#### Additional context
Contributor guide
Research direction
Start with variables.tf and the custom_landing_zones input referenced in the issue, then trace how archetype_config_overrides is applied to standard landing zones. Compare that path with custom landing zone management groups. Done means custom landing zones can use archetype_config_overrides, including a DoNotEnforce override for a staging management group, without duplicating policy assignments.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, terraform
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100