Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

docs: fix policy enforcement override example #808

Merged
merged 2 commits into from
Sep 7, 2023
Merged

docs: fix policy enforcement override example #808

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4335639
Fix docs
jaredfholgate Sep 7, 2023
6969afc
Fix typo and remove confusing comment
jaredfholgate Sep 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 20 additions & 4 deletions docs/wiki/[Examples]-Deploy-policies-without-enforcing-them.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,12 +131,12 @@ module "enterprise_scale" {

### `archetype_config_overrides.tf` for landing zones archetype

Examplary, to change the enforcementMode for the landing zone archetype, we could use the following configuration. Note how the `root_id` specified when calling the module in `main.tf` is used to identify the archetype.
Examplary, to change the enforcementMode for the landing zone archetype, we could use the following configuration.

```hcl
locals {
archetype_config_overrides = {
myorg-landing-zones = {
landing-zones = {
enforcement_mode = {
Audit-AppGW-WAF = false
Deny-IP-forwarding = false
Expand All @@ -159,6 +159,22 @@ locals {
}
```

Note that the key `landing-zones` in this example refers to the name of the default core management group as specified in the archetype file name. The supported management group names are:

- `root`
- `decommissioned`
- `sandboxes`
- `landing-zones`
- `platform`
- `connectivity`
- `management`
- `identity`
- `corp`
- `online`
- `sap`

You can see the default policy assignments for each management group in the corresponding template file in the [archetype_definitions](../../modules/archetypes/lib/archetype_definitions) folder.

You have successfully overridden the `enforcementMode` for the landing zone archetype.

## Brownfield deployment for corp landing zone
Expand All @@ -170,7 +186,7 @@ If you want to move your workloads quickly into the corp landing zone, it might
```hcl
locals {
archetype_config_overrides = {
myorg-corp = {
corp = {
enforcement_mode = {
Audit-PeDnsZones = false
Deny-HybridNetworking = false
Expand All @@ -179,7 +195,7 @@ locals {
Deploy-Private-DNS-Zones = false
}
}
myorg-landing-zones = {
landing-zones = {
enforcement_mode = {
Audit-AppGW-WAF = false
Deny-IP-forwarding = false
Expand Down