Added Virtual Network Manager

docs/EnterpriseScaleAnalytics-AzureDevOpsDeployment.md

@@ -81,6 +81,8 @@ To begin, please open the [infra/params.dev.json](/infra/params.dev.json). In th
 | `firewallPrivateIp` | Specifies the private IP address of the central firewall. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `10.0.0.4` |
 | `dnsServerAdresses` | Specifies the private IP addresses of the dns servers. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | [ `10.0.0.4` ] |
 | `firewallPolicyId` | Specifies the resource ID of the Azure Firewall Policy. Optional parameter allows you to deploy Firewall rules to an existing Firewall Policy if `enableDnsAndFirewallDeployment` is set to `false`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/firewallPolicies/{firewallpolicy-name}` |
+| `virtualNetworkManagerManagementGroupScopes` | Specifies the management group scopes for the Azure Virtual Network Manager. | [`{management-group-id-1}`, `{management-group-id-2}`] |
+| `virtualNetworkManagerSubscriptionScopes` | Specifies the subscription scopes for the Azure Virtual Network Manager. | [`/subscriptions/{subscription-id-1}`, `/subscriptions/{subscription-id-2}`] |
 | `privateDnsZoneIdContainerRegistry` | Specifies the resource ID of the private DNS zone for Container Registry. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/privateDnsZones/privatelink.azurecr.io` |
 | `privateDnsZoneIdKeyVault` | Specifies the resource ID of the private DNS zone for Key Vault. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/privateDnsZones/privatelink.vaultcore.azure.net` |
 | `privateDnsZoneIdNamespace` | Specifies the resource ID of the private DNS zone for EventHub namespaces. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/privateDnsZones/privatelink.servicebus.windows.net` |

docs/EnterpriseScaleAnalytics-GitHubActionsDeployment.md

@@ -72,6 +72,8 @@ To begin, please open the [infra/params.dev.json](/infra/params.dev.json). In th
 | `firewallPrivateIp` | Specifies the private IP address of the central firewall. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `10.0.0.4` |
 | `dnsServerAdresses` | Specifies the private IP addresses of the dns servers. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | [ `10.0.0.4` ] |
 | `firewallPolicyId` | Specifies the resource ID of the Azure Firewall Policy. Optional parameter allows you to deploy Firewall rules to an existing Firewall Policy if `enableDnsAndFirewallDeployment` is set to `false`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/firewallPolicies/{firewallpolicy-name}` |
+| `virtualNetworkManagerManagementGroupScopes` | Specifies the management group scopes for the Azure Virtual Network Manager. | [`{management-group-id-1}`, `{management-group-id-2}`] |
+| `virtualNetworkManagerSubscriptionScopes` | Specifies the subscription scopes for the Azure Virtual Network Manager. | [`/subscriptions/{subscription-id-1}`, `/subscriptions/{subscription-id-2}`] |
 | `privateDnsZoneIdContainerRegistry` | Specifies the resource ID of the private DNS zone for Container Registry. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/privateDnsZones/privatelink.azurecr.io` |
 | `privateDnsZoneIdKeyVault` | Specifies the resource ID of the private DNS zone for Key Vault. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/privateDnsZones/privatelink.vaultcore.azure.net` |
 | `privateDnsZoneIdNamespace` | Specifies the resource ID of the private DNS zone for EventHub namespaces. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/privateDnsZones/privatelink.servicebus.windows.net` |

docs/reference/enterpriseScaleAnalytics.bicep

@@ -12,7 +12,7 @@ targetScope = 'subscription'
 @description('Specifies the environment.')
 param environment string = 'dev'
 @description('Specifies the tags that you want to apply to all resources.')
-param tags object
+param tags object = {}
 
 // Data Management Parameters
 @description('Specifies the subscription ID where your Data Management Zone will be deployed.')
@@ -21,6 +21,8 @@ param dataManagementZoneSubscriptionId string
 param dataManagementZonePrefix string
 @description('Specifies the location of your Data Management Zone.')
 param dataManagementZoneLocation string
+@description('Specifies the management group scopes for the Azure Virtual Network Manager.')
+param virtualNetworkManagerManagementGroupScopes array = []
 
 // Data Landing Zone Parameters
 @description('Specifies the administrator username of the Synapse workspace and the virtual machine scale sets.')
@@ -32,7 +34,7 @@ param dataLandingZoneDetails array
 @description('Specifies the prefix of Data Landing Zones.')
 param dataLandingZonePrefix string
 @description('Specifies whether Azure Bastion will be deployed in the first Data Landing Zone.')
-param enableBastionHostDeployment bool
+param enableBastionHostDeployment bool = false
 @allowed([
   'Windows11'
   'WindowsServer2022'
@@ -94,6 +96,12 @@ resource dataManagementZoneDeployment 'Microsoft.Resources/deployments@2021-04-0
       firewallPolicyId: {
         value: ''
       }
+      virtualNetworkManagerManagementGroupScopes: {
+        value: virtualNetworkManagerManagementGroupScopes
+      }
+      virtualNetworkManagerSubscriptionScopes: {
+        value: [for dataLandingZoneDetail in dataLandingZoneDetails:  '/subscriptions/${dataLandingZoneDetail.subscription}']
+      }
       privateDnsZoneIdBlob: {
         value: ''
       }

docs/reference/enterpriseScaleAnalytics.json

@@ -5,7 +5,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.4.1008.15138",
-      "templateHash": "7920090618025606816"
+      "templateHash": "7094337474074200395"
     }
   },
   "parameters": {
@@ -23,6 +23,7 @@
     },
     "tags": {
       "type": "object",
+      "defaultValue": {},
       "metadata": {
         "description": "Specifies the tags that you want to apply to all resources."
       }
@@ -45,6 +46,13 @@
         "description": "Specifies the location of your Data Management Zone."
       }
     },
+    "virtualNetworkManagerManagementGroupScopes": {
+      "type": "array",
+      "defaultValue": [],
+      "metadata": {
+        "description": "Specifies the management group scopes for the Azure Virtual Network Manager."
+      }
+    },
     "administratorUsername": {
       "type": "string",
       "defaultValue": "SuperMainUser",
@@ -72,6 +80,7 @@
     },
     "enableBastionHostDeployment": {
       "type": "bool",
+      "defaultValue": false,
       "metadata": {
         "description": "Specifies whether Azure Bastion will be deployed in the first Data Landing Zone."
       }
@@ -145,6 +154,18 @@
           "firewallPolicyId": {
             "value": ""
           },
+          "virtualNetworkManagerManagementGroupScopes": {
+            "value": "[parameters('virtualNetworkManagerManagementGroupScopes')]"
+          },
+          "virtualNetworkManagerSubscriptionScopes": {
+            "copy": [
+              {
+                "name": "value",
+                "count": "[length(parameters('dataLandingZoneDetails'))]",
+                "input": "[format('/subscriptions/{0}', parameters('dataLandingZoneDetails')[copyIndex('value')].subscription)]"
+              }
+            ]
+          },
           "privateDnsZoneIdBlob": {
             "value": ""
           },

infra/main.bicep

@@ -41,6 +41,10 @@ param dnsServerAdresses array = [
 ]
 @description('Specifies the resource ID of the Azure Firewall Policy. Optional parameter allows you to deploy Firewall rules to an existing Firewall Policy if `enableDnsAndFirewallDeployment` is set to `false`.')
 param firewallPolicyId string = ''
+@description('Specifies the management group scopes for the Azure Virtual Network Manager.')
+param virtualNetworkManagerManagementGroupScopes array = []
+@description('Specifies the subscription scopes for the Azure Virtual Network Manager.')
+param virtualNetworkManagerSubscriptionScopes array = []
 
 // Private DNS Zone parameters
 @description('Specifies the resource ID of the private DNS zone for Key Vault. Optional if `enableDnsAndFirewallDeployment` is set to `true`.')
@@ -93,6 +97,8 @@ module networkServices 'modules/network.bicep' = {
     enableDnsAndFirewallDeployment: enableDnsAndFirewallDeployment
     firewallPrivateIp: firewallPrivateIp
     firewallPolicyId: firewallPolicyId
+    virtualNetworkManagerManagementGroupScopes: virtualNetworkManagerManagementGroupScopes
+    virtualNetworkManagerSubscriptionScopes: virtualNetworkManagerSubscriptionScopes
   }
 }
 

infra/main.json

@@ -5,7 +5,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.4.1008.15138",
-      "templateHash": "16584189192184544370"
+      "templateHash": "18257694432751193303"
     }
   },
   "parameters": {
@@ -100,6 +100,20 @@
         "description": "Specifies the resource ID of the Azure Firewall Policy. Optional parameter allows you to deploy Firewall rules to an existing Firewall Policy if `enableDnsAndFirewallDeployment` is set to `false`."
       }
     },
+    "virtualNetworkManagerManagementGroupScopes": {
+      "type": "array",
+      "defaultValue": [],
+      "metadata": {
+        "description": "Specifies the management group scopes for the Azure Virtual Network Manager."
+      }
+    },
+    "virtualNetworkManagerSubscriptionScopes": {
+      "type": "array",
+      "defaultValue": [],
+      "metadata": {
+        "description": "Specifies the subscription scopes for the Azure Virtual Network Manager."
+      }
+    },
     "privateDnsZoneIdKeyVault": {
       "type": "string",
       "defaultValue": "",
@@ -266,6 +280,12 @@
           },
           "firewallPolicyId": {
             "value": "[parameters('firewallPolicyId')]"
+          },
+          "virtualNetworkManagerManagementGroupScopes": {
+            "value": "[parameters('virtualNetworkManagerManagementGroupScopes')]"
+          },
+          "virtualNetworkManagerSubscriptionScopes": {
+            "value": "[parameters('virtualNetworkManagerSubscriptionScopes')]"
           }
         },
         "template": {
@@ -275,7 +295,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.4.1008.15138",
-              "templateHash": "10662562629090602323"
+              "templateHash": "2364844395026092218"
             }
           },
           "parameters": {
@@ -317,12 +337,21 @@
             "firewallPolicyId": {
               "type": "string",
               "defaultValue": ""
+            },
+            "virtualNetworkManagerManagementGroupScopes": {
+              "type": "array",
+              "defaultValue": []
+            },
+            "virtualNetworkManagerSubscriptionScopes": {
+              "type": "array",
+              "defaultValue": []
             }
           },
           "functions": [],
           "variables": {
             "azureFirewallSubnetName": "AzureFirewallSubnet",
             "servicesSubnetName": "ServicesSubnet",
+            "virtualNetworkManagerName": "[format('{0}-vnm', parameters('prefix'))]",
             "firewallPolicySubscriptionId": "[if(greaterOrEquals(length(split(parameters('firewallPolicyId'), '/')), 9), split(parameters('firewallPolicyId'), '/')[2], subscription().subscriptionId)]",
             "firewallPolicyResourceGroupName": "[if(greaterOrEquals(length(split(parameters('firewallPolicyId'), '/')), 9), split(parameters('firewallPolicyId'), '/')[4], resourceGroup().name)]",
             "firewallPolicyName": "[if(greaterOrEquals(length(split(parameters('firewallPolicyId'), '/')), 9), last(split(parameters('firewallPolicyId'), '/')), 'incorrectSegmentLength')]"
@@ -528,6 +557,107 @@
                 "[resourceId('Microsoft.Network/virtualNetworks', format('{0}-vnet', parameters('prefix')))]"
               ]
             },
+            {
+              "type": "Microsoft.Network/networkManagers",
+              "apiVersion": "2021-02-01-preview",
+              "name": "[variables('virtualNetworkManagerName')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "description": "Network Manager for ESA Mesh Network Architecture",
+                "displayName": "[variables('virtualNetworkManagerName')]",
+                "networkManagerScopeAccesses": [
+                  "Connectivity",
+                  "SecurityAdmin",
+                  "SecurityUser"
+                ],
+                "networkManagerScopes": {
+                  "managementGroups": "[union(array(null()), parameters('virtualNetworkManagerManagementGroupScopes'))]",
+                  "subscriptions": "[union(array(subscription().id), parameters('virtualNetworkManagerSubscriptionScopes'))]"
+                }
+              }
+            },
+            {
+              "type": "Microsoft.Network/networkManagers/networkGroups",
+              "apiVersion": "2021-02-01-preview",
+              "name": "[format('{0}/{1}', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsDevNetworkGroup')]",
+              "properties": {
+                "description": "Development Group for Enterprise-Scale Analytics",
+                "displayName": "Enterprise-Scale Analytics Dev Network Group",
+                "conditionalMembership": "{ \"allOf\": [ { \"field\": \"tags['Environment']\", \"equals\": \"dev\" }, { \"value\": \"[resourceGroup().Name]\", \"contains\": \"-network\" } ] }",
+                "groupMembers": [],
+                "memberType": ""
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/networkManagers', variables('virtualNetworkManagerName'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Network/networkManagers/networkGroups",
+              "apiVersion": "2021-02-01-preview",
+              "name": "[format('{0}/{1}', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsTestNetworkGroup')]",
+              "properties": {
+                "description": "Test Group for Enterprise-Scale Analytics",
+                "displayName": "Enterprise-Scale Analytics Test Network Group",
+                "conditionalMembership": "{ \"allOf\": [ { \"field\": \"tags['Environment']\", \"equals\": \"tst\" }, { \"value\": \"[resourceGroup().Name]\", \"contains\": \"-network\" } ] }",
+                "groupMembers": [],
+                "memberType": ""
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/networkManagers', variables('virtualNetworkManagerName'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Network/networkManagers/networkGroups",
+              "apiVersion": "2021-02-01-preview",
+              "name": "[format('{0}/{1}', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsProdNetworkGroup')]",
+              "properties": {
+                "description": "Production Group for Enterprise-Scale Analytics",
+                "displayName": "Enterprise-Scale Analytics Prod Network Group",
+                "conditionalMembership": "{ \"allOf\": [ { \"field\": \"tags['Environment']\", \"equals\": \"prd\" }, { \"value\": \"[resourceGroup().Name]\", \"contains\": \"-network\" } ] }",
+                "groupMembers": [],
+                "memberType": ""
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/networkManagers', variables('virtualNetworkManagerName'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Network/networkManagers/connectivityConfigurations",
+              "apiVersion": "2021-02-01-preview",
+              "name": "[format('{0}/{1}', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsConnectivityConfig')]",
+              "properties": {
+                "connectivityTopology": "Mesh",
+                "appliesToGroups": [
+                  {
+                    "groupConnectivity": "DirectlyConnected",
+                    "isGlobal": "False",
+                    "networkGroupId": "[resourceId('Microsoft.Network/networkManagers/networkGroups', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsDevNetworkGroup')]"
+                  },
+                  {
+                    "groupConnectivity": "DirectlyConnected",
+                    "isGlobal": "False",
+                    "networkGroupId": "[resourceId('Microsoft.Network/networkManagers/networkGroups', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsTestNetworkGroup')]"
+                  },
+                  {
+                    "groupConnectivity": "DirectlyConnected",
+                    "isGlobal": "False",
+                    "networkGroupId": "[resourceId('Microsoft.Network/networkManagers/networkGroups', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsProdNetworkGroup')]"
+                  }
+                ],
+                "deleteExistingPeering": "True",
+                "description": "Enterprise-Scale Analytics Mesh Network Topology",
+                "displayName": "Enterprise-Scale Analytics Connectivity Config",
+                "hubs": [],
+                "isGlobal": "False"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/networkManagers', variables('virtualNetworkManagerName'))]",
+                "[resourceId('Microsoft.Network/networkManagers/networkGroups', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsDevNetworkGroup')]",
+                "[resourceId('Microsoft.Network/networkManagers/networkGroups', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsProdNetworkGroup')]",
+                "[resourceId('Microsoft.Network/networkManagers/networkGroups', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsTestNetworkGroup')]"
+              ]
+            },
             {
               "condition": "[parameters('enableDnsAndFirewallDeployment')]",
               "type": "Microsoft.Resources/deployments",