forked from Azure/terraform-azurerm-caf-enterprise-scale
-
Notifications
You must be signed in to change notification settings - Fork 0
/
resources.management_groups.tf
152 lines (123 loc) · 5.54 KB
/
resources.management_groups.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
# The following resource blocks and for_each logic are used
# to ensure Management Group deployment respects the
# hierarchical dependencies between Management Groups and
# their parents. A local variable is used to merge the
# response from each block to return the configuration
# data from the module in a single object.
# Azure only supports a Management Group depth of 6 levels.
resource "azurerm_management_group" "level_1" {
for_each = local.azurerm_management_group_level_1
name = each.value.id
display_name = each.value.display_name
parent_management_group_id = "${local.provider_path.management_groups}${each.value.parent_management_group_id}"
subscription_ids = each.value.subscription_ids
}
resource "azurerm_management_group" "level_2" {
for_each = local.azurerm_management_group_level_2
name = each.value.id
display_name = each.value.display_name
parent_management_group_id = "${local.provider_path.management_groups}${each.value.parent_management_group_id}"
subscription_ids = each.value.subscription_ids
depends_on = [azurerm_management_group.level_1]
}
resource "azurerm_management_group" "level_3" {
for_each = local.azurerm_management_group_level_3
name = each.value.id
display_name = each.value.display_name
parent_management_group_id = "${local.provider_path.management_groups}${each.value.parent_management_group_id}"
subscription_ids = each.value.subscription_ids
depends_on = [azurerm_management_group.level_2]
}
resource "azurerm_management_group" "level_4" {
for_each = local.azurerm_management_group_level_4
name = each.value.id
display_name = each.value.display_name
parent_management_group_id = "${local.provider_path.management_groups}${each.value.parent_management_group_id}"
subscription_ids = each.value.subscription_ids
depends_on = [azurerm_management_group.level_3]
}
resource "azurerm_management_group" "level_5" {
for_each = local.azurerm_management_group_level_5
name = each.value.id
display_name = each.value.display_name
parent_management_group_id = "${local.provider_path.management_groups}${each.value.parent_management_group_id}"
subscription_ids = each.value.subscription_ids
depends_on = [azurerm_management_group.level_4]
}
resource "azurerm_management_group" "level_6" {
for_each = local.azurerm_management_group_level_6
name = each.value.id
display_name = each.value.display_name
parent_management_group_id = "${local.provider_path.management_groups}${each.value.parent_management_group_id}"
subscription_ids = each.value.subscription_ids
depends_on = [azurerm_management_group.level_5]
}
# This will deploy Diagnostic Settings for the Management Groups
# when the input variable deploy_diagnostics_for_mg is true
resource "azapi_resource" "diag_settings" {
for_each = local.azapi_mg_diagnostics
type = "Microsoft.Insights/diagnosticSettings@2021-05-01-preview"
name = "toLA"
parent_id = each.key
schema_validation_enabled = false
body = {
properties = {
logAnalyticsDestinationType = "null"
logs = [
{
category = "Administrative"
enabled = true
},
{
category = "Policy"
enabled = true
}
]
workspaceId = local.template_file_variables.log_analytics_workspace_resource_id
}
}
depends_on = [
time_sleep.after_azurerm_management_group,
azurerm_management_group.level_1,
azurerm_management_group.level_2,
azurerm_management_group.level_3,
azurerm_management_group.level_4,
azurerm_management_group.level_5,
azurerm_management_group.level_6,
]
}
# This is used when strict_subscription_association is set to true
resource "azurerm_management_group_subscription_association" "enterprise_scale" {
for_each = local.azurerm_management_group_subscription_association_enterprise_scale
management_group_id = each.value.management_group_id
subscription_id = each.value.subscription_id
depends_on = [
time_sleep.after_azurerm_management_group,
azurerm_management_group.level_1,
azurerm_management_group.level_2,
azurerm_management_group.level_3,
azurerm_management_group.level_4,
azurerm_management_group.level_5,
azurerm_management_group.level_6,
]
}
resource "time_sleep" "after_azurerm_management_group" {
depends_on = [
azurerm_management_group.level_1,
azurerm_management_group.level_2,
azurerm_management_group.level_3,
azurerm_management_group.level_4,
azurerm_management_group.level_5,
azurerm_management_group.level_6,
]
triggers = {
"azurerm_management_group_level_1" = jsonencode(keys(azurerm_management_group.level_1))
"azurerm_management_group_level_2" = jsonencode(keys(azurerm_management_group.level_2))
"azurerm_management_group_level_3" = jsonencode(keys(azurerm_management_group.level_3))
"azurerm_management_group_level_4" = jsonencode(keys(azurerm_management_group.level_4))
"azurerm_management_group_level_5" = jsonencode(keys(azurerm_management_group.level_5))
"azurerm_management_group_level_6" = jsonencode(keys(azurerm_management_group.level_6))
}
create_duration = local.create_duration_delay["after_azurerm_management_group"]
destroy_duration = local.destroy_duration_delay["after_azurerm_management_group"]
}