Azure Landing Zones Documentation
Home GitHub Issue Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  1. Azure Landing Zones Documentation
  2. /
  3. Accelerator
  4. /
  5. Starter Modules
  6. /
  7. Terraform - Azure Verified Modules for Platform Landing Zone (ALZ)
  8. /
  9. Configuration File
Edit page

Configuration File

This section details the available configuration settings / variables in this starter module.

Custom Replacements (custom_replacements)

The custom_replacements variable builds on the built-in replacements to provide user defined replacements that can be used throughout your configuration. This reduces the complexity of the configuration file by allowing re-use of names and other definitions that may be repeated throughout the configuration.

There are 4 layers of replacements that can be built upon to provide the level of flexibility you need. The order of precedence determines which other replacements can be used to build your replacement. For example a ‘Name’ replacement can be used to build a ‘Resource Group Identifier’ replacement, but a ‘Resource Group Identifier’ replacement cannot be used to build a ‘Name’ replacement.

The layers and precedence order is:

  1. Built-in Replacements: These can be found at the top of our example config files and you can also see them in the code base here
  2. Names: This is for resource names and other basic strings
  3. Resource Group Identifiers: This is for resource group IDs
  4. Resource Identifiers: This is for resource IDs

Names (custom_replacements.names)

Used to define custom names and strings that can be used throughout the configuration file. This can leverage the built-in replacements.

Example usage:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

custom_replacements = {
  names = {
    # Resource group names
    management_resource_group_name                 = "rg-management-$${starter_location_01}"
    connectivity_hub_primary_resource_group_name   = "rg-hub-$${starter_location_01}"
    connectivity_hub_secondary_resource_group_name = "rg-hub-$${starter_location_02}"
    dns_resource_group_name                        = "rg-hub-dns-$${starter_location_01}"
    ddos_resource_group_name                       = "rg-hub-ddos-$${starter_location_01}"
    asc_export_resource_group_name                 = "rg-asc-export-$${starter_location_01}"

    # Resource names
    log_analytics_workspace_name            = "law-management-$${starter_location_01}"
    ddos_protection_plan_name               = "ddos-$${starter_location_01}"
    automation_account_name                 = "aa-management-$${starter_location_01}"
    ama_user_assigned_managed_identity_name = "uami-management-ama-$${starter_location_01}"
    dcr_change_tracking_name                = "dcr-change-tracking"
    dcr_defender_sql_name                   = "dcr-defender-sql"
    dcr_vm_insights_name                    = "dcr-vm-insights"

    # IP Ranges Primary
    # Regional Address Space: 10.0.0.0/16
    primary_hub_address_space                          = "10.0.0.0/16"
    primary_hub_virtual_network_address_space          = "10.0.0.0/22"
    primary_firewall_subnet_address_prefix             = "10.0.0.0/26"
    primary_bastion_subnet_address_prefix              = "10.0.0.64/26"
    primary_gateway_subnet_address_prefix              = "10.0.0.128/27"
    primary_private_dns_resolver_subnet_address_prefix = "10.0.0.160/28"
  }
}

Resource Group Identifiers (custom_replacements.resource_group_identifiers)

Used to define resource group IDs that can be used throughout the configuration file. This can leverage the built-in replacements and custom names.

Example usage:

1
2
3
4
5
6

custom_replacements = {
  resource_group_identifiers = {
    management_resource_group_id           = "/subscriptions/$${subscription_id_management}/resourcegroups/$${management_resource_group_name}"
    ddos_protection_plan_resource_group_id = "/subscriptions/$${subscription_id_connectivity}/resourcegroups/$${ddos_resource_group_name}"
  }
}

Resource Identifiers (custom_replacements.resource_identifiers)

Used to define resource IDs that can be used throughout the configuration file. This can leverage the built-in replacements, custom names, and resource group IDs.

Example usage:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

custom_replacements = {
  resource_identifiers = {
    ama_change_tracking_data_collection_rule_id = "$${management_resource_group_id}/providers/Microsoft.Insights/dataCollectionRules/$${dcr_change_tracking_name}"
    ama_mdfc_sql_data_collection_rule_id        = "$${management_resource_group_id}/providers/Microsoft.Insights/dataCollectionRules/$${dcr_defender_sql_name}"
    ama_vm_insights_data_collection_rule_id     = "$${management_resource_group_id}/providers/Microsoft.Insights/dataCollectionRules/$${dcr_vm_insights_name}"
    ama_user_assigned_managed_identity_id       = "$${management_resource_group_id}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$${ama_user_assigned_managed_identity_name}"
    log_analytics_workspace_id                  = "$${management_resource_group_id}/providers/Microsoft.OperationalInsights/workspaces/$${log_analytics_workspace_name}"
    ddos_protection_plan_id                     = "$${ddos_protection_plan_resource_group_id}/providers/Microsoft.Network/ddosProtectionPlans/$${ddos_protection_plan_name}"
  }
}

Enable Telemetry (enable_telemetry)

The enable_telemetry variable determines whether telemetry about module usage is sent to Microsoft, enabling us to invest in improvements to the Accelerator and Azure Verified Modules.

Example usage:

1

enable_telemetry = true

Tags (tags)

The tags variable is a default set of tags to apply to resources that support them. In many cases, these tags can be overridden on a per resource basis.

Example usage:

1
2
3
4

tags = {
  deployed_by = "terraform"
  source      = "Azure Landing Zones Accelerator"
}

Management Resource Settings (management_resource_settings)

The management_resource_settings variable is used to configure the management resources. This includes the log analytics workspace, automation account, and data collection rules for Azure Monitoring Agent (AMA).

This variable is of type any as it maps directly to the Azure Verified Module variables. To determine what can be supplied to this variable you can refer to the documentation for this module directly:

Documentation link: registry.terraform.io/modules/Azure/avm-ptn-alz-management

Example usage:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

management_resource_settings = {
  automation_account_name      = "$${automation_account_name}"
  location                     = "$${starter_location_01}"
  log_analytics_workspace_name = "$${log_analytics_workspace_name}"
  resource_group_name          = "$${management_resource_group_name}"
  user_assigned_managed_identities = {
    ama = {
      name = "$${ama_user_assigned_managed_identity_name}"
    }
  }
  data_collection_rules = {
    change_tracking = {
      name = "$${dcr_change_tracking_name}"
    }
    defender_sql = {
      name = "$${dcr_defender_sql_name}"
    }
    vm_insights = {
      name = "$${dcr_vm_insights_name}"
    }
  }
}

Management Group Settings (management_group_settings)

The management_group_settings variable is used to configure the management groups, policies, and policy role assignments.

This variable is of type any as it maps directly to the Azure Verified Module variables. To determine what can be supplied to this variable you can refer to the documentation for this module directly:

Documentation link: registry.terraform.io/modules/Azure/avm-ptn-alz

Example usage:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

management_group_settings = {
  location           = "$${starter_location_01}"
  architecture_name  = "alz"
  parent_resource_id = "$${root_parent_management_group_id}"
  # Example of how to set default values for policy parameters
  policy_default_values = {
    ama_change_tracking_data_collection_rule_id = "$${ama_change_tracking_data_collection_rule_id}"
    ama_mdfc_sql_data_collection_rule_id        = "$${ama_mdfc_sql_data_collection_rule_id}"
    ama_vm_insights_data_collection_rule_id     = "$${ama_vm_insights_data_collection_rule_id}"
    ama_user_assigned_managed_identity_id       = "$${ama_user_assigned_managed_identity_id}"
    ama_user_assigned_managed_identity_name     = "$${ama_user_assigned_managed_identity_name}"
    log_analytics_workspace_id                  = "$${log_analytics_workspace_id}"
    ddos_protection_plan_id                     = "$${ddos_protection_plan_id}"
    private_dns_zone_subscription_id            = "$${subscription_id_connectivity}"
    private_dns_zone_region                     = "$${starter_location_01}"
    private_dns_zone_resource_group_name        = "$${dns_resource_group_name}"
  }
  # Example of how to place the 3 platform subscriptions under their management groups
  subscription_placement = {
    identity = {
      subscription_id       = "$${subscription_id_identity}"
      management_group_name = "identity"
    }
    connectivity = {
      subscription_id       = "$${subscription_id_connectivity}"
      management_group_name = "connectivity"
    }
    management = {
      subscription_id       = "$${subscription_id_management}"
      management_group_name = "management"
    }
  }
  policy_assignments_to_modify = {
    # Example of how to update a policy assignment parameters for Defender for Cloud
    alzroot = {
      policy_assignments = {
        Deploy-MDFC-Config-H224 = {
          parameters = {
            ascExportResourceGroupName                  = "$${asc_export_resource_group_name}"
            ascExportResourceGroupLocation              = "$${starter_location_01}"
            emailSecurityContact                        = "security_contact@replace_me"
            enableAscForServers                         = "DeployIfNotExists"
            enableAscForServersVulnerabilityAssessments = "DeployIfNotExists"
            enableAscForSql                             = "DeployIfNotExists"
            enableAscForAppServices                     = "DeployIfNotExists"
            enableAscForStorage                         = "DeployIfNotExists"
            enableAscForContainers                      = "DeployIfNotExists"
            enableAscForKeyVault                        = "DeployIfNotExists"
            enableAscForSqlOnVm                         = "DeployIfNotExists"
            enableAscForArm                             = "DeployIfNotExists"
            enableAscForOssDb                           = "DeployIfNotExists"
            enableAscForCosmosDbs                       = "DeployIfNotExists"
            enableAscForCspm                            = "DeployIfNotExists"
          }
        }
      }
    }
    # Example of how to update a policy assignment enforcement mode for DDOS Protection Plan
    connectivity = {
      policy_assignments = {
        Enable-DDoS-VNET = {
          enforcement_mode = "DoNotEnforce"
        }
      }
    }
  }
}

Connectivity Type (connectivity_type)

The connectivity_type variable is used to choose the type of connectivity to deploy. Supported values are:

  • hub_and_spoke_vnet: Deploy hub and spoke networking using Azure Virtual Networks
  • virtual_wan: Deploy Azure Virtual WAN networking
  • none: Don’t deploy any networking

Example usage:

1
2
3
4
5
6
7
8

# Example of how to use a hub and spoke Virtual Network for connectivity
connectivity_type = "hub_and_spoke_vnet"

# Example of how to use a Virtual WAN for connectivity
connectivity_type = "virtual_wan"

# Example of how to disable connectivity
connectivity_type = "none"

Connectivity Resource Groups (connectivity_resource_groups)

The connectivity_resource_groups variable is used to specify the name and location of the resource groups used for connectivity.

This variable is a map(object) and has two properties:

  • name: The resource group name
  • location: The resource group location

Example usage:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

# Example for hub and spoke Virtual Network
connectivity_resource_groups = {
  ddos = {
    name     = "$${ddos_resource_group_name}"
    location = "$${starter_location_01}"
  }
  vnet_primary = {
    name     = "$${connectivity_hub_primary_resource_group_name}"
    location = "$${starter_location_01}"
  }
  vnet_secondary = {
    name     = "$${connectivity_hub_secondary_resource_group_name}"
    location = "$${starter_location_02}"
  }
  dns = {
    name     = "$${dns_resource_group_name}"
    location = "$${starter_location_01}"
  }
}

# Example for Virtual WAN
connectivity_resource_groups = {
  ddos = {
    name     = "$${ddos_resource_group_name}"
    location = "$${starter_location_01}"
  }
  vwan = {
    name     = "$${connectivity_hub_vwan_resource_group_name}"
    location = "$${starter_location_01}"
  }
  vwan_hub_primary = {
    name     = "$${connectivity_hub_primary_resource_group_name}"
    location = "$${starter_location_01}"
  }
  vwan_hub_secondary = {
    name     = "$${connectivity_hub_secondary_resource_group_name}"
    location = "$${starter_location_02}"
  }
  dns = {
    name     = "$${dns_resource_group_name}"
    location = "$${starter_location_01}"
  }
}

Hub and Spoke Virtual Network Settings (hub_and_spoke_vnet_settings)

The hub_and_spoke_vnet_settings variable is used to set the non-regional settings for the hub and spoke Virtual Network connectivity option. It is only used to set the DDOS Protection Plan at this time.

This variable is of type any as it will be used for other purposes moving forward.

Example usage:

1
2
3
4
5
6
7

hub_and_spoke_vnet_settings = {
  ddos_protection_plan = {
    name                = "$${ddos_protection_plan_name}"
    resource_group_name = "$${ddos_resource_group_name}"
    location            = "$${starter_location_01}"
  }
}

Hub and Spoke Virtual Networks (hub_and_spoke_vnet_virtual_networks)

The hub_and_spoke_vnet_virtual_networks variable is used to set the regional settings for the hub and spoke Virtual Network connectivity options. This includes Hub Networks, Peering, Routing, Subnets, Firewalls, Virtual Network Gateways, Bastion Hosts, Private DNS Zones, and Private DNS Resolver

This variable is of type map(object). Some of the object properties map directly to the Azure Verified Module variables. To determine what can be supplied to these variable you can refer to the documentation for this module directly.

The map(object) definition can be found here.

The supported object properties are:

  • hub_virtual_network: This object maps directly to the variables of the Azure Verified Module, which can be found here: registry.terraform.io/modules/Azure/avm-ptn-hubnetworking
  • bastion: This an object to specify the Bastion Host settings (omit this object if you don’t want to deploy a Bastion Host)
  • virtual_network_gateways: This an object to specify the Virtual Network Gateways settings (omit this object if you don’t want to deploy any Virtual Network Gateways)
  • private_dns_zones: This an object to specify the Private DNS Zone settings (omit this object if you don’t want to deploy any Private DNS Zones)
    • subnet_address_prefix: The Private DNS Resolver subnet address space
    • resource_group_name: The name of the resource group to deploy the Private DNS Zones into
    • is_primary: Whether this is the primary region. Any non-regional Private Link Private DNS Zones will be deployed into this region. Although the Private DNS Zones are a global resource, their meta-data needs to reside in a specific region.
    • private_link_private_dns_zones: This is a map(object) used to override the Private Link Private DNS Zones that are deployed, leave this empty to deploy the default set of zones specified by ALZ
      • zone_name: The name of the Private DNS Zone to deploy
    • auto_registration_zone_enabled: Whether to deploy the Virtual Machine auto-registration Private DNS Zone
    • auto_registration_zone_name: The name of the Virtual Machine auto-registration Private DNS Zone
    • private_dns_resolver: This is an object to specify the Private DNS Resolver
      • name: The name of the Private DNS Resolver
      • resource_group_name: The name of the resource group to deploy the Private DNS Resolver into
      • ip_address: The static IP Address of the Private DNS Resolver. This will be auto calculated if not supplied

Example usage:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

hub_and_spoke_vnet_virtual_networks = {
  primary = {
    # Example hub network settings for this region
    hub_virtual_network = {
      name                            = "vnet-hub-$${starter_location_01}"
      resource_group_name             = "$${connectivity_hub_primary_resource_group_name}"
      resource_group_creation_enabled = false
      location                        = "$${starter_location_01}"
      address_space                   = ["$${primary_hub_virtual_network_address_space}"]
      routing_address_space           = ["$${primary_hub_address_space}"]
      route_table_name_firewall       = "rt-hub-fw-$${starter_location_01}"
      route_table_name_user_subnets   = "rt-hub-std-$${starter_location_01}"
      mesh_peering                    = true
      ddos_protection_plan_id         = "$${management_resource_group_id}/providers/Microsoft.Network/ddosProtectionPlans/$${ddos_protection_plan_name}"
      subnets                         = {}
      # Example Azure Firewall settings for this region (omit this section if not using Azure Firewall)
      firewall = {
        subnet_address_prefix = "$${primary_firewall_subnet_address_prefix}"
        name                  = "fw-hub-$${starter_location_01}"
        sku_name              = "AZFW_VNet"
        sku_tier              = "Standard"
        zones                 = "$${starter_location_01_availability_zones}"
        default_ip_configuration = {
          public_ip_config = {
            name  = "pip-fw-hub-$${starter_location_01}"
            zones = "$${starter_location_01_availability_zones}"
          }
        }
        # Example firewall policy settings for this region
        firewall_policy = {
          name = "fwp-hub-$${starter_location_01}"
        }
      }
    }
    # Example Virtual Network Gateway settings for this region (omit this section if not using Virtual Network Gateway)
    virtual_network_gateways = {
      subnet_address_prefix = "$${primary_gateway_subnet_address_prefix}"
      # Example ExpressRoute settings for this region (omit this section if not using ExpressRoute)
      express_route = {
        location = "$${starter_location_01}"
        name     = "vgw-hub-expressroute-$${starter_location_01}"
        sku      = "$${starter_location_01_virtual_network_gateway_sku_express_route}"
        ip_configurations = {
          default = {
            name = "ipconfig-vgw-hub-expressroute-$${starter_location_01}"
            public_ip = {
              name  = "pip-vgw-hub-expressroute-$${starter_location_01}"
              zones = "$${starter_location_01_availability_zones}"
            }
          }
        }
      }
      # Example VPN Gateway settings for this region (omit this section if not using VPN Gateway)
      vpn = {
        location = "$${starter_location_01}"
        name     = "vgw-hub-vpn-$${starter_location_01}"
        sku      = "$${starter_location_01_virtual_network_gateway_sku_vpn}"
        ip_configurations = {
          default = {
            name = "ipconfig-vgw-hub-vpn-$${starter_location_01}"
            public_ip = {
              name  = "pip-vgw-hub-vpn-$${starter_location_01}"
              zones = "$${starter_location_01_availability_zones}"
            }
          }
        }
      }
    }
    # Example Private DNS Zone settings for this region (omit this section if not using Private DNS Zones)
    private_dns_zones = {
      resource_group_name            = "$${dns_resource_group_name}"
      is_primary                     = true
      auto_registration_zone_enabled = true
      auto_registration_zone_name    = "$${starter_location_01}.azure.local"
      subnet_address_prefix          = "$${primary_private_dns_resolver_subnet_address_prefix}"
      private_dns_resolver = {
        name = "pdr-hub-dns-$${starter_location_01}"
      }
    }
    # Example Bastion Host settings for this region (omit this section if not using Bastion Host)
    bastion = {
      subnet_address_prefix = "$${primary_bastion_subnet_address_prefix}"
      bastion_host = {
        name = "bastion-hub-$${starter_location_01}"
      }
      bastion_public_ip = {
        name  = "pip-bastion-hub-$${starter_location_01}"
        zones = "$${starter_location_01_availability_zones}"
      }
    }
  }
}

Virtual WAN Settings (virtual_wan_settings)

The virtual_wan_settings variable is used to set the non-regional settings for the Virtual WAN connectivity option. It is used to set the Virtual WAN non-regional properties and the DDOS Protection Plan.

This variable is of type any as it maps directly to the Azure Verified Module variables. To determine what can be supplied to this variable you can refer to the documentation for this module directly:

Documentation link: registry.terraform.io/modules/Azure/avm-ptn-virtualwan

Example usage:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

virtual_wan_settings = {
  name                = "vwan-$${starter_location_01}"
  resource_group_name = "$${connectivity_hub_vwan_resource_group_name}"
  location            = "$${starter_location_01}"
  ddos_protection_plan = {
    name                = "$${ddos_protection_plan_name}"
    resource_group_name = "$${ddos_resource_group_name}"
    location            = "$${starter_location_01}"
  }
}

Virtual WAN Virtual Hubs (virtual_wan_virtual_hubs)

The hub_and_spoke_vnet_virtual_networks variable is used to set the regional settings for the Virtual WAN connectivity options. This includes Virtual WAN Hubs, Firewalls, Virtual Network Gateways, Bastion Hosts, Private DNS Zones, and Private DNS Resolver

This variable is of type map(object). Some of the object properties map directly to the Azure Verified Module variables. To determine what can be supplied to these variable you can refer to the documentation for this module directly.

The map(object) definition can be found here.

The supported object properties are:

  • hub: This object maps directly to the virtual_hubs variable of the Azure Verified Module, which can be found here: registry.terraform.io/modules/Azure/avm-ptn-virtualwan
  • firewall: This object maps directly to the firewalls variable of the Azure Verified Module, which can be found here: registry.terraform.io/modules/Azure/avm-ptn-virtualwan
  • firewall_policy: This object maps directly to the Azure Verified Module, which can be found here: registry.terraform.io/modules/Azure/avm-res-network-firewallpolicy
  • bastion: This an object to specify the Bastion Host settings (omit this object if you don’t want to deploy a Bastion Host)
  • virtual_network_gateways: This an object to specify the Virtual Network Gateways settings (omit this object if you don’t want to deploy any Virtual Network Gateways)
  • private_dns_zones: This an object to specify the Private DNS Zone settings (omit this object if you don’t want to deploy any Private DNS Zones)
    • subnet_address_prefix: The Private DNS Resolver subnet address space
    • resource_group_name: The name of the resource group to deploy the Private DNS Zones into
    • is_primary: Whether this is the primary region. Any non-regional Private Link Private DNS Zones will be deployed into this region. Although the Private DNS Zones are a global resource, their meta-data needs to reside in a specific region.
    • private_link_private_dns_zones: This is a map(object) used to override the Private Link Private DNS Zones that are deployed, leave this empty to deploy the default set of zones specified by ALZ
      • zone_name: The name of the Private DNS Zone to deploy
    • auto_registration_zone_enabled: Whether to deploy the Virtual Machine auto-registration Private DNS Zone
    • auto_registration_zone_name: The name of the Virtual Machine auto-registration Private DNS Zone
    • private_dns_resolver: This is an object to specify the Private DNS Resolver
      • name: The name of the Private DNS Resolver
      • resource_group_name: The name of the resource group to deploy the Private DNS Resolver into
      • ip_address: The static IP Address of the Private DNS Resolver. This will be auto calculated if not supplied
  • side_car_virtual_network: This object maps directly to the variables of the Azure Verified Module, which can be found here: registry.terraform.io/modules/Azure/avm-res-network-virtualnetwork

Example usage:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

virtual_wan_virtual_hubs = {
  primary = {
    # Example hub network settings for this region
    hub = {
      name = "vwan-hub-$${starter_location_01}"
      resource_group = "$${connectivity_hub_primary_resource_group_name}"
      location       = "$${starter_location_01}"
      address_prefix = "$${primary_hub_address_space}"
    }
    # Example Azure Firewall settings for this region (omit this section if not using Azure Firewall)
    firewall = {
      name     = "fw-hub-$${starter_location_01}"
      sku_name = "AZFW_Hub"
      sku_tier = "Standard"
      zones    = "$${starter_location_01_availability_zones}"
    }
    # Example firewall policy settings for this region (omit this section if not using Azure Firewall)
    firewall_policy = {
      name = "fwp-hub-$${starter_location_01}"
    }
    # Example Virtual Network Gateway settings for this region (omit this section if not using Virtual Network Gateway)
    virtual_network_gateways = {
      # Example ExpressRoute settings for this region (omit this section if not using ExpressRoute)
      express_route = {
        name = "vgw-hub-expressroute-$${starter_location_01}"
      }
      # Example VPN Gateway settings for this region (omit this section if not using VPN Gateway)
      vpn = {
        name = "vgw-hub-vpn-$${starter_location_01}"
      }
    }
    # Example Private DNS Zone settings for this region (omit this section if not using Private DNS Zones)
    private_dns_zones = {
      resource_group_name            = "$${dns_resource_group_name}"
      is_primary                     = true
      auto_registration_zone_enabled = true
      auto_registration_zone_name    = "$${starter_location_01}.azure.local"
      subnet_address_prefix          = "$${primary_private_dns_resolver_subnet_address_prefix}"
      private_dns_resolver = {
        name = "pdr-hub-dns-$${starter_location_01}"
      }
    }
    # Example Bastion Host settings for this region (omit this section if not using Bastion Host)
    bastion = {
      subnet_address_prefix = "$${primary_bastion_subnet_address_prefix}"
      bastion_host = {
        name = "bastion-hub-$${starter_location_01}"
      }
      bastion_public_ip = {
        name  = "pip-bastion-hub-$${starter_location_01}"
        zones = "$${starter_location_01_availability_zones}"
      }
    }
    # Example Side Car Virtual Network settings for this region
    side_car_virtual_network = {
      name          = "vnet-side-car-$${starter_location_01}"
      address_space = ["$${primary_side_car_virtual_network_address_space}"]
    }
  }
}
gdoc_arrow_left_alt 14 - Zero Trust Networking Module Index gdoc_arrow_right_alt