Options

This section provides detailed instructions for updating your configuration to implement each option.

If you are familiar with Terraform tfvars file structure, you can skip the next section that explains how to update the configuration file and go directly to the Options you want to implement.

Most of the options require you to update the platform configuration file. The platform configuration file is a HCL (tfvars) file that contains the configuration settings for the platform landing zone.

There are two types of settings in the platform configuration file that you may need to update. For the sake of simplicity we will refer to these as line and block settings.

Depending on the option you want to implement, you may need to delete and / or add configuration settings to the platform configuration file.

A line setting is a single line in the configuration file that you need to update. For example, the following line setting is used to specify the name of the resource group:

1

ddos_resource_group_name = "rg-hub-ddos-$${starter_location_01}"

A line setting is denoted by the <key> = "<value>" format.

If you are asked to update a line setting, you will need to find the line based on it’s key. You can use Ctrl + F to search for the key in the file.

For example, if you are asked to delete a line setting, you would:

1. Use Ctrl + F to bring up the search dialog
2. Enter the key in the search dialog. E.g. ddos_resource_group_name
3. Hit enter to search for the key
4. Delete the whole line from the configuration file
5. Save the configuration file

A block setting is a group of settings that are enclosed in curly braces {}. For example, the following block setting is used to specify the policy assignments for a management group:

For those familiar with Terraform, what we refer to as a block here is generally an object or a map type in HCL.

1
2
3
4

ddos = {
  name     = "$${ddos_resource_group_name}"
  location = "$${starter_location_01}"
}

A block setting is denoted by the <key> = { <value> } format, where the curly braces and value span multiple lines in the configuration file.

If you are asked to update a block setting, you will need to find the block based on it’s key. You can use Ctrl + F to search for the key in the file.

For example, if you are asked to delete a block setting, you would:

1. Use Ctrl + F to bring up the search dialog
2. Enter the key in the search dialog. E.g. ddos
3. Hit enter to search for the key
4. Identify the start and end of the block by looking for the opening and closing curly braces {}. This is made easier when using an IDE like Visual Studio Code, which will highlight the matching braces when you click on one of them.
5. Select the whole block, including the key and delete all the lines from the configuration file
6. Save the configuration file

If you are asked to paste configuration inside a block setting, you would:

1. Use Ctrl + F to bring up the search dialog
2. Enter the key in the search dialog. E.g. management_group_settings
3. If the block is denoted as a nested block (e.g. management_group_settings > policy_assignments_to_modify), you will need to find the last child block. In this case, you would then search for policy_assignments_to_modify
4. Repeat the last step for each nested block until you find the block where you need to paste the code
5. Copy the code you need to paste into the clipboard
6. Place the cursor at the end of the first line of the block after the and press Enter to create a new line. If you are using Visual Studio Code, it will automatically indent the new line to match the indentation of the block
7. Paste the code from the clipboard using Ctrl + V
8. Save the configuration file

The available options are:

1. Customise Resource Names
2. Customize Management Group Names and IDs
3. Turn off DDOS protection plan
4. Turn off Bastion host
5. Turn off Private DNS zones and Private DNS resolver
6. Turn off Virtual Network Gateways
7. Additional Regions
8. IP Address Ranges
9. Change a policy assignment enforcement mode
10. Remove a policy assignment
11. Turn off Azure Monitoring Agent
12. Deploy Azure Monitoring Baseline Alerts (AMBA)
13. Turn off Defender Plans
14. Implement Zero Trust Networking