Deploying Azure Landing Zone with Azure Bicep

Azure Landing Zone

Azure Landing Zones are pre-defined architectures for deploying and managing workloads on the Azure cloud platform. They provide a structured approach to designing and implementing a cloud environment that is optimized for security, compliance, governance, and cost efficiency. By using Azure Landing Zones, organizations can accelerate their cloud adoption journey while ensuring their cloud environment is consistent, scalable, and manageable.

Azure Landing Zones provide several benefits to organizations. Firstly, they help organizations establish a standardized framework for deploying workloads on the Azure platform, which simplifies the deployment process and ensures consistency across different teams and projects. Secondly, Azure Landing Zones help organizations meet regulatory and compliance requirements by implementing best practices for security, governance, and compliance. This ensures that sensitive data is protected and that the organization remains compliant with relevant regulations. Finally, Azure Landing Zones help organizations optimize their cloud costs by implementing cost-effective architectures and enabling efficient resource management. This helps organizations achieve their business goals while minimizing their cloud spending. Overall, Azure Landing Zones are an essential tool for organizations looking to maximize the benefits of the Azure cloud platform while minimizing the associated risks and costs.

You can learn more about Landing Zones and find more examples in Cloud Adoption Framework.

Azure Bicep

Azure Bicep is a domain-specific language (DSL) for deploying Azure resources. It is designed to be more expressive and easier to read than the traditional Azure Resource Manager (ARM) templates. One of the benefits of using Azure Bicep is that it allows you to modularize your resources and reuse them in other deployments. This can save time and reduce errors when deploying multiple resources that have similar configurations.

You can learn more about it in this article Simplify Your Resource Deployments With Azure Bicep

Bicep Template for Azure Landing Zone

In this article, we’ll cover deploying an Azure Landing Zone with Bicep. This involves creating a set of foundational resources that will serve as the basis for your organization’s Azure environment.

The following Bicep template creates an Azure Landing Zone that includes a resource group, a virtual network, subnets, and security groups:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

param deploymentName string
param location string
param virtualNetworkName string
param addressPrefix string
param subnetName string
param subnetPrefix string
param securityGroupName string
param subnetSecurityGroupAssociationName string
param defaultTags object

resource rg 'Microsoft.Resources/resourceGroups@2021-04-01' = {
  name: 'landing-zone-rg'
  location: location
  tags: defaultTags
}

resource vnet 'Microsoft.Network/virtualNetworks@2021-05-01' = {
  name: virtualNetworkName
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: [addressPrefix]
    }
  }
  tags: defaultTags
}

resource subnet 'Microsoft.Network/virtualNetworks/subnets@2021-05-01' = {
  name: subnetName
  dependsOn: [
    vnet
  ]
  properties: {
    addressPrefix: subnetPrefix
    networkSecurityGroup: {
      id: subnetSecurityGroupAssociationName
    }
  }
}

resource securityGroup 'Microsoft.Network/networkSecurityGroups@2021-02-01' = {
  name: securityGroupName
  location: location
  properties: {
    securityRules: [
      {
        name: 'Allow-All'
        properties: {
          protocol: '*'
          sourceAddressPrefix: '*'
          destinationAddressPrefix: '*'
          access: 'Allow'
          direction: 'Inbound'
          priority: 100
          sourcePortRange: '*'
          destinationPortRange: '*'
        }
      }
    ]
  }
  tags: defaultTags
}

resource subnetSecurityGroupAssociation 'Microsoft.Network/virtualNetworks/subnets/networkSecurityGroupAssociations@2021-05-01' = {
  name: subnetSecurityGroupAssociationName
  properties: {
    networkSecurityGroup: {
      id: securityGroup.id
    }
  }
}

output output_rg_id string = rg.id
output output_vnet_id string = vnet.id
output output_subnet_id string = subnet.id
output output_security_group_id string = securityGroup.id
output output_subnet_security_group_association_id string = subnetSecurityGroupAssociation.id

In this template, we define several parameters that can be customized for your environment, including the deployment name, location, virtual network name, address prefix, subnet name, subnet prefix, security group name, subnet security group association name, and default tags.

We create a resource group using the ‘Microsoft.Resources/resourceGroups’ resource type, which provides a logical container for our resources. We then create a virtual network using the ‘Microsoft.Network/virtualNetworks’ resource type, which provides a private network space for our resources to communicate with each other. The virtual network includes a single subnet, which we create using the ‘Microsoft.Network/virtualNetworks/subnets’ resource type. We also create a network security group using the ‘Microsoft.Network/networkSecurityGroups’ resource type, which provides a way to filter network traffic to and from our resources. Finally, we associate the network security group with the subnet using the ‘Microsoft.Network/virtualNetworks/subnets/networkSecurityGroupAssociations’ resource type.

At the end of the template, we define several outputs that can be used to retrieve the IDs of the created resources for use in subsequent deployments or scripts.

To deploy this template, you can use the Azure CLI command:

1

az deployment group create --name

I hope this was useful. Keep learning Azure Bicep and keep clouding around.

Vukasin Terzic