### Start Hugo server with make

Source: https://github.com/azure/azure-landing-zones/blob/main/DEVELOPER.md

Starts a local HTTP server for the documentation using GNU make. Requires Hugo to be installed.

```bash
make server
```

--------------------------------

### Start Interactive Accelerator Wizard

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/accelerator/2_bootstrap/_index.md

Launches the interactive wizard for the ALZ accelerator. This command should be run without any parameters to initiate the guided configuration process.

```powershell
Deploy-Accelerator
```

--------------------------------

### Example Configuration YAML

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/terraform/migration/managementgroups.md

An example configuration file for migrating management groups. Update the 'alz' value to your top-level management group ID.

```yaml
managementGroupIDs:
# ALZ Root Management Group ID
- "alz"
```

--------------------------------

### Install Dependencies and Build Assets

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/themes/hugo-geekdoc/README.md

Install npm packages and run the build script to create required assets for the theme. This is necessary if you want to use the theme from a cloned branch instead of a release tarball.

```shell
# install required packages from package.json
npm install
```

```shell
# run the build script to build required assets
npm run build
```

```shell
# build release tarball
npm run pack
```

--------------------------------

### Start Hugo server manually

Source: https://github.com/azure/azure-landing-zones/blob/main/DEVELOPER.md

Starts a local HTTP server for the documentation by navigating to the docs directory and running the hugo server command. This can be used on Linux or Windows.

```bash
cd docs
hugo server
```

--------------------------------

### Download Configuration File

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/terraform/migration/managementgroups.md

Downloads the example ALZ management group configuration file from GitHub.

```powershell
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/Azure/terraform-state-importer/refs/heads/main/.config/alz.management-groups.config.yaml" -OutFile "config.yaml"
```

--------------------------------

### Download Virtual WAN Configuration

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/terraform/migration/resources.md

Downloads the example configuration file for a Virtual WAN network topology from the terraform-state-importer GitHub repository.

```powershell
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/Azure/terraform-state-importer/refs/heads/main/.config/alz.connectivity.virtual-wan.config.yaml" -OutFile "config.yaml"
```

--------------------------------

### Int-Root Management Group Configuration

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/bicep/howtos/modifyingMgHierarchy.md

Example configuration for the tenant root management group (int-root).

```bicep
param intRootConfig = {
  createOrUpdateManagementGroup: true
  managementGroupName: 'alz'
  managementGroupParentId: ''  // Empty means tenant root
  managementGroupDisplayName: 'Azure landing zone'
  managementGroupDoNotEnforcePolicyAssignments: []
  managementGroupExcludedPolicyAssignments: []
  // ... other properties
}
```

--------------------------------

### Download Hub and Spoke Configuration

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/terraform/migration/resources.md

Downloads the example configuration file for a Hub and Spoke network topology from the terraform-state-importer GitHub repository.

```powershell
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/Azure/terraform-state-importer/refs/heads/main/.config/alz.connectivity.hub-and-spoke.config.yaml" -OutFile "config.yaml"
```

--------------------------------

### Install Hugo using winget

Source: https://github.com/azure/azure-landing-zones/blob/main/DEVELOPER.md

Installs a specific version of Hugo Extended using the Windows Package Manager.

```pwsh
winget install Hugo.Hugo.Extended -v 0.136.5
```

--------------------------------

### Bicep Platform Landing Zone Configuration

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/accelerator/2_bootstrap/_index.md

Example configuration for a Bicep platform landing zone. Update 'starter_locations' with valid Azure regions for your deployment.

```bicep
starter_locations: <region-#>
```

--------------------------------

### Update Subscription IDs in Config File

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/terraform/migration/resources.md

This is an example of the config.yaml file structure. You must replace the placeholder subscription IDs with your actual management and connectivity subscription IDs.

```yaml
subscriptionIDs:
# Connectivity subscription ID
- "00000000-0000-0000-0000-000000000000"
# Management Subscription ID
- "00000000-0000-0000-0000-000000000000"
```

--------------------------------

### Combined Policy Initiative Example

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/terraform/custom-policy/policy-initiative.md

This snippet shows a policy definition within a policy initiative that references a built-in policy for allowed locations. It demonstrates how to configure parameters for the referenced policy.

```json
      "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c",
      "policyDefinitionReferenceId": "Allowed-Locations",
      "groupNames": ["ResourceRestrictions"],
      "parameters": {
        "listOfAllowedLocations": {
          "value": "[parameters('allowedLocations')]"
        }
      }
    }
  ]
}
}
```

--------------------------------

### Build Policy, Initiative, and Role Templates with Bicep

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/whats-new/_index.md

Contributors must run these Bicep build commands to generate policy, initiative, and role templates after committing changes to the `src` folder. Ensure Bicep is installed.

```bash
bicep build ./src/templates/policies.bicep --outfile ./eslzArm/managementGroupTemplates/policyDefinitions/policies.json
```

```bash
bicep build ./src/templates/initiatives.bicep --outfile ./eslzArm/managementGroupTemplates/policyDefinitions/initiatives.json
```

```bash
bicep build ./src/templates/roles.bicep --outfile ./eslzArm/managementGroupTemplates/roleDefinitions/customRoleDefinitions.json
```

--------------------------------

### Reusing the Same Policy Multiple Times in an Initiative

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/terraform/custom-policy/policy-initiative.md

This example shows how to include the same policy definition multiple times within a single initiative, each with a unique `policyDefinitionReferenceId` and potentially different parameters. This allows for flexible configuration of policies.

```json
"policyDefinitions": [
  {
    "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/871b6d14-10aa-478d-b590-94f262ecfa99",
    "policyDefinitionReferenceId": "Require-Environment-Tag",
    "parameters": {
      "tagName": { "value": "Environment" }
    }
  },
  {
    "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/871b6d14-10aa-478d-b590-94f262ecfa99",
    "policyDefinitionReferenceId": "Require-Owner-Tag",
    "parameters": {
      "tagName": { "value": "Owner" }
    }
  }
]
```

--------------------------------

### Complete ALZ Library Structure

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/terraform/custom-policy/policy-initiative.md

An example of the complete directory structure for an Azure Landing Zones library after creating initiatives and related definitions. This outlines the organization of metadata, definitions, assignments, and policies.

```text
lib/
├── alz_library_metadata.json
├── architecture_definitions/
│   └── alz.alz_architecture_definition.yaml
├── archetype_definitions/
│   └── root_override.alz_archetype_override.yaml
├── policy_assignments/
│   └── Enforce-Governance-Standards.alz_policy_assignment.json
├── policy_definitions/
│   └── Deny-Resource-Types.alz_policy_definition.json
└── policy_set_definitions/
    └── Enforce-Governance-Standards.alz_policy_set_definition.json
```

--------------------------------

### GitHub Actions CI Workflow Example

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/bicep/howtos/modifyingPolicyAssets.md

This YAML snippet outlines a GitHub Actions workflow for Continuous Integration in Azure Landing Zones. It triggers on pull requests to the main branch and defines necessary permissions.

```yaml
# Workflow: 01 Azure landing zone Continuous Integration
# Triggered on: Pull Request to main branch
# Permissions: id-token (write), contents (read), pull-requests (write)
```

--------------------------------

### Handle Parameter Changes in Module Updates

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/bicep/howtos/update.md

Illustrates how parameter names can change between module versions. The example shows an old parameter name 'vnetName' being replaced by a new name 'name' in a subsequent module version.

```bicep
// Old module version
module network 'br/public:avm/res/network/virtual-network:0.1.0' = {
  params: {
    vnetName: 'hub-vnet'  // Old parameter name
  }
}

// New module version
module network 'br/public:avm/res/network/virtual-network:0.2.0' = {
  params: {
    name: 'hub-vnet'  // New parameter name
  }
}
```

--------------------------------

### Terraform Platform Landing Zone Configuration

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/accelerator/2_bootstrap/_index.md

Example configuration for a Terraform platform landing zone. Ensure 'starter_locations' are updated with valid Azure regions and 'defender_email_security_contact' is set for Defender for Cloud alerts.

```terraform
starter_locations: <region-#>
defender_email_security_contact: (Terraform only)
```

--------------------------------

### Azure DevOps Pipelines CI Configuration Example

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/bicep/howtos/modifyingPolicyAssets.md

This YAML snippet shows a basic configuration for an Azure DevOps Pipeline used for Continuous Integration in Azure Landing Zones. It specifies the pipeline name, trigger, and stages.

```yaml
# Pipeline: ALZ-Bicep-CI
# Triggered on: Pull Request to main branch
# Stages: Validate, WhatIf
```

--------------------------------

### Install or Update ALZ PowerShell Module

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/accelerator/2_bootstrap/advanced.md

Ensures the ALZ PowerShell module is installed or updated to the latest version. This is a prerequisite for running bootstrap commands.

```powershell
$alzModule = Get-InstalledPSResource -Name ALZ 2>$null
if (-not $alzModule) {
    Install-PSResource -Name ALZ
} else {
    Update-PSResource -Name ALZ
}

```

--------------------------------

### Install or Update ALZ PowerShell Module

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/accelerator/2_bootstrap/_index.md

Installs the ALZ PowerShell module if not already present, or updates it to the latest version. This is a prerequisite for running the accelerator.

```powershell
$alzModule = Get-InstalledPSResource -Name ALZ 2>$null
if (-not $alzModule) {
    Install-PSResource -Name ALZ
} else {
    Update-PSResource -Name ALZ
}
```

--------------------------------

### Create and Navigate to Migration Directory

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/terraform/migration/resources.md

Use these PowerShell commands to create a new directory for migration tooling and navigate into it.

```powershell
New-Item -ItemType Directory "~/alz-migration"
Set-Location -Path "~/alz-migration"
```

--------------------------------

### Example: Set Enforcement Mode for DDOS Protection

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/accelerator/starter-terraform/options/policy-enforcement.md

This example demonstrates how to set the enforcement mode of the 'Enable-DDoS-VNET' policy assignment to 'DoNotEnforce' for the 'connectivity' management group within the `policy_assignments_to_modify` block.

```terraform
management_group_settings = {
  ... 
  policy_assignments_to_modify = {
    "connectivity" = {
      policy_assignments = {
        "Enable-DDoS-VNET" = {
          enforcement_mode = "DoNotEnforce"
        }
      }
    }
  }
}
```

--------------------------------

### Login to Azure CLI

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/accelerator/1_prerequisites/root-access.md

Log in to Azure CLI and select your tenant. Replace `<tenant-id>` with your actual tenant ID.

```pwsh
az login --tenant "<tenant-id>" --use-device-code
```

--------------------------------

### Custom Policy Metadata Versioning

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/policy/policyCustom.md

Example of metadata section for a custom policy or initiative, including versioning information.

```json
{
"metadata": {
   "version": "1.0.0",
   "category": "{categoryName}",
   "source": "https://github.com/Azure/Enterprise-Scale/",
   "alzCloudEnvironments": [
      "AzureCloud",
      "AzureChinaCloud",
      "AzureUSGovernment"
   ]
}
}
```

--------------------------------

### Copy Platform Landing Zone Module Files

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/accelerator/starter-terraform/upgrade-guide.md

Copy the latest platform landing zone .tf files and modules from the cloned accelerator repository to your local module folder.

```powershell
$pathToMyModuleFolder = "~/code/my-module-folder"
$pathToLatestModuleFolder = "~/code/alz-terraform-accelerator/templates/platform_landing_zone"

Copy-Item -Path "$pathToLatestModuleFolder/*.tf" -Destination "$pathToMyModuleFolder" -Force
Copy-Item -Path "$pathToLatestModuleFolder/modules/*" -Destination "$pathToMyModuleFolder/modules" -Recurse -Force
```

--------------------------------

### Run Terraform State Importer for Initial Import

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/terraform/migration/resources.md

Execute the terraform-state-importer tool to perform the initial import of resources. This command generates `imports.tf` and `destroy.tf` files in the specified Terraform module path.

```powershell
./terraform-state-importer.exe run \
    --config "~/alz-migration/config.yaml" \
    --terraformModulePath "~/alz-migration-terraform-module" \
    --workingFolderPath "~/alz-migration" \
    --issuesCsv "~/resolved-issues.csv"
```

--------------------------------

### Modify Policy Assignments in Terraform

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/terraform/gettingStarted.md

Use the `policy_assignments_to_modify` variable to disable specific policy assignments. This example shows how to set the enforcement mode to 'DoNotEnforce' for a policy assignment.

```terraform
module "alz" {
  source  = "Azure/avm-ptn-alz/azurerm"
  version = "~> 0.10"

  # other variable inputs...

  policy_assignments_to_modify = {
    management_group_id = {
      "Policy-Assignment-Name" = {
        enforcement_mode = "DoNotEnforce"
      }
    }
  }
}
```

--------------------------------

### Assign Built-in Initiative for Allowed Locations

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/terraform/custom-policy/policy-assignment.md

This JSON example assigns the built-in 'Allowed locations' initiative to restrict resource deployment regions. For initiatives, use `policySetDefinitions` in the `policyDefinitionId`.

```json
{
  "type": "Microsoft.Authorization/policyAssignments",
  "apiVersion": "2024-04-01",
  "name": "Allowed-Locations",
  "dependsOn": [],
  "properties": {
    "displayName": "Allowed locations for resource deployment",
    "description": "This initiative restricts the locations where resources can be deployed to enforce data residency requirements.",
    "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c",
    "enforcementMode": "Default",
    "nonComplianceMessages": [
      {
        "message": "Resources must be deployed to an approved location."
      }
    ],
    "parameters": {
      "listOfAllowedLocations": {
        "value": [
          "eastus",
          "eastus2",
          "westus2",
          "westeurope",
          "northeurope"
        ]
      }
    },
    "scope": "/providers/Microsoft.Management/managementGroups/placeholder",
    "notScopes": []
  },
  "location": "${default_location}"
}
```

--------------------------------

### Connect to Azure using PowerShell

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/accelerator/3_run.md

Log in to Azure using PowerShell. Ensure you replace the placeholder TenantId and SubscriptionId with your actual values.

```powershell
Connect-AzAccount -TenantId 00000000-0000-0000-0000-000000000000 -SubscriptionId 00000000-0000-0000-0000-000000000000
```

--------------------------------

### Example Override Archetype YAML

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/terraform/howtos/modifyingPolicyAssets.md

This YAML defines an override archetype to modify existing policy assignments and definitions. It specifies policies to remove and can be extended to add new ones.

```yaml
name: "landing_zones_override"
base_archetype: "landing_zones"
policy_assignments_to_add: []
policy_assignments_to_remove:
  - "Deny-IP-forwarding"
policy_definitions_to_add: []
policy_definitions_to_remove: []
policy_set_definitions_to_add: []
policy_set_definitions_to_remove: []
role_definitions_to_add: []
role_definitions_to_remove: []
```

--------------------------------

### Login to Azure CLI

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/accelerator/2_bootstrap/advanced.md

Logs into the Azure CLI and sets the target subscription for the bootstrap process. Replace placeholders with your actual tenant and subscription IDs.

```powershell
az login --tenant "<tenant-id>" --use-device-code
az account set --subscription "<bootstrap-subscription-id>"

```

--------------------------------

### Setup Az Context and Assign Policy

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/policy/policyTesting.md

Sets the Azure context and assigns a policy to a management group scope with specific parameters. This is part of the BeforeAll section for Pester tests.

```powershell
        # Set the default context for Az commands.
        Set-AzContext -SubscriptionId $env:SUBSCRIPTION_ID -TenantId $env:TENANT_ID -Force

        if (-not [String]::IsNullOrEmpty($DeploymentConfigPath)) {
            Write-Information "==> Loading deployment configuration from : $DeploymentConfigPath"
            $deploymentObject = Get-Content -Path $DeploymentConfigPath | ConvertFrom-Json -AsHashTable

            # Set the esCompanyPrefix from the deployment configuration if not specified
            $esCompanyPrefix = $deploymentObject.TemplateParameterObject.enterpriseScaleCompanyPrefix
            $mangementGroupScope = "/providers/Microsoft.Management/managementGroups/$esCompanyPrefix-corp"
        }

        $definition = Get-AzPolicyDefinition | Where-Object { $_.Name -eq 'Deny-MgmtPorts-From-Internet' }
        New-AzPolicyAssignment -Name "TDeny-MgmtPorts-Internet" -Scope $mangementGroupScope 
            -PolicyDefinition $definition -PolicyParameterObject @{"ports" = @("3389", "22")
        }
```

--------------------------------

### Configure Resource Group Provisioning

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/sub-vending/tf/upgrades.md

Enable resource group creation and define new resource group objects in the `resource_groups` map. Set `resource_group_creation_enabled` to `true` to activate this functionality.

```hcl
resource_group_creation_enabled = true
resource_groups = {
  vnetrg = {
    name         = local.network_rg
    location     = var.location
    lock_enabled = true
    lock_name    = "lock-network-${local.component_name}-01"
  }
  mainrg = {
    name     = local.application_rg
    location = var.location
  }
  identityrg = {
    name         = local.identity_rg
    location     = var.location
    lock_enabled = true
    lock_name    = "lock-umi-${local.component_name}-plan-01"
  }
}
```

--------------------------------

### Create Customer Directory Structure with PowerShell

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/bicep/howtos/modifyingPolicyAssets.md

This PowerShell script demonstrates how to create the necessary directory structure for custom policy assets within the Azure Landing Zones accelerator. It includes creating a base customer directory and optional subdirectories for different scopes.

```powershell
# Create customer directory structure
New-Item -Path "templates\core\governance\lib\customer" -ItemType Directory -Force

# Create subdirectories for different scopes (optional)
New-Item -Path "templates\core\governance\lib\customer\platform" -ItemType Directory -Force
New-Item -Path "templates\core\governance\lib\customer\landingzones" -ItemType Directory -Force
```

--------------------------------

### Update Block Setting in Terraform Configuration

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/accelerator/starter-terraform/options/_index.md

Example of a block setting in a Terraform configuration file, used for policy assignments. This format is denoted by `<key> = { <value> }` and spans multiple lines.

```terraform
ddos = {
  name     = "$${ddos_resource_group_name}"
  location = "$${starter_location_01}"
}
```

--------------------------------

### Run Terraform State Importer

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/terraform/migration/resources.md

Execute the terraform-state-importer tool to generate an initial list of migration issues. Ensure the configuration, module path, and working directory are correctly specified.

```powershell
./terraform-state-importer.exe run \
    --config "~/alz-migration/config.yaml" \
    --terraformModulePath "~/alz-migration-terraform-module" \
    --workingFolderPath "~/alz-migration"
```

--------------------------------

### Deprecated Policy Snippet Example

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/policy/policyCustom.md

Illustrates the metadata and properties of a deprecated policy, including the '[Deprecated]' prefix in the display name, updated description with a superseding link, and 'deprecated' and 'supersededBy' metadata properties.

```json
   "policyType": "Custom",
   "mode": "Indexed",
   "displayName": "[Deprecated]: Deploy SQL Database vulnerability Assessments",
   "description": "Deploy SQL Database vulnerability Assessments when it not exist in the deployment. Superseded by https://www.azadvertizer.net/azpolicyadvertizer/Deploy-Sql-vulnerabilityAssessments_20230706.html",
   "metadata": {
      "version": "1.0.1-deprecated",
      "category": "SQL",
      "source": "https://github.com/Azure/Enterprise-Scale/",
      "deprecated": true,
      "supersededBy": "Deploy-Sql-vulnerabilityAssessments_20230706",
      "alzCloudEnvironments": [
         "AzureCloud",
         "AzureChinaCloud",
         "AzureUSGovernment"
      ]
   }
```

--------------------------------

### Remove Specific Policy Assignment

Source: https://github.com/azure/azure-landing-zones/blob/main/docs/content/accelerator/starter-terraform/options/policy-assignment.md

Example of an `alz_archetype_override.yaml` file configured to remove the `Enable-DDoS-VNET` policy assignment from the `landing_zones` management group archetype. Add the desired assignment names to the `policy_assignments_to_remove` list.

```yaml
base_archetype: landing_zones
name: landing_zones_custom
policy_assignments_to_add: []
policy_assignments_to_remove:
  - Enable-DDoS-VNET
policy_definitions_to_add: []
policy_definitions_to_remove: []
policy_set_definitions_to_add: []
policy_set_definitions_to_remove: []
role_definitions_to_add: []
role_definitions_to_remove: []
```