Merge pull request #234 from mbender-ms/avnm-update-create-mesh

Tests passed so merging. Update 101-virtual-network-manager-create-mesh
Azure · Jun 27, 2023 · ab98a8b · ab98a8b
2 parents eb55df5 + a966811
commit ab98a8b
Show file tree

Hide file tree

Showing 2 changed files with 57 additions and 8 deletions.
diff --git a/quickstart/101-virtual-network-manager-create-mesh/main.tf b/quickstart/101-virtual-network-manager-create-mesh/main.tf
@@ -11,9 +11,14 @@ resource "azurerm_resource_group" "rg" {
 }
 
 # Create three virtual networks
+resource "random_string" "prefix" {
+  length = 4
+  special = false
+  upper = false
+}
 
 resource "random_pet" "virtual_network_name" {
-  prefix = "vnet"
+  prefix = "vnet-${random_string.prefix.result}"
 }
 resource "azurerm_virtual_network" "vnet" {
   count = 3
@@ -58,14 +63,56 @@ resource "azurerm_network_manager_network_group" "network_group" {
   network_manager_id = azurerm_network_manager.network_manager_instance.id
 }
 
-# Add the three virtual networks to the network group as static members
+# Add three virtual networks to a network group as dynamic members with Azure Policy
 
-resource "azurerm_network_manager_static_member" "static_members" {
-  count = 3
+resource "random_pet" "network_group_policy_name" {
+  prefix = "network-group-policy"
+}
+
+resource "azurerm_policy_definition" "network_group_policy" {
+  name         = "${random_pet.network_group_policy_name.id}"
+  policy_type  = "Custom"
+  mode         = "Microsoft.Network.Data"
+  display_name = "Policy Definition for Network Group"
+
+  metadata = <<METADATA
+    {
+      "category": "Azure Virtual Network Manager"
+    }
+  METADATA
+
+  policy_rule = <<POLICY_RULE
+    {
+      "if": {
+        "allOf": [
+          {
+              "field": "type",
+              "equals": "Microsoft.Network/virtualNetworks"
+          },
+          {
+            "allOf": [
+              {
+              "field": "Name",
+              "contains": "${random_pet.virtual_network_name.id}"
+              }
+            ]
+          }
+        ]
+      },
+      "then": {
+        "effect": "addToNetworkGroup",
+        "details": {
+          "networkGroupId": "${azurerm_network_manager_network_group.network_group.id}"
+        }
+      }
+    }
+  POLICY_RULE
+}
 
-  name                      = "static-member-0${count.index}"
-  network_group_id          = azurerm_network_manager_network_group.network_group.id
-  target_virtual_network_id = azurerm_virtual_network.vnet[count.index].id
+resource "azurerm_subscription_policy_assignment" "azure_policy_assignment" {
+  name                 = "${random_pet.network_group_policy_name.id}-policy-assignment"
+  policy_definition_id = azurerm_policy_definition.network_group_policy.id
+  subscription_id      = data.azurerm_subscription.current.id
 }
 
 # Create a connectivity configuration

diff --git a/quickstart/101-virtual-network-manager-create-mesh/readme.md b/quickstart/101-virtual-network-manager-create-mesh/readme.md
@@ -5,12 +5,14 @@ This template deploys an Azure Virtual Network Manager instance with a connectiv
 ## Terraform resource types
 
 - [random_pet](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet)
+- [random_string](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string)
 - [azurerm_resource_group](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group)
 - [azurerm_virtual_network](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network)
 - [azurerm_subnet](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet)
 - [azurerm_virtual_network_manager](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_manager)
 - [azurerm_network_manager_network_group](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_manager_network_group)
-- [azurerm_network_manager_static_member](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_manager_static_member)
+- [azurerm_policy_definition](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/policy_definition)
+- [azurerm_subscription_policy_assignment](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subscription_policy_assignment)
 - [azurerm_network_manager_connectivity_configuration](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_manager_connectivity_configuration)
 - [azurerm_network_manager_deployment](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_manager_deployment)