$ show Azure/Enterprise-Scale
This repository is the Azure Enterprise-Scale (ALZ) reference implementation, providing infrastructure-as-code artifacts to deploy and govern multi-subscription Azure environments. It is not a runtime application but a deployment toolkit consisting of ARM templates, Bicep files, custom Azure Policy definitions/initiatives, custom role definitions, and PowerShell automation. The architecture follows the Cloud Adoption Framework's landing zone design, with a management group hierarchy, policy-driven governance, and modular networking topologies (hub-spoke, Virtual WAN). Key entry points include the main ARM deployment template (`eslzArm/eslzArm.json`), the portal accelerator (`eslzArm/eslz-portal.json`), and the Bicep-based policy compilation (`src/templates/policies.bicep`). Data flows are primarily declarative: policy definitions and assignments are deployed to management groups, which then enforce compliance on subscriptions and resources. External dependencies are entirely Azure-native: Azure Resource Manager, Azure Policy, Azure RBAC, and Azure networking services. The repository also includes a PowerShell module (`Alz.Tools`) for subscription alias creation, orphaned RBAC cleanup, and artifact conversion, plus a Pester-based test framework for policy validation.
The LLM identified 4 files worth highlighting for reuse:
A well-crafted custom Azure Policy definition that denies creation of network security group rules allowing inbound management ports (RDP, SSH, WinRM, etc.) from the internet. It uses a complex policy rule with aliases, field conditions, and array operations to detect and block non-compliant configurations. This policy is self-contained, parameterized (effect, excluded ports), and can be reused in any Azure environment to enforce a security baseline.
A reusable PowerShell module providing helper functions for testing Azure Policy compliance. Includes `Complete-PolicyComplianceScan`, `Complete-PolicyRemediation`, and `Get-PolicyComplianceState` with retry logic and error handling. It abstracts the Azure REST API calls and can be extracted into any project that needs to validate policy enforcement in a test environment.
A Bicep template that programmatically loads all policy set definitions from JSON files, filters by cloud environment (AzureCloud, AzureChinaCloud, AzureUSGovernment), and deploys them as resources. It uses `loadTextContent` and string replacement to inject the actual management group scope, avoiding hardcoded placeholders. This pattern is reusable for any project that needs to deploy a large catalog of Azure Policy initiatives across multiple clouds.
Core PowerShell functions for processing ARM templates and converting them to different formats (Raw, Terraform, Bicep). Includes `ProcessFile`, `ConvertTo-ArmTemplateResource`, and `Export-LibraryArtifact` with ARM expression escaping/unescaping. This module is self-contained and can be reused in any infrastructure-as-code pipeline that needs to transform ARM templates for multi-tool support.