use Bicep loop syntax to create spoke resources the same way (Azure#497)

ARPA-H · Nov 3, 2021 · 11400f2 · 11400f2
1 parent 7872e2a
commit 11400f2
Show file tree

Hide file tree

Showing 10 changed files with 652 additions and 3,528 deletions.
diff --git a/src/bicep/README.md b/src/bicep/README.md
@@ -27,6 +27,10 @@ By default, this template deploys **[Azure Firewall Premium](https://docs.micros
 - See [Setting the Firewall SKU](#Setting-the-Firewall-SKU) for steps on how to use the Standard SKU instead.
 - See [Setting the Firewall Location](#Setting-the-Firewall-Location) for steps on how to deploy into a different region.
 
+After a deployment is complete, you can refer to the provisioned resources programmaticaly with the Azure CLI.
+
+- See [Reference Deployment Output](#Reference-Deployment-Output) for steps on how to use `az deployment` subcommands and JMESPath to query for specific properties.
+
 ### Azure CLI
 
 Use `az deployment sub` to deploy MLZ across 1:M subscriptions (and `az deployment sub create --help` for more information).
@@ -246,6 +250,88 @@ az deployment sub create \
   --template-file "src/bicep/mlz.bicep"
 ```
 
+### Reference Deployment Output
+
+After you've deployed Mission Landing Zone you'll probably want to integrate additional services or infrastructure.
+
+You can use the `az deployment sub show` command with a `--query` argument to retrieve information about the resources you deployed.
+
+Before giving the next steps a try, it's probably a good idea to [review the Azure CLI's documentation on querying with JMESPath](https://docs.microsoft.com/en-us/cli/azure/query-azure-cli).
+
+First off, let's say you deployed Mission Landing Zone with a deployment name of `myMissionLandingZone`:
+
+```plaintext
+az deployment sub create \
+  --name "myMissionLandingZone" \
+  --location "East US" \
+  --template-file "src/bicep/mlz.bicep"
+```
+
+Once it's complete, you could see all the resources provisioned in that deployment by querying the `properties.outputResources` property:
+
+```plaintext
+az deployment sub show \
+  --name "myMissionLandingZone" \
+  --query "properties.outputResources"
+```
+
+That's a lot of resources. Thankfully, the template produces outputs for just the things you _probably_ need at `properties.outputs`:
+
+```plaintext
+az deployment sub show \
+  --name "myMissionLandingZone" \
+  --query "properties.outputs"
+```
+
+For example, if you need just the Firewall Private IP address you could retrieve it like this:
+
+```plaintext
+az deployment sub show \
+  --name "myMissionLandingZone" \
+  --query "properties.outputs.firewallPrivateIPAddress.value"
+```
+
+Or, if you need just the Log Analytics Workspace that performs central logging you could retrieve it like this:
+
+```plaintext
+az deployment sub show \
+  --name "myMissionLandingZone" \
+  --query "properties.outputs.logAnalyticsWorkspaceResourceId.value"
+```
+
+Or, say you wanted to deploy resources into the Identity spoke. You could retrieve information about the Identity spoke by querying it from the `properties.outputs.spokes` array like this:
+
+```plaintext
+az deployment sub show \
+  --name "myMissionLandingZone" \
+  --query "properties.outputs.spokes.value[?name=='identity']"
+```
+
+Which would return an output similar to:
+
+```json
+[
+  {
+    "name": "identity",
+    "networkSecurityGroupName": "identity-nsg",
+    "networkSecurityGroupResourceId": ".../providers/Microsoft.Network/networkSecurityGroups/identity-nsg",
+    "resourceGroupId": ".../resourceGroups/mlz-identity",
+    "resourceGroupName": "mlz-identity",
+    "subnetAddressPrefix": "10.0.110.0/27",
+    "subnetName": "identity-subnet",
+    "subscriptionId": "<A GUID>",
+    "virtualNetworkName": "identity-vnet",
+    "virtualNetworkResourceId": ".../providers/Microsoft.Network/virtualNetworks/identity-vnet"
+  }
+]
+```
+
+Bicep templates, the Azure CLI, and JMESpath queries allows you to manually, or in an automated fashion, compose infrastructure incrementally and pass output from one template as input to another.
+
+Read more about `az deployment` at: [https://docs.microsoft.com](https://docs.microsoft.com/en-us/cli/azure/deployment?view=azure-cli-latest)
+
+Read more about JMESPath queries at: <https://jmespath.org/>
+
 ## Development Pre-requisites
 
 If you want to develop with Bicep you'll need these:

diff --git a/src/bicep/examples/newWorkload/README.md b/src/bicep/examples/newWorkload/README.md
@@ -48,46 +48,29 @@ az deployment sub show \
 
 ```plaintext
 {
-  "hubSubscriptionId": {
-    "type": "String",
-    "value": "0987654-3210..."
-  },
-  ...
-  "hubResourceGroupName": {
-    "type": "String",
-    "value": "mlz-dev-hub"
-  },
-  ...
-  "hubVirtualNetworkName": {
+  "firewallPrivateIPAddress": {
     "type": "String",
-    "value": "hub-vnet"
+    "value": "10.0.100.4"
   },
-  ...
-  "hubVirtualNetworkId": {
-    "type": "String",
-    "value": "/subscriptions/.../providers/Microsoft.Network/virtualNetworks/hub-vnet"
+  "hub": {
+    "type": "Object",
+    "value": {
+      ...
+      "resourceGroupName": "mlz-dev-hub",
+      ...
+      "subscriptionId": "...",
+      "virtualNetworkName": "hub-vnet",
+      "virtualNetworkResourceId": "/subscriptions/.../providers/Microsoft.Network/virtualNetworks/hub-vnet"
+    }
   },
-  ...
   "logAnalyticsWorkspaceResourceId": {
     "type": "String",
     "value": "/subscriptions/.../providers/Microsoft.OperationalInsights/workspaces/mlz-dev-laws"
   },
   ...
-  "firewallPrivateIPAddress": {
-    "type": "String",
-    "value": "10.0.100.4"
-  },
 }
 ```
 
-...and if you're on a BASH terminal, this command (take note to replace "myMlzDeployment" with your deployment name) will export the values as environment variables:
-
-<!-- markdownlint-disable MD013 -->
-```bash
-export $(az deployment sub show --name "myMlzDeployment" --query "properties.outputs.{ args: [ join('', ['hubSubscriptionId=', hubSubscriptionId.value]), join('', ['hubResourceGroupName=', hubResourceGroupName.value]), join('', ['hubVirtualNetworkName=', hubVirtualNetworkName.value]), join('', ['hubVirtualNetworkResourceId=', hubVirtualNetworkResourceId.value]), join('', ['logAnalyticsWorkspaceResourceId=', logAnalyticsWorkspaceResourceId.value]), join('', ['firewallPrivateIPAddress=', firewallPrivateIPAddress.value]) ] }.args" --output tsv | xargs)
-```
-<!-- markdownlint-enable MD013 -->
-
 ## Deploy the example
 
 Once you have the Mission LZ output values, you can pass those in as parameters to this deployment.

diff --git a/src/bicep/examples/remoteAccess/README.md b/src/bicep/examples/remoteAccess/README.md
@@ -55,41 +55,27 @@ az deployment sub show \
 ```plaintext
 {
   ...
-  "hubResourceGroupName": {
-    "type": "String",
-    "value": "mlz-dev-hub"
-  },
-  ...
-  "hubVirtualNetworkName": {
-    "type": "String",
-    "value": "hub-vnet"
-  },
-  ...
-  "hubSubnetResourceId": {
-    "type": "String",
-    "value": "/subscriptions/.../providers/Microsoft.Network/virtualNetworks/hub-vnet/subnets/hub-subnet"
-  },
-  ...
-  "hubNetworkSecurityGroupResourceId": {
-    "type": "String",
-    "value": "/subscriptions/.../providers/Microsoft.Network/networkSecurityGroups/hub-nsg"
+  "hub": {
+    "type": "Object",
+    "value": {
+      ...
+      "resourceGroupName": "mlz-dev-hub",
+      ...
+      "networkSecurityGroupResourceId": "/subscriptions/.../providers/Microsoft.Network/networkSecurityGroups/hub-nsg
+      ...
+      "subnetResourceId": "/subscriptions/.../providers/Microsoft.Network/virtualNetworks/hub-vnet/subnets/hub-subnet",
+      ...
+      "virtualNetworkName": "hub-vnet"
+    }
   },
-  ...
   "logAnalyticsWorkspaceResourceId": {
     "type": "String",
     "value": "/subscriptions/.../providers/Microsoft.OperationalInsights/workspaces/mlz-dev-laws"
   },
+  ...
 }
 ```
 
-...and if you're on a BASH terminal, this command (take note to replace "myMlzDeployment" with your deployment name) will export the values as environment variables:
-
-<!-- markdownlint-disable MD013 -->
-```bash
-export $(az deployment sub show --name "myMlzDeployment" --query "properties.outputs.{ args: [ join('', ['hubResourceGroupName=', hubResourceGroupName.value]), join('', ['hubVirtualNetworkName=', hubVirtualNetworkName.value]), join('', ['hubSubnetResourceId=', hubSubnetResourceId.value]), join('', ['hubNetworkSecurityGroupResourceId=', hubNetworkSecurityGroupResourceId.value]), join('', ['logAnalyticsWorkspaceResourceId=', logAnalyticsWorkspaceResourceId.value]) ] }.args" --output tsv | xargs)
-```
-<!-- markdownlint-enable MD013 -->
-
 ## Deploy the example
 
 Once you have the Mission LZ output values, you can pass those in as parameters to this deployment.