Spoke Vnet peering with Vwan virtual hub

docs/wiki/CustomerUsage.md

@@ -44,4 +44,5 @@ The following are the unique ID's (also known as PIDs) used in each of the modul
 | subscriptionPlacement       | 3dfa9e81-f0cf-4b25-858e-167937fd380b |
 | virtualNetworkPeer          | ab8e3b12-b0fa-40aa-8630-e3f7699e2142 |
 | vwanConnectivity            | 7f94f23b-7a59-4a5c-9a8d-2a253a566f61 |
+| vnetPeeringVwan             | 7b5e6db2-1e8c-4b01-8eee-e1830073a63d |
 | hubSpoke - Orchestration    | 50ad3b1a-f72c-4de4-8293-8a6399991beb |

docs/wiki/DeploymentFlowVWAN.md

@@ -15,4 +15,4 @@ Modules in this reference implementation must be deployed in the following order
 | Order | Module                                 | Description                                                                                                                                                                                | Prerequisites                                                          | Module Documentation                                                                                                                                                  |
 | :---: | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 |   1   | Virtual WAN Connectivity                      | Deploys the Virtual WAN network topology and its components according to the Azure Landing Zone conceptual architecture.                                                                                          | Management Groups, Subscription for vWAN connectivity.                    | [infra-as-code/bicep/modules/vwanConnectivity](https://github.com/Azure/ALZ-Bicep/tree/main/infra-as-code/bicep/modules/vwanConnectivity)                             |
-|   2   | VNet Peering with vWAN                        | Connect a virtual network to a Virtual WAN hub.                                                                                          | Management Groups, Subscription for spoke VNet, vWAN Connectivity Module                    | _**Coming soon**_                            |
+|   2   | VNet Peering with vWAN                        | Connect a spoke virtual network to a Virtual WAN virtual hub.                                                                                          | Management Groups, Subscription for spoke VNet, vWAN Connectivity Module                    | [infra-as-code/bicep/modules/vnetPeeringVwan](https://github.com/Azure/ALZ-Bicep/tree/main/infra-as-code/bicep/modules/vnetPeeringVwan)                             |

infra-as-code/bicep/modules/vnetPeeringVwan/README.md

@@ -0,0 +1,96 @@
+# Module:  VNet Peering with vWAN
+
+This module is used to perform virtual network peering with the Virtual WAN virtual hub. This network topology is based on the Azure Landing Zone conceptual architecture which can be found [here](https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology) and the hub-spoke network topology with Virtual WAN [here](https://docs.microsoft.com/en-us/azure/architecture/networking/hub-spoke-vwan-architecture). Once peered, virtual networks exchange traffic by using the Azure backbone network. Virtual WAN enables transitivity among hubs which is not possible solely by using peering. This module draws parity with the Enterprise Scale implementation in the ARM template [here](https://github.com/Azure/Enterprise-Scale/blob/main/eslzArm/subscriptionTemplates/vnetPeeringVwan.json).
+
+Module deploys the following resources which can be configured by parameters:
+
+- Virtual network peering with Virtual WAN virtual hub
+
+## Parameters
+
+The module requires the following inputs:
+
+ | Parameter                    | Type   | Default                                                                                              | Description                                                                                                                                                                                                                                                         | Requirement                   | Example                      |
+ | ---------------------------- | ------ | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | ---------------------------- |
+ | parVirtualHubResourceId        | string | None                                               | Resource ID for Virtual WAN Hub.                                                                                                                                                                                          | 2-50 char                     | `/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/alz-vwan-eastus/providers/Microsoft.Network/virtualHubs/alz-vhub-eastus`              |
+| parRemoteVirtualNetworkResourceId        | string | None                                                 | Resource ID for remote spoke virtual network.                                                                                                                                                                                          | 2-50 char                     | `/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/alz-vwan-eastus/providers/Microsoft.Network/virtualNetworks/alz-spokevnet-westus`              |
+ | parTelemetryOptOut           | bool   | `false`                                                                                                | Set Parameter to true to Opt-out of deployment telemetry                                                                                                                                                                                                            | None                          | `false`                        |
+
+## Outputs
+
+The module will generate the following outputs:
+
+| Output                    | Type   | Example                                                                                                                                                                                                  |
+| ------------------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| outHubVirtualNetworkConnectionName | string | `alz-spokevnet-westus-vhc`                                                                                                                                                                                            |
+| outHubVirtualNetworkConnectionResourceId      | string | `/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/alz-vwan-eastus/providers/Microsoft.Network/virtualHubs/alz-vhub-eastus/hubVirtualNetworkConnections/alz-spokevnet-westus-vhc`                                                                                                                                                                                          |
+
+## Deployment
+
+In this example, the remote spoke Vnet will be peered with the Vwan Virtual Hub in the Connectivity subscription. During the deployment step, we will take parameters provided in the example parameters file.
+
+ | Azure Cloud    | Bicep template      | Input parameters file                    |
+ | -------------- | ------------------- | ---------------------------------------- |
+ | All  regions | vnetPeeringVwan.bicep | vnetPeeringVwan.parameters.example.json    |
+
+> For the examples below we assume you have downloaded or cloned the Git repo as-is and are in the root of the repository as your selected directory in your terminal of choice.
+
+### Azure CLI
+```bash
+# For Azure global regions
+# Set your Connectivity subscription ID as the the current subscription 
+$ConnectivitySubscriptionId="[your Connectivity subscription ID]"
+az account set --subscription $ConnectivitySubscriptionId
+
+az deployment sub create \
+   --template-file infra-as-code/bicep/modules/vnetPeeringVwan/vnetPeeringVwan.bicep \
+   --parameters @infra-as-code/bicep/modules/vnetPeeringVwan/vnetPeeringVwan.parameters.example.json \
+   --location eastus
+```
+OR
+```bash
+# For Azure China regions
+# Set your Corp Connected Landing Zone subscription ID as the the current subscription 
+$ConnectivitySubscriptionId="[your Connectivity subscription ID]"
+az account set --subscription $ConnectivitySubscriptionId
+
+az deployment sub create \
+   --template-file infra-as-code/bicep/modules/vnetPeeringVwan/vnetPeeringVwan.bicep \
+   --parameters @infra-as-code/bicep/modules/vnetPeeringVwan/vnetPeeringVwan.parameters.example.json \
+   --location chinaeast2
+```
+
+### PowerShell
+
+```powershell
+# For Azure global regions
+# Set your Connectivity subscription ID as the the current subscription 
+$ConnectivitySubscriptionId = "[your Connectivity subscription ID]"
+
+Select-AzSubscription -SubscriptionId $ConnectivitySubscriptionId
+
+New-AzDeployment `
+  -TemplateFile infra-as-code/bicep/modules/vnetPeeringVwan/vnetPeeringVwan.bicep `
+  -TemplateParameterFile infra-as-code/bicep/modules/vnetPeeringVwan/vnetPeeringVwan.parameters.example.json `
+  -Location 'eastus'
+```
+OR
+```powershell
+# For Azure China regions
+# Set your Connectivity subscription ID as the the current subscription 
+$ConnectivitySubscriptionId = "[your Connectivity subscription ID]"
+
+Select-AzSubscription -SubscriptionId $ConnectivitySubscriptionId
+
+New-AzDeployment `
+  -TemplateFile infra-as-code/bicep/modules/vnetPeeringVwan/vnetPeeringVwan.bicep `
+  -TemplateParameterFile infra-as-code/bicep/modules/vnetPeeringVwan/vnetPeeringVwan.parameters.example.json `
+  -Location 'chinaeast2'
+```
+## Example Output in Azure global regions
+
+![Example Deployment Output](media/vnetPeeringVwanExampleDeploymentOutput.png "Example Deployment Output in Azure global regions")
+
+## Bicep Visualizer
+
+![Bicep Visualizer](media/vnetPeeringVwanBicepVisualizer.png "Bicep Visualizer")

infra-as-code/bicep/modules/vnetPeeringVwan/bicepconfig.json

@@ -0,0 +1,64 @@
+{
+  "analyzers": {
+    "core": {
+      "enabled": true,
+      "verbose": true,
+      "rules": {
+        "adminusername-should-not-be-literal": {
+          "level": "error"
+        },
+        "no-hardcoded-env-urls": {
+          "level": "error"
+        },
+        "no-unnecessary-dependson": {
+          "level": "error"
+        },
+        "no-unused-params": {
+          "level": "error"
+        },
+        "no-unused-vars": {
+          "level": "error"
+        },
+        "outputs-should-not-contain-secrets": {
+          "level": "error"
+        },
+        "prefer-interpolation": {
+          "level": "error"
+        },
+        "secure-parameter-default": {
+          "level": "error"
+        },
+        "simplify-interpolation": {
+          "level": "error"
+        },
+        "protect-commandtoexecute-secrets": {
+          "level": "error"
+        },
+        "use-stable-vm-image": {
+          "level": "error"
+        },
+        "explicit-values-for-loc-params": {
+          "level": "error"
+        },
+        "no-hardcoded-location": {
+          "level": "error"
+        },
+        "no-loc-expr-outside-params": {
+          "level": "error"
+        },
+        "max-outputs": {
+          "level": "error"
+        },
+        "max-params": {
+          "level": "error"
+        },
+        "max-resources": {
+          "level": "error"
+        },
+        "max-variables": {
+          "level": "error"
+        }
+      }
+    }
+  }
+}

infra-as-code/bicep/modules/vnetPeeringVwan/hubVirtualNetworkConnection.bicep

@@ -0,0 +1,31 @@
+/*
+SUMMARY: Module to connect your spoke virtual network to your Virtual WAN virtual hub/ 
+DESCRIPTION: The following components will be options in this deployment
+              Virtual Hub network connection
+AUTHOR/S: faister, jtracey93
+VERSION: 1.0.2
+*/
+
+@description('Virtual WAN Hub resource ID. No default')
+param parVirtualHubResourceId string
+
+@description('Remote Spoke virtual network resource ID. No default')
+param parRemoteVirtualNetworkResourceId string
+
+var varVwanHubName = split(parVirtualHubResourceId, '/')[8]
+
+var varSpokeVnetName = split(parRemoteVirtualNetworkResourceId, '/')[8]
+
+var varVnetPeeringVwanName = '${varVwanHubName}/${varSpokeVnetName}-vhc'
+
+resource resVnetPeeringVwan 'Microsoft.Network/virtualHubs/hubVirtualNetworkConnections@2021-05-01' = if (!empty(parVirtualHubResourceId) && !empty(parRemoteVirtualNetworkResourceId)) {
+  name: varVnetPeeringVwanName
+  properties: {
+    remoteVirtualNetwork: {
+      id: parRemoteVirtualNetworkResourceId
+    }
+  }
+}
+
+output outHubVirtualNetworkConnectionName string = resVnetPeeringVwan.name
+output outHubVirtualNetworkConnectionResourceId string = resVnetPeeringVwan.id

infra-as-code/bicep/modules/vnetPeeringVwan/vnetPeeringVwan.bicep

@@ -0,0 +1,48 @@
+/*
+SUMMARY: Module to perform spoke network peering with the Virtual WAN virtual hub as per the Azure Landing Zone conceptual architecture - https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology. This module draws parity with the Enterprise Scale implementation defined in https://github.com/Azure/Enterprise-Scale/blob/main/eslzArm/subscriptionTemplates/vwan-connectivity.json
+DESCRIPTION: The peering can be configured using the parameters file:
+            Virtual network peering with Virtual WAN virtual hub
+AUTHOR/S: faister, jtracey93
+VERSION: 1.0.1
+*/
+
+targetScope = 'subscription'
+
+@description('Virtual WAN Hub resource ID. No default')
+param parVirtualHubResourceId string
+
+@description('Remote Spoke virtual network resource ID. No default')
+param parRemoteVirtualNetworkResourceId string
+
+@description('Set Parameter to true to Opt-out of deployment telemetry')
+param parTelemetryOptOut bool = false
+
+// Customer Usage Attribution Id
+var varCuaid = '7b5e6db2-1e8c-4b01-8eee-e1830073a63d'
+
+var varVwanSubscriptionId = split(parVirtualHubResourceId, '/')[2]
+
+var varVwanResourceGroup = split(parVirtualHubResourceId, '/')[4]
+
+var varSpokeVnetName = split(parRemoteVirtualNetworkResourceId, '/')[8]
+
+var varModhubVirtualNetworkConnectionDeploymentName = take('deploy-vnet-peering-vwan-${varSpokeVnetName}', 64)
+
+// The hubVirtualNetworkConnection resource is implemented as a separate module because the deployment scope could be on a different subscription and resource group
+module modhubVirtualNetworkConnection 'hubVirtualNetworkConnection.bicep' = if (!empty(parVirtualHubResourceId) && !empty(parRemoteVirtualNetworkResourceId)) {
+  scope: resourceGroup(varVwanSubscriptionId, varVwanResourceGroup)  
+  name: varModhubVirtualNetworkConnectionDeploymentName
+    params: {
+    parVirtualHubResourceId: parVirtualHubResourceId
+    parRemoteVirtualNetworkResourceId: parRemoteVirtualNetworkResourceId
+  }
+}
+
+// Optional Deployment for Customer Usage Attribution
+module modCustomerUsageAttribution '../../CRML/customerUsageAttribution/cuaIdSubscription.bicep' = if (!parTelemetryOptOut) {
+  name: 'pid-${varCuaid}-${uniqueString(subscription().id, varSpokeVnetName)}'
+  params: {}
+}
+
+output outHubVirtualNetworkConnectionName string = modhubVirtualNetworkConnection.outputs.outHubVirtualNetworkConnectionName
+output outHubVirtualNetworkConnectionResourceId string = modhubVirtualNetworkConnection.outputs.outHubVirtualNetworkConnectionResourceId

infra-as-code/bicep/modules/vnetPeeringVwan/vnetPeeringVwan.parameters.example.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "parVirtualHubResourceId": {
+      "value": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/alz-vwan-eastus/providers/Microsoft.Network/virtualHubs/alz-vhub-eastus"
+    },
+    "parRemoteVirtualNetworkResourceId": {
+      "value": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/remotevnet-rg/providers/Microsoft.Network/virtualNetworks/vnet-spoke"
+    },
+    "parTelemetryOptOut": {
+      "value": false
+    }
+  }
+}