sample-workflow.yml

name: Deploy ALZ Monitor policies

on:
  workflow_dispatch: {}

permissions:
      id-token: write
      contents: read

env:
  Location: "norwayeast"
  ManagementGroupPrefix: "alz"
  identityManagementGroup: "alz-platform-identity"
  managementManagementGroup: "alz-platform-management"
  connectivityManagementGroup: "alz-platform-connectivity"
  LZManagementGroup: "alz-landing-zone"
  
jobs:
  deploy_job:
    runs-on: ubuntu-latest
    environment: deploy

    steps:
    - name: Checkout Repo
      uses: actions/checkout@v2
      with:
        fetch-depth: 0

    - name: 'Az CLI login'
      uses: azure/login@v1
      with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          enable-AzPSSession: true

    - name: Az CLI Deploy Monitor Policy Definitions
      id: create_monitor_policy_defs
      shell: bash
      run: |
          az deployment mg create --template-file infra-as-code/bicep/deploy_dine_policies.bicep --location ${{ env.Location }} --management-group-id ${{ env.ManagementGroupPrefix }}

    - name: Az CLI Deploy Monitor Policy Initiative Definitions
      id: create_monitor_policy_initiative_defs
      shell: bash
      run: |
          az deployment mg create --template-file ./src/resources/Microsoft.Authorization/policySetDefinitions/ALZ-MonitorConnectivity.json --location ${{ env.Location }} --management-group-id ${{ env.ManagementGroupPrefix }}
          az deployment mg create --template-file ./src/resources/Microsoft.Authorization/policySetDefinitions/ALZ-MonitorIdentity.json --location ${{ env.Location }} --management-group-id ${{ env.ManagementGroupPrefix }}
          az deployment mg create --template-file ./src/resources/Microsoft.Authorization/policySetDefinitions/ALZ-MonitorManagement.json --location ${{ env.Location }} --management-group-id ${{ env.ManagementGroupPrefix }}
          az deployment mg create --template-file ./src/resources/Microsoft.Authorization/policySetDefinitions/ALZ-MonitorLandingZone.json --location ${{ env.Location }} --management-group-id ${{ env.ManagementGroupPrefix }}
          az deployment mg create --template-file ./src/resources/Microsoft.Authorization/policySetDefinitions/ALZ-MonitorServiceHealth.json --location ${{ env.Location }} --management-group-id ${{ env.ManagementGroupPrefix }}
    
    - name: Az CLI Monitor Policy initiative assignments
      id: assign_monitor_policy_initiatives
      shell: bash
      run: |
            az deployment mg create --template-file ./infra-as-code/bicep/assign_initiatives_identity.bicep --location ${{ env.Location }} --management-group-id ${{ env.identityManagementGroup }} --parameters ./infra-as-code/bicep/parameters-complete-identity.json
            az deployment mg create --template-file ./infra-as-code/bicep/assign_initiatives_management.bicep --location ${{ env.Location }} --management-group-id ${{ env.managementManagementGroup }} --parameters ./infra-as-code/bicep/parameters-complete-management.json
            az deployment mg create --template-file ./infra-as-code/bicep/assign_initiatives_connectivity.bicep --location ${{ env.Location }} --management-group-id ${{ env.connectivityManagementGroup }} --parameters ./infra-as-code/bicep/parameters-complete-connectivity.json
            az deployment mg create --template-file ./infra-as-code/bicep/assign_initiatives_landingzones.bicep --location ${{ env.Location }} --management-group-id ${{ env.LZManagementGroup }} --parameters ./infra-as-code/bicep/parameters-complete-landingzones.json
            az deployment mg create --template-file ./infra-as-code/bicep/assign_initiatives_servicehealth.bicep --location ${{ env.Location }} --management-group-id ${{ env.ManagementGroupPrefix }} --parameters ./infra-as-code/bicep/parameters-complete-servicehealth.json