Landing Zone aufbauen: das Fundament vor der ersten Migration

# AWS: Organisation mit allen Funktionen, danach Organisationseinheiten
aws organizations create-organization --feature-set ALL
ROOT=$(aws organizations list-roots --query 'Roots[0].Id' --output text)

aws organizations create-organizational-unit --parent-id "$ROOT" --name Workloads
aws organizations create-organizational-unit --parent-id "$ROOT" --name Security
aws organizations create-organizational-unit --parent-id "$ROOT" --name Sandbox

# Azure: Verwaltungsgruppen unterhalb der Mandantenwurzel
az account management-group create --name mg-plattform --display-name "Plattform"
az account management-group create --name mg-workloads \
  --display-name "Workloads" --parent mg-plattform

az account management-group subscription add --name mg-workloads \
  --subscription "00000000-0000-0000-0000-000000000000"

cat > deny-non-eu.json <<'JSON'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "NotAction": [
        "iam:*", "sts:*", "organizations:*", "account:*",
        "support:*", "health:*", "budgets:*", "ce:*", "cur:*",
        "cloudfront:*", "route53:*", "waf:*", "shield:*"
      ],
    "Resource": "*",
    "Condition": {
      "StringNotEquals": {
        "aws:RequestedRegion": ["eu-central-1", "eu-west-1"]
      }
    }
  }]
}
JSON

aws organizations create-policy --name DenyNonEU \
  --type SERVICE_CONTROL_POLICY --content file://deny-non-eu.json

aws organizations attach-policy --policy-id p-beispiel \
  --target-id ou-beispiel

# Eingebaute Definition suchen, statt die Kennung zu raten
POLICY=$(az policy definition list \
  --query "[?displayName=='Allowed locations'].name | [0]" -o tsv)

az policy assignment create \
  --name nur-eu-regionen \
  --display-name "Nur Regionen in der EU" \
  --scope "/providers/Microsoft.Management/managementGroups/mg-workloads" \
  --policy "$POLICY" \
  --params '{"listOfAllowedLocations":{"value":["germanywestcentral","westeurope"]}}'

# Nach einigen Minuten die Konformität auswerten
az policy state summarize --management-group mg-workloads

# Azure: Nabe und Speiche, Adressräume überschneidungsfrei
az network vnet create -g rg-hub -n vnet-hub --address-prefixes 10.0.0.0/20
az network vnet create -g rg-prod -n vnet-prod --address-prefixes 10.1.0.0/16

az network vnet peering create -g rg-hub -n hub-zu-prod \
  --vnet-name vnet-hub \
  --remote-vnet "$(az network vnet show -g rg-prod -n vnet-prod --query id -o tsv)" \
  --allow-vnet-access --allow-forwarded-traffic

# AWS: organisationsweite Protokollierung in ein eigenes Konto
aws cloudtrail create-trail --name org-trail \
  --s3-bucket-name acme-org-trail-eu-central-1 \
  --is-organization-trail --is-multi-region-trail
aws cloudtrail start-logging --name org-trail

terraform {
  required_version = ">= 1.10"

  backend "s3" {
    bucket       = "acme-tfstate-eu-central-1"
    key          = "landing-zone/terraform.tfstate"
    region       = "eu-central-1"
    encrypt      = true
    use_lockfile = true
  }
}

provider "aws" {
  region = "eu-central-1"

  default_tags {
    tags = {
      kostenstelle  = var.kostenstelle
      umgebung      = var.umgebung
      verwaltet_von = "terraform"
    }
  }
}

module "organisation" {
  source                 = "./module/organisation"
  organisationseinheiten = ["Workloads", "Security", "Sandbox"]
}

terraform init
terraform plan -out=tfplan

# Billigste Prüfung überhaupt: entfernt der Lauf etwas?
terraform show -json tfplan \
  | jq '.resource_changes[] | select(.change.actions[] == "delete") | .address'

terraform apply tfplan

# Rückweg: nur den betroffenen Teil zurücknehmen
terraform plan -destroy -target=module.sandbox -out=rueckbau.tfplan
terraform apply rueckbau.tfplan