From b59cb658876e39635c94c55ccde8ed4cc5a0d049 Mon Sep 17 00:00:00 2001 From: "Shaik Naseeruddin (BEYONDSOFT CONSULTING INC)" Date: Mon, 17 Aug 2026 18:08:53 +0530 Subject: [PATCH] feat(bootstrap): expose move_subscriptions_to_target_management_group toggle (#4205) Adds an optional bool input 'move_subscriptions_to_target_management_group' to the azuredevops, github and local variants. Defaults to null, preserving current behaviour (var.iac_type != 'bicep-classic'). Allows brownfield estates whose platform subscriptions are already placed to opt out of relocation during bootstrap. --- alz/azuredevops/main.tf | 2 +- alz/azuredevops/variables.tf | 12 ++++++++++++ alz/github/main.tf | 2 +- alz/github/variables.tf | 12 ++++++++++++ alz/local/main.tf | 2 +- alz/local/variables.tf | 12 ++++++++++++ 6 files changed, 39 insertions(+), 3 deletions(-) diff --git a/alz/azuredevops/main.tf b/alz/azuredevops/main.tf index 30cde013..33c0227a 100644 --- a/alz/azuredevops/main.tf +++ b/alz/azuredevops/main.tf @@ -71,7 +71,7 @@ module "azure" { intermediate_root_management_group_creation_enabled = var.iac_type != "bicep-classic" intermediate_root_management_group_id = module.file_manipulation.intermediate_root_management_group_id intermediate_root_management_group_display_name = module.file_manipulation.intermediate_root_management_group_display_name - move_subscriptions_to_target_management_group = var.iac_type != "bicep-classic" + move_subscriptions_to_target_management_group = var.move_subscriptions_to_target_management_group != null ? var.move_subscriptions_to_target_management_group : (var.iac_type != "bicep-classic") } module "azure_devops" { diff --git a/alz/azuredevops/variables.tf b/alz/azuredevops/variables.tf index d6c2736d..b3801635 100644 --- a/alz/azuredevops/variables.tf +++ b/alz/azuredevops/variables.tf @@ -7,6 +7,18 @@ variable "iac_type" { type = string } +variable "move_subscriptions_to_target_management_group" { + description = <<-EOT + **(Optional)** Whether to move the target subscriptions under the intermediate root management group. + + Defaults to `true` for Terraform and Bicep (and `false` for bicep-classic). Set to `false` for brownfield + estates where the platform subscriptions are already placed in a management group hierarchy, to avoid + relocating them during bootstrap. + EOT + type = bool + default = null +} + variable "module_folder_path" { description = <<-EOT **(Required)** The filesystem path to the folder containing ALZ starter modules. diff --git a/alz/github/main.tf b/alz/github/main.tf index 278125ca..19005b0a 100644 --- a/alz/github/main.tf +++ b/alz/github/main.tf @@ -72,7 +72,7 @@ module "azure" { intermediate_root_management_group_creation_enabled = var.iac_type != "bicep-classic" intermediate_root_management_group_id = module.file_manipulation.intermediate_root_management_group_id intermediate_root_management_group_display_name = module.file_manipulation.intermediate_root_management_group_display_name - move_subscriptions_to_target_management_group = var.iac_type != "bicep-classic" + move_subscriptions_to_target_management_group = var.move_subscriptions_to_target_management_group != null ? var.move_subscriptions_to_target_management_group : (var.iac_type != "bicep-classic") } module "github" { diff --git a/alz/github/variables.tf b/alz/github/variables.tf index 46338e8b..24696c4c 100644 --- a/alz/github/variables.tf +++ b/alz/github/variables.tf @@ -7,6 +7,18 @@ variable "iac_type" { type = string } +variable "move_subscriptions_to_target_management_group" { + description = <<-EOT + **(Optional)** Whether to move the target subscriptions under the intermediate root management group. + + Defaults to `true` for Terraform and Bicep (and `false` for bicep-classic). Set to `false` for brownfield + estates where the platform subscriptions are already placed in a management group hierarchy, to avoid + relocating them during bootstrap. + EOT + type = bool + default = null +} + variable "module_folder_path" { description = <<-EOT **(Required)** The filesystem path to the folder containing ALZ starter modules. diff --git a/alz/local/main.tf b/alz/local/main.tf index 79f7ec2a..3569abff 100644 --- a/alz/local/main.tf +++ b/alz/local/main.tf @@ -45,7 +45,7 @@ module "azure" { intermediate_root_management_group_creation_enabled = var.iac_type != "bicep-classic" intermediate_root_management_group_id = module.file_manipulation.intermediate_root_management_group_id intermediate_root_management_group_display_name = module.file_manipulation.intermediate_root_management_group_display_name - move_subscriptions_to_target_management_group = var.iac_type != "bicep-classic" + move_subscriptions_to_target_management_group = var.move_subscriptions_to_target_management_group != null ? var.move_subscriptions_to_target_management_group : (var.iac_type != "bicep-classic") } module "file_manipulation" { diff --git a/alz/local/variables.tf b/alz/local/variables.tf index b2a9816c..878137f4 100644 --- a/alz/local/variables.tf +++ b/alz/local/variables.tf @@ -7,6 +7,18 @@ variable "iac_type" { type = string } +variable "move_subscriptions_to_target_management_group" { + description = <<-EOT + **(Optional)** Whether to move the target subscriptions under the intermediate root management group. + + Defaults to `true` for Terraform and Bicep (and `false` for bicep-classic). Set to `false` for brownfield + estates where the platform subscriptions are already placed in a management group hierarchy, to avoid + relocating them during bootstrap. + EOT + type = bool + default = null +} + variable "module_folder_path" { description = <<-EOT **(Required)** The filesystem path to the folder containing ALZ starter modules.