-
Notifications
You must be signed in to change notification settings - Fork 528
Home
The Azure landing zones Terraform module provides an opinionated approach for deploying and managing the core platform capabilities of Azure landing zones architecture using Terraform, with a focus on the central resource hierarchy:
Depending on selected options, this module can deploy different sets of resources based on the following capabilities:
Please click on each of the above links for more details.
The module provides a consistent approach for deploying and managing resources relating to the following design areas:
-
Resource organization
- Create the Management Group resource hierarchy
- Assign Subscriptions to Management Groups
- Create custom Policy Assignments, Policy Definitions and Policy Set Definitions (Initiatives)
-
Identity and access management
- Secure the identity subscription using Azure Policy
- Create custom Role Assignments and Role Definitions
-
Management
- Create a central Log Analytics workspace and Automation Account
- Link Log Analytics workspace to the Automation Account
- Deploy recommended Log Analytics Solutions
- Enable Microsoft Defender for Cloud
-
Network topology and connectivity
- Create a centralized hub network
- Traditional Azure networking topology (hub and spoke)
- Virtual WAN network topology (Microsoft-managed)
- Secure network design
- Azure Firewall
- DDoS Network Protection
- Hybrid connectivity
- Azure Virtual Network Gateway
- Azure ExpressRoute Gateway
- Centrally managed DNS zones
- Create a centralized hub network
Check out the User Guide, or go straight to our Examples.
This wiki is being actively developed
If you discover any documentation bugs or would like to request new content, please raise them as an issue or feel free to contribute to the wiki via a pull request. The wiki docs are located in the repository in the docs/wiki/
folder.
- Home
- User guide
- Video guides
-
Examples
- Level 100
- Level 200
-
Level 300
- Deploy multi region networking with custom settings (Hub and Spoke)
- Deploy multi region networking with custom settings (Virtual WAN)
- Deploy with Zero Trust network principles (Hub and Spoke)
- Deploy identity resources with custom settings
- Deploy management resources with custom settings
- Expand built-in archetype definitions
- Create custom policies, initiatives and assignments
- Override module role assignments
- Control policy enforcement mode
- Policy assignments with user assigned managed identities
- Level 400
- Frequently Asked Questions
- Troubleshooting
- Contributing