Architecture Overview
The lab is organized around Azure Landing Zone design areas: platform networking, identity, management, security, governance, and workload landing zones.
Primary orchestration:
-
main.tfbuilds resource groups and common naming. - Networking creates the hub VNet and optional shared edge services.
- Identity creates the identity spoke and domain controllers.
- Management creates operational services such as Log Analytics, jumpbox, alerts, diagnostics, backup, and automation.
- Shared services creates private-first PaaS foundations.
- Workload prod and workload dev create application landing zones.
- Connectivity wires hub-to-spoke peerings, NAT, ASGs, and flow logs.
- Governance applies policies, custom roles, management groups, regulatory controls, and cost budgets.
- Post-deployment diagnostics attach logging to resources that are only known after optional modules deploy.
| View | Use |
|---|---|
| Visual Architecture Map | Diagram gallery and explanation |
| Full Environment Inventory | Resource-by-resource inventory |
| Network Topology | CIDRs, peerings, routing, public entry points |
| Security Model | Controls and guardrails |
| Module Reference | Terraform source map |
| Root module | Purpose | Source |
|---|---|---|
networking |
Hub VNet, subnets, Firewall, VPN Gateway, base route tables, App Gateway subnet/NSG | landing-zones/networking |
identity |
Identity VNet, domain controller subnet, NSG, DC01, optional DC02 | landing-zones/identity-management |
management |
Management VNet, jumpbox, Log Analytics, alerts, diagnostics, workbooks, backup, automation | landing-zones/management |
security |
Shared VNet, Key Vault, Storage, SQL, Private DNS, Private Endpoints | landing-zones/security |
workload_prod |
Production workload spoke with web/app/data tiers and optional services | landing-zones/management/workload |
workload_dev |
Development workload spoke using the same reusable workload module | landing-zones/management/workload |
application_gateway |
Optional root-level App Gateway wired declaratively to workload backend IPs | modules/application-gateway |
networking_connectivity |
Hub-spoke peering, optional NAT, ASGs, VNet flow logs | landing-zones/networking/connectivity |
post_deployment_diagnostics |
Diagnostic settings for optional resources after IDs are known | modules/monitoring/diagnostic-settings |
onprem |
Optional simulated on-premises VNet, VPN gateway, NSG, and connection back to hub | landing-zones/networking/onprem-simulated |
governance |
Management groups, Azure Policy, RBAC, cost management, regulatory compliance | landing-zones/governance |
| Flow | Path | Expected controls |
|---|---|---|
| Public web request | Internet to Application Gateway WAF to workload web tier | WAF policy, App Gateway subnet NSG, backend health probe |
| Public load balancer test | Internet to public Load Balancer to IIS web VMs | HTTP only by default; RDP NAT rules disabled |
| Private PaaS access | Spoke subnet to Private DNS to Private Endpoint to Key Vault, Storage, or SQL | Private DNS zone links and public data-plane restrictions |
| Management access | Trusted operator path to VPN, Bastion-style access, or controlled jumpbox | No broad public RDP; source CIDRs must be explicit |
| Spoke egress with firewall | Spoke route table to Azure Firewall to internet or Azure service | Firewall route table, policy rules, diagnostics |
| CI/CD deployment | GitHub Actions OIDC to AzureRM backend and Azure APIs | Federated identity, protected state, plan/apply gates |
| Subnet | Purpose | Security expectation |
|---|---|---|
| GatewaySubnet | VPN gateway when enabled | No workload resources |
| AzureFirewallSubnet | Azure Firewall when enabled | Dedicated subnet only |
| Hub management subnet | Central platform management services | Restricted management-plane access |
| App Gateway subnet | Application Gateway WAF | Public web ingress only when enabled |
| Identity DC subnet | Domain controller VMs | AD DS rules scoped to required sources |
| Management jumpbox subnet | Optional jumpbox | Public IP disabled unless break-glass |
| Shared app subnet | Shared service support workloads | Internal-only unless explicitly changed |
| Shared private endpoint subnet | Private endpoints | Private endpoint network policies as required by Azure service behavior |
| Workload web subnet | Web tier | HTTP/HTTPS ingress through approved path |
| Workload app subnet | Application tier | No direct public ingress |
| Workload data subnet | Data tier | No direct public ingress |
Use this table when reviewing a plan or Azure Portal inventory.
| Terraform area | Expected Azure evidence |
|---|---|
landing-zones/networking |
Hub VNet, hub subnets, route tables, optional Firewall/VPN/App Gateway subnet |
landing-zones/networking/connectivity |
VNet peerings, NAT gateway, ASGs, flow log resources when enabled |
landing-zones/identity-management |
Identity VNet, domain controller subnet, DC VM NICs, NSG |
landing-zones/management |
Management VNet, jumpbox, Log Analytics, alerts, diagnostics, automation, backup |
landing-zones/security/shared-services |
Shared VNet, Key Vault, Storage, SQL, private endpoints, private DNS links |
landing-zones/management/workload |
Workload VNets, web/app/data subnets, NSGs, route tables, IIS VMs, AKS |
landing-zones/governance |
Management groups, policy assignments, custom roles, budgets, compliance artifacts |
| Zone | CIDR | Purpose |
|---|---|---|
| Hub | 10.0.0.0/16 |
Central connectivity and inspection |
| Identity | 10.1.0.0/16 |
Domain controllers and identity services |
| Management | 10.2.0.0/16 |
Jumpbox, monitoring, automation, management plane |
| Shared services | 10.3.0.0/16 |
Shared PaaS, Private Endpoints, Private DNS |
| Workload prod | 10.10.0.0/16 |
Production application tiers |
| Workload dev | 10.11.0.0/16 |
Development application tiers |
| Simulated on-premises | 10.100.0.0/16 |
Optional VPN lab simulation |
The address space is controlled by variables in variables.tf and profile files in environments.
The root design intentionally makes richer services optional so the lab can run in different cost and security modes.
Default foundations:
- Resource groups
- Naming locals
- Hub VNet
- Identity VNet and primary DC
- Management VNet
- Shared services VNet
- Log Analytics when enabled by profile
- Workload prod or dev depending on profile
Optional services:
- Azure Firewall
- VPN Gateway
- Simulated on-premises
- Application Gateway WAF
- NAT Gateway
- Public Load Balancer
- RDP NAT rules
- AKS
- Backup
- Workbooks
- Connection Monitor
- VNet flow logs and Traffic Analytics
- Azure Policy
- Management groups
- Cost management
- Regulatory compliance initiatives
- PaaS workload services
| Evidence | Purpose |
|---|---|
| Main architecture PNG | Human-readable overview of deployed scope |
| Terraform plan summary | Confirms resources before apply |
| Azure resource inventory | Confirms resources after apply |
| VNet/subnet export | Confirms addressing and segmentation |
| Peering export | Confirms hub-spoke connectivity |
| Public IP export | Confirms public exposure review |
| Diagnostic settings export | Confirms observability wiring |
Next page: Network Topology