-
Notifications
You must be signed in to change notification settings - Fork 95
FAQ
It is a production-aligned lab, not a production landing zone by itself. It demonstrates important platform patterns, but production use still requires organization-specific identity, policy, compliance, threat modeling, operations, backup, disaster recovery, and change management.
Deploy cheap-lab first. See Deployment Profiles.
Because public RDP is a high-risk management exposure. The repo now requires a deliberate override before allowing 0.0.0.0/0. See Security Model.
The pipeline uses GitHub OIDC federation to avoid storing long-lived Azure client secrets. See CI/CD Pipeline.
Yes, but it should be temporary and restricted to trusted CIDRs with allowed_jumpbox_source_ips. Prefer private access through VPN or equivalent.
They are useful architecture components but can create meaningful recurring cost. Enable them only when you need to test those paths. See Cost Management.
Use:
- Root outputs in outputs.tf
- GitHub Actions plan summary
- Resource inventory action output
- Azure Portal resource groups
- Terratest checks in tests/landing_zone_test.go
Azure Policy module:
OPA/Rego CI policies:
Tests live in tests. See Testing and Validation.
The lab is designed to support multiple learning and cost profiles. Optional toggles let you model production-like capabilities without forcing every expensive resource into every deployment.
Yes. Add a new tfvars file under environments, update the GitHub Actions environment choices, and document the profile. See Operations Runbooks.
Review:
- Architecture Overview
- Full Environment Inventory
- Network Topology
- Shared Services
- Workloads
- Module Reference
- Security Model
- Security Operations
- Identity and Access
- Governance and Policy
- Production Readiness Review
- Monitoring and Diagnostics
- Operations Runbooks
- Azure Portal Validation Evidence
- Cost Management
- Disaster Recovery and Resilience