Full Environment Inventory

Full Environment Inventory

This page is the detailed inventory of what the Terraform lab can deploy. It is organized by landing zone, resource type, toggle, source path, and validation evidence.

Inventory Rules

• A resource is considered default-enabled only when a profile enables the relevant toggle.
• cheap-lab is the recommended baseline for low-cost validation.
• lab is the full demonstration profile.
• dev is for development and AKS experiments.
• prod is production-like, not production-certified.
• Local terraform.tfvars should be treated as an override and reviewed before every apply.

Visual Summary

Root Orchestration

Area	Source	Important outputs
Root orchestration	main.tf	All root module wiring
Variables	variables.tf	Feature toggles and validation
Locals	locals.tf	Tags, naming, derived values
Outputs	outputs.tf	VNet IDs, workspace IDs, service names
Backend	backend.tf	AzureRM state backend

Networking Inventory

Component	Default profile behavior	Toggle	Source	Validation
Hub VNet	Core platform	Root networking module	landing-zones/networking	Root output hub_vnet_id
Gateway subnet	Always with hub	Address variables	landing-zones/networking/core	Azure subnet exists
Azure Firewall subnet	Present when firewall enabled	deploy_firewall	modules/firewall	Firewall ID and route table next hop
VPN Gateway	Optional	deploy_vpn_gateway	modules/networking/vpn-gateway	VPN gateway output ID
Application Gateway subnet	Optional with App Gateway	deploy_application_gateway	modules/application-gateway	App Gateway backend health
NAT Gateway	Optional	deploy_nat_gateway	modules/networking/nat-gateway	NAT gateway output ID
Peerings	Core hub-spoke flow	Spoke deployment toggles	landing-zones/networking/connectivity	Terratest peering check
VNet flow logs	Optional	enable_vnet_flow_logs	modules/monitoring/vnet-flow-logs	Flow log resource exists

Identity Inventory

Component	Toggle	Source	Notes
Identity VNet	Core identity module	landing-zones/identity-management	Default 10.1.0.0/16
Domain controller subnet	Core identity module	landing-zones/identity-management/core	Default 10.1.1.0/24
DC01	Core identity module	modules/compute/windows-vm	Default IP 10.1.1.4
DC02	deploy_secondary_dc	landing-zones/identity-management/core	Enabled in production-like profile
DC NSG	Core identity module	modules/networking/nsg	Allows required AD DS traffic

Management Inventory

Component	Toggle	Source	Validation
Management VNet	Core management module	landing-zones/management	Root output management_vnet_id
Jumpbox	Management module	landing-zones/management/core	Public IP disabled in cheap-lab
Jumpbox public IP	enable_jumpbox_public_ip	variables.tf	Must not use 0.0.0.0/0
Log Analytics	deploy_log_analytics	modules/monitoring/log-analytics	Workspace ID output
Action group	Management module	modules/monitoring/action-group	Alert action group output
Alerts	Management module	modules/monitoring/alerts	Alert IDs output
Workbooks	deploy_workbooks	modules/monitoring/workbooks	Portal workbooks
Backup	deploy_backup	modules/backup	Vault output
Automation	enable_scheduled_startstop	modules/automation	Start/stop runbooks

Shared Services Inventory

Component	Toggle	Source	Security expectation
Shared VNet	Shared services module	landing-zones/security/shared-services	Default 10.3.0.0/16
Key Vault	deploy_keyvault	modules/keyvault	Public access controlled; private endpoint supported
Storage	deploy_storage	modules/storage	HTTPS only; no public blobs
SQL	deploy_sql	modules/sql	Public network access disabled by default
Private DNS	deploy_private_dns_zones	modules/networking/private-dns-zone	Links to hub/spokes
Private Endpoints	deploy_private_endpoints	modules/private-endpoint	Key Vault, Storage, SQL

Workload Inventory

Component	Toggle	Source	Notes
Workload prod VNet	deploy_workload_prod	landing-zones/management/workload	Default 10.10.0.0/16
Workload dev VNet	deploy_workload_dev	landing-zones/management/workload	Default 10.11.0.0/16
Web/App/Data subnets	Workload deployment toggles	landing-zones/management/workload/main.tf	Tiered segmentation
Load Balancer	deploy_load_balancer	modules/networking/load-balancer	HTTP path; RDP NAT disabled by default
Web server VMs	deploy_load_balancer	modules/compute/web-server	IIS lab servers
AKS	deploy_aks	modules/aks	Enabled in dev/prod profiles
PaaS bundle	Service-specific toggles	modules	Functions, App Service, Logic Apps, Event Grid, Service Bus, Cosmos DB

Governance Inventory

Component	Toggle	Source	Notes
Management groups	deploy_management_groups	modules/management-groups	Requires elevated permissions
Azure Policy	deploy_azure_policy	modules/policy	Locations, tags, public access, HTTPS, NSG
Custom RBAC	deploy_rbac_custom_roles	modules/rbac	Network, backup, monitoring roles
Cost management	deploy_cost_management	modules/cost-management	Requires real alert recipients
Regulatory compliance	deploy_regulatory_compliance	modules/regulatory-compliance	Lab demonstration only

Inventory Validation

Use the validation order in Testing and Validation:

1. terraform fmt -check -recursive -diff
2. terraform init -backend=false
3. terraform validate -no-color
4. CI scans and OPA gates
5. Plan review
6. Apply only after approval
7. Terratest and manual Azure checks
8. Cost review and cleanup