Glossary

Glossary

Azure Landing Zone

A structured Azure environment that provides networking, identity, management, security, governance, and workload placement patterns.

Hub VNet

The central network that hosts shared connectivity and inspection components such as Azure Firewall, VPN Gateway, and Application Gateway subnets.

Spoke VNet

A workload or platform VNet peered with the hub. In this lab, identity, management, shared services, workload prod, and workload dev are spokes.

Private Endpoint

An Azure network interface that exposes a PaaS service privately inside a VNet. This is used for Key Vault, Storage, and SQL in the shared services landing zone.

Private DNS Zone

An Azure DNS zone used to resolve private endpoint names to private IP addresses.

OIDC

OpenID Connect. GitHub Actions uses OIDC federation to authenticate to Azure without storing a client secret.

Terraform Backend

The storage location for Terraform state. This lab uses the AzureRM backend pattern.

State Key

The blob name used for a Terraform state file. This lab uses one key per profile, such as cheap-lab.terraform.tfstate.

tfvars

Terraform variable value files. Environment profiles live in the environments folder.

NSG

Network Security Group. A subnet or NIC-level firewall for Azure virtual networks.

ASG

Application Security Group. A grouping mechanism that can simplify NSG rule targeting.

WAF

Web Application Firewall. Application Gateway WAF can inspect HTTP/S traffic before it reaches workload backends.

Break-Glass

A temporary, documented exception used for urgent access. In this lab, broad public RDP should never become normal operation.

Terratest

A Go testing framework used to validate deployed cloud infrastructure.

OPA

Open Policy Agent. The repo uses Rego policies to evaluate Terraform plan JSON and fail risky changes.

Infracost

A cost estimation tool used in CI to show expected infrastructure cost changes.