Governance and Policy

Governance And Policy

The governance landing zone models Azure Landing Zone controls for management groups, policy, cost, compliance, monitoring, and RBAC.

Source:

• landing-zones/governance
• modules/management-groups
• modules/policy
• modules/cost-management
• modules/regulatory-compliance
• modules/rbac

Toggle Summary

Capability	Variable
Management groups	deploy_management_groups
Azure Policy	deploy_azure_policy
Custom RBAC roles	deploy_rbac_custom_roles
Cost management	deploy_cost_management
Regulatory compliance	deploy_regulatory_compliance
HIPAA compliance policy	enable_hipaa_compliance
PCI DSS compliance policy	enable_pci_dss_compliance
Allowed locations	policy_allowed_locations
Audit public network access	enable_audit_public_network_access
Require HTTPS storage	enable_require_https_storage
Require NSG on subnet	enable_require_nsg_on_subnet

Variables source: variables.tf

Management Group Model

The management group module creates an Azure Landing Zone style hierarchy when enabled.

Source: modules/management-groups

Outputs include:

• Root management group
• Platform management group
• Platform identity management group
• Platform management management group
• Platform connectivity management group
• Landing zones management group
• Landing zones corp management group
• Landing zones online management group
• Sandbox management group
• Decommissioned management group

Outputs source: modules/management-groups/outputs.tf

Azure Policy

Source: modules/policy

Policy areas:

• Allowed locations
• Required tags
• Inherit tags
• Audit SQL public access
• Audit Storage public access
• Audit Key Vault public access
• Require HTTPS Storage
• Audit unattached disks
• Require NSG on subnet
• Allowed VM SKUs

Outputs source: modules/policy/outputs.tf

OPA Policy As Code

CI policy checks use Rego files:

• policies/terraform.rego
• policies/security.rego
• policies/naming.rego

Current enforced checks include:

• Deny resources without tags.
• Deny public blob access on Storage.
• Deny resources in non-approved regions.
• Deny SQL public network access.
• Deny Key Vault without soft delete on create.
• Warn on public IP creation.
• Warn on broad inbound NSG rules.
• Warn on large VM sizes.

Policy action source: .github/actions/policy-check

Cost Governance

Cost management is implemented in modules/cost-management.

Controls:

• Budget creation
• Budget alert action group
• Cost anomaly alert output
• Required cost_alert_emails when cost management is enabled

See Cost Management.

Regulatory Compliance

Source: modules/regulatory-compliance

Optional compliance assignments:

• HIPAA
• PCI DSS
• Exemptions

These are useful for lab demonstration, but they should not be treated as proof of compliance. Production compliance requires scoped evidence, operational controls, monitoring, identity review, incident response, data governance, and audit trails.

Validation

Before enabling governance in a subscription:

• Confirm the identity has rights to create management groups and policy assignments.
• Confirm policy scope is correct.
• Confirm lab policies do not block intentionally optional resources.
• Confirm policy_allowed_locations matches tfvars region choices.
• Confirm cost emails are real.
• Confirm GitHub policy gate is enforced on PRs.

Governance Maturity Path

1. Start with advisory audit policies in a lab subscription.
2. Confirm the lab builds cleanly with policy assignments enabled.
3. Move repeated findings into CI OPA rules.
4. Promote production rules from audit to deny only after testing.
5. Document exceptions and review them regularly.