Home

Azure Landing Zone Lab Wiki

This wiki is the full operator and architecture documentation for the Azure Landing Zone Lab repository.

• Source repository: Jamonygr/azure-landing-zone-lab
• Current documented implementation branch: codex/landing-zone-safe-hardening
• Main Terraform orchestration: main.tf
• Root variables: variables.tf
• Root outputs: outputs.tf
• CI/CD workflow: .github/workflows/terraform.yml
• Terratest suite: tests/landing_zone_test.go

Primary Architecture Diagram

Visual Guide

The fastest way to understand the full lab is through Visual Architecture Map.

What This Repository Deploys

The project is a Terraform-based Azure Landing Zone lab that models a hub-spoke enterprise platform. It includes:

Area	What it covers	Main source
Hub networking	Hub VNet, gateway subnet, firewall subnet, management subnet, App Gateway subnet, route tables, optional Firewall and VPN Gateway	landing-zones/networking
Spoke connectivity	Hub-to-spoke VNet peering, optional NAT Gateway, ASGs, VNet flow logs	landing-zones/networking/connectivity
Identity	Identity VNet and Windows Server domain controller VMs	landing-zones/identity-management
Management	Jumpbox, Log Analytics, alerts, action groups, diagnostics, workbooks, backup, automation, connection monitor	landing-zones/management
Shared services	Shared VNet, Key Vault, Storage, SQL, Private DNS, Private Endpoints	landing-zones/security
Workloads	Prod and dev workload VNets, web/app/data tiers, NSGs, route tables, optional IIS VMs, Load Balancer, AKS, and PaaS services	landing-zones/management/workload
Governance	Management groups, Azure Policy, cost management, regulatory compliance, custom RBAC	landing-zones/governance
CI/CD	Terraform format, validate, scanning, policy, graph, module version, cost, plan, apply, destroy, inventory, metrics	.github/workflows/terraform.yml
Tests	Terratest checks for deployed Azure resources and tags	tests

Start Here

1. Read Quick Start before running anything.
2. Follow End-to-End Deployment Walkthrough for the complete plan, apply, validate, and destroy path.
3. Review Visual Architecture Map for diagrams.
4. Check Full Environment Inventory for every deployable component.
5. Choose a profile in Deployment Profiles.
6. Review Terraform Plan Review Guide before approving any apply.
7. Review Security Model and Security Operations before enabling public access, RDP, App Gateway, VPN, or expensive PaaS services.
8. Configure GitHub Actions and state using CI/CD Pipeline and Remote State and Secrets.
9. Run validation from Testing and Validation and Azure Portal Validation Evidence.
10. Use Operations Runbooks for plan, apply, destroy, cleanup, and incident workflows.

Cloud Engineer Handbook Paths

Task	Primary page	Evidence page
Deploy the lab for the first time	End-to-End Deployment Walkthrough	Azure Portal Validation Evidence
Review a Terraform plan	Terraform Plan Review Guide	Testing and Validation
Explain the architecture	Architecture Overview	Visual Architecture Map
Review security posture	Security Model	Security Operations
Prepare production adaptation	Production Readiness Review	Known Limitations And Design Decisions
Operate the roadmap	GitHub Projects and Roadmap Operating Model	Roadmap And Backlog

GitHub Project Boards

Board	Purpose
Master Roadmap	Complete roadmap across every active workstream
Secure Foundation	Security, governance, RBAC, policy, management access, and PaaS hardening
CI/CD Validation	OIDC, Terraform validation, state, CI gates, and tests
Observability Operations	Diagnostics, alerts, workbooks, runbooks, and cost operations
Workload Scenarios	Workload spokes, App Gateway, AKS, smoke tests, and production-like scenarios

Current Safety Defaults

The documented branch contains important safe defaults:

• Public RDP from 0.0.0.0/0 is rejected unless allow_public_rdp_from_internet = true is deliberately set.
• Public Load Balancer RDP NAT rules are disabled by default through enable_lb_rdp_nat_rules = false.
• The cheapest learning profile is environments/cheap-lab.tfvars.
• GitHub Actions uses Azure OIDC through AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_SUBSCRIPTION_ID, not long-lived AZURE_CREDENTIALS.
• Key security gates are enforced in CI: tfsec, Checkov, Gitleaks, and OPA policy checks.
• Private-first PaaS defaults are documented for Key Vault, SQL, Storage, Private DNS, and Private Endpoints.

Documentation Paths

Reader	Start with	Then read
First-time deployer	Quick Start	Deployment Profiles, Remote State and Secrets
Platform engineer	Architecture Overview	Full Environment Inventory, Module Reference
Security reviewer	Security Model	Security Operations, Governance and Policy
CI/CD owner	CI/CD Pipeline	Testing and Validation, Operations Runbooks
Cost owner	Cost Management	Deployment Profiles, Roadmap And Backlog
Production reviewer	Production Readiness Review	Known Limitations And Design Decisions, Disaster Recovery And Resilience

Do Not Do These In A Lab

• Do not commit real secrets, subscription IDs, tenant IDs, private keys, passwords, or service principal secrets.
• Do not leave cost_alert_emails = ["replace-me@example.com"] when enabling cost management.
• Do not enable allow_public_rdp_from_internet unless it is a temporary break-glass test with trusted CIDRs.
• Do not run terraform destroy outside the controlled GitHub Actions destroy workflow unless you understand backend state and dependencies.
• Do not use production subscriptions for throwaway testing.

Next page: Quick Start