Module Reference
This page maps the Terraform implementation so contributors can find the right module quickly.
| File | Purpose |
|---|---|
| main.tf | Root orchestration |
| variables.tf | Root input variables and validation |
| outputs.tf | Root outputs for validation and consumption |
| locals.tf | Naming, tags, and shared local values |
| backend.tf | Terraform backend declaration |
| terraform.tfvars.example | Example root variables |
| Path | Purpose |
|---|---|
| landing-zones/networking | Hub and connectivity orchestration |
| landing-zones/networking/core | Hub VNet, subnets, Firewall, VPN, route tables, App Gateway subnet |
| landing-zones/networking/connectivity | Peerings, NAT, ASGs, flow logs |
| landing-zones/networking/onprem-simulated | Optional on-premises simulation |
| landing-zones/identity-management | Identity spoke orchestration |
| landing-zones/identity-management/core | Identity VNet, DC subnet, NSG, DC VMs |
| landing-zones/management | Management and monitoring orchestration |
| landing-zones/management/core | Jumpbox, Log Analytics, route table, action group, alerts, diagnostics |
| landing-zones/management/workload | Workload prod/dev reusable module |
| landing-zones/security | Shared services and Private DNS orchestration |
| landing-zones/security/shared-services | Shared VNet, PaaS, route table, Private Endpoints |
| landing-zones/governance | Management groups, policy, cost, compliance, RBAC |
| Path | Purpose |
|---|---|
| modules/resource-group | Resource group creation |
| modules/naming | Naming helpers |
| modules/networking/vnet | Virtual network |
| modules/networking/subnet | Subnet |
| modules/networking/nsg | Network security group and rules |
| modules/networking/route-table | Route table |
| modules/networking/peering | Bidirectional VNet peering |
| modules/networking/load-balancer | Public Load Balancer |
| modules/networking/nat-gateway | NAT Gateway |
| modules/networking/vpn-gateway | VPN Gateway |
| modules/networking/vpn-connection | VPN connection |
| modules/networking/local-network-gateway | Local Network Gateway |
| modules/networking/private-dns-zone | Private DNS zone and VNet links |
| modules/networking/asg | Application Security Groups |
| Path | Purpose |
|---|---|
| modules/firewall | Azure Firewall and policy |
| modules/firewall-rules | Firewall rule collection groups |
| modules/application-gateway | Application Gateway WAF |
| modules/keyvault | Key Vault |
| modules/storage | Storage account |
| modules/sql | Azure SQL server and database |
| modules/private-endpoint | Private Endpoint |
| modules/compute/windows-vm | Generic Windows VM |
| modules/compute/web-server | IIS web server VM |
| modules/aks | AKS cluster |
| Path | Purpose |
|---|---|
| modules/functions | Azure Functions |
| modules/static-web-app | Static Web App |
| modules/logic-apps | Logic Apps |
| modules/event-grid | Event Grid |
| modules/service-bus | Service Bus |
| modules/app-service | App Service |
| modules/cosmos-db | Cosmos DB |
| Path | Purpose |
|---|---|
| modules/monitoring/log-analytics | Log Analytics workspace |
| modules/monitoring/action-group | Monitor action group |
| modules/monitoring/alerts | Metric alerts |
| modules/monitoring/diagnostic-settings | Diagnostic settings |
| modules/monitoring/workbooks | Azure Workbooks |
| modules/monitoring/connection-monitor | Network Watcher Connection Monitor |
| modules/monitoring/vnet-flow-logs | VNet flow logs |
| modules/monitoring/nsg-flow-logs | NSG flow logs reference |
| modules/backup | Recovery Services vault and backup policies |
| modules/automation | Start/stop automation |
| modules/management-groups | Management groups |
| modules/policy | Azure Policy assignments |
| modules/rbac | Custom RBAC roles |
| modules/cost-management | Budgets and alerts |
| modules/regulatory-compliance | Compliance policy assignments |
Use this sequence:
- Check whether an existing module already owns the resource family.
- Add variables with validation where unsafe values are possible.
- Add outputs for IDs needed by diagnostics, tests, or parent modules.
- Keep environment toggles at the root unless the module is purely internal.
- Update the relevant landing zone wrapper.
- Update profile tfvars if behavior changes.
- Update Full Environment Inventory and the relevant Wiki page.
- Run format, validate, plan, security scans, and policy checks.