Production Readiness Review

Production Readiness Review

This page is a review checklist for deciding whether the lab pattern is ready to be adapted into a production landing-zone implementation. The answer for this repository is not "copy directly into production"; it is "use as a learning and design baseline, then harden and validate."

Use this page with:

• Security Model
• Governance and Policy
• Monitoring and Diagnostics
• Known Limitations And Design Decisions

Readiness Summary

Area	Lab maturity	Production expectation
Terraform module layout	Strong learning baseline	Add versioned modules and promotion workflow
Networking	Hub-spoke model represented	Validate IPAM, DNS, routing, firewall, and NVA strategy
Identity	AD DS simulation represented	Use enterprise identity and privileged access process
Security	Important guardrails represented	Enforce tenant/subscription policies and incident controls
Monitoring	Diagnostics framework represented	Full SIEM integration and alert ownership
CI/CD	OIDC and gated pipeline represented	Branch protection, approvals, drift detection, change records
Cost	Lab guardrails represented	Budgets, chargeback, commitments, and FinOps process
DR	Conceptual only	Formal RTO/RPO, failover testing, and regional design

Go/No-Go Review

Review item	Go condition
Management access	No public RDP path is enabled by default
PaaS access	Key Vault, SQL, and Storage data planes are private-first
Identity	Production principals and roles are mapped to least privilege
Policy	Required policies are deny or deploy-if-not-exists where appropriate
Monitoring	Diagnostics and alerts have owners and response procedures
State	Backend storage has RBAC, backup, retention, and access review
CI/CD	Apply and destroy are protected by environment approvals
Testing	Plan, policy, security, and post-deployment checks are repeatable
Cost	Budget alerts have real owners
Documentation	Runbooks and evidence are current

Production Gaps To Close

Gap	Why it matters	Recommended action
Lab profiles are not tenant-specific	Enterprise environments need organization policy alignment	Create organization-specific profiles
Some controls are optional	Production requires enforceable baselines	Move required controls from optional to mandatory
DR is not implemented end to end	Production needs recovery objectives	Design secondary-region or rebuild strategy
Manual evidence collection	Production needs consistent audit records	Automate inventory and validation artifacts
AKS production hardening is still a backlog item	Kubernetes is high-risk when exposed or misconfigured	Implement private cluster and policy controls
Policy mode varies by lab profile	Audit mode can be mistaken for enforcement	Document and enforce production deny mode

Production Hardening Checklist

Security:

• Disable public management access.
• Require private endpoint access for sensitive PaaS.
• Enable Defender plans as required by organization policy.
• Use managed identities and least-privilege RBAC.
• Rotate any credentials used during setup.

Networking:

• Validate IP address management against enterprise ranges.
• Use formal DNS design for private zones.
• Confirm firewall routing and route table ownership.
• Document ingress and egress flows.

Operations:

• Define alert owners and escalation paths.
• Add operational dashboards and SIEM routing.
• Configure backup and retention policies.
• Define patching and vulnerability management ownership.

CI/CD:

• Protect main.
• Require PR reviews.
• Require successful checks before merge.
• Require environment approval for apply and destroy.
• Store plan artifacts and change evidence.

Acceptance Evidence

Evidence	Required before production adaptation
Approved architecture decision record	Yes
Successful plan and apply in non-prod	Yes
Security scan and policy evidence	Yes
Cost estimate and budget setup	Yes
Operations runbook review	Yes
DR decision record	Yes
Rollback or destroy plan	Yes
Owner sign-off	Yes

Recommended Production Adaptation Path

1. Fork or branch from the hardened lab baseline.
2. Replace lab naming, tags, and address spaces with enterprise standards.
3. Convert audit-only controls into required production controls.
4. Wire production principals and role assignments.
5. Build a non-production subscription first.
6. Run plan, apply, evidence collection, and destroy tests.
7. Promote through controlled environments only after review.

Next page: Security Operations