Quick Start

Quick Start

This page gets the lab ready without exposing management ports or spending more than needed.

Prerequisites

Local tools:

• Terraform >= 1.9.0, matching terraform.yml
• Azure CLI for local authentication and state setup
• GitHub CLI for workflow dispatch and repository checks
• Go only if running the Terratest suite locally

Azure prerequisites:

• An Azure subscription where you can create resource groups, networking, monitoring, policy assignments, role assignments, and optional management groups.
• A remote Terraform state storage account or a plan to create one.
• A Microsoft Entra application registration with federated credentials for GitHub Actions OIDC.

Repository entry points:

• README.md
• backend.tf
• terraform.tfvars.example
• environments

Recommended First Deployment

Use cheap-lab first. It keeps the topology realistic but turns off expensive edge and workload services.

See Deployment Profiles for the full profile matrix.

Source file: environments/cheap-lab.tfvars

Cheap lab defaults:

• No Azure Firewall
• No VPN Gateway
• No Application Gateway
• No NAT Gateway
• No public Load Balancer
• No public jumpbox IP
• No RDP NAT rules
• Log Analytics enabled with low quota
• Key Vault and Storage enabled
• SQL disabled by default
• Private DNS and Private Endpoints enabled
• Cost management enabled but requires a real email address

Before applying with cost management enabled, replace:

cost_alert_emails = ["replace-me@example.com"]

with a real address.

Local Read-Only Validation

These commands do not deploy Azure resources:

terraform fmt -check -recursive -diff
terraform init -backend=false
terraform validate -no-color

Run OPA policy checks after generating a plan JSON through the pipeline or locally with Conftest. Policy source:

• policies/terraform.rego
• policies/security.rego
• policies/naming.rego

GitHub Actions Plan

The main workflow is Terraform Pipeline.

Plan cheap-lab from the GitHub UI:

1. Open the workflow.
2. Select Run workflow.
3. Choose environment = cheap-lab.
4. Choose action = plan.
5. Leave destroy_confirm empty.

Equivalent GitHub CLI command:

gh workflow run "Terraform Pipeline" --repo Jamonygr/azure-landing-zone-lab -f environment=cheap-lab -f action=plan

GitHub Actions Apply

Only apply after reviewing the plan output and cost estimate.

gh workflow run "Terraform Pipeline" --repo Jamonygr/azure-landing-zone-lab -f environment=cheap-lab -f action=apply

Applies run through the GitHub environment named after the selected profile. Configure environment approval rules in repository settings before using production-like profiles.

GitHub Actions Destroy

Destroy requires the workflow input destroy_confirm = DESTROY.

gh workflow run "Terraform Pipeline" --repo Jamonygr/azure-landing-zone-lab -f environment=cheap-lab -f action=destroy -f destroy_confirm=DESTROY

Destroy uses an environment named <environment>-destroy. Add a protection rule to require manual approval.

First Checks After Apply

Use the root outputs in outputs.tf:

• hub_vnet_id
• identity_vnet_id
• management_vnet_id
• log_analytics_workspace_id
• shared_services_vnet_id
• storage_account_name
• workload_prod_vnet_id
• workload_dev_vnet_id
• aks_cluster_name
• lb_web_server_ips

Then validate:

• VNets exist in the expected resource groups.
• Hub-spoke peerings exist.
• No public RDP is present unless deliberately enabled.
• Log Analytics workspace receives diagnostics.
• Private Endpoint DNS resolves from peered VNets.
• Cost budget and alerts are configured when cost management is enabled.