Shared Services
The shared services landing zone provides private PaaS foundations for the lab.
Source:
| Component | Module | Toggle |
|---|---|---|
| Shared VNet | modules/networking/vnet | Always in shared services |
| App subnet | modules/networking/subnet | Always in shared services |
| Private Endpoint subnet | modules/networking/subnet | Always in shared services |
| App NSG | modules/networking/nsg | Always in shared services |
| Key Vault | modules/keyvault | deploy_keyvault |
| Storage | modules/storage | deploy_storage |
| Azure SQL | modules/sql | deploy_sql |
| Route table | modules/networking/route-table | Always in shared services |
| Private DNS zones | modules/networking/private-dns-zone | deploy_private_dns_zones |
| Private Endpoints | modules/private-endpoint | deploy_private_endpoints |
| Item | Default |
|---|---|
| Shared services VNet | 10.3.0.0/16 |
| App subnet | 10.3.1.0/24 |
| Private Endpoint subnet | 10.3.2.0/24 |
Source: modules/keyvault
Key Vault should be used for lab-generated secrets and sensitive service integration values.
Security posture:
- Soft delete support is expected.
- Public network access is controlled by variable.
- Network ACL default is deny when Private Endpoints are enabled.
- Private Endpoint is available through the shared private endpoint subnet.
- Diagnostic settings can be attached through modules/monitoring/diagnostic-settings.
Source: modules/storage
Storage is used for shared lab data and can support diagnostics or workload artifacts depending on profile.
Security posture:
- HTTPS traffic only.
- Public blob access disabled.
- Public network access can be disabled.
- Network rules can be applied.
- Private Endpoint is available for blob.
- Diagnostic settings can be attached.
Source: modules/sql
SQL is optional and disabled in cheap-lab to reduce cost.
Security posture:
- Public network access disabled by default.
- "Allow Azure Services" firewall exception disabled by default.
- Private Endpoint is available.
- Private DNS zone can be linked.
- Diagnostic settings can target both SQL server and SQL database resources.
Private DNS zones are defined in landing-zones/security/main.tf.
Common zones:
- Blob storage private DNS
- Key Vault private DNS
- SQL private DNS
Link zones to the hub and relevant spokes so workloads can resolve private endpoints consistently.
After apply:
- Confirm Private Endpoint network interfaces are in the shared PE subnet.
- Resolve service FQDNs from workload and management spokes.
- Confirm public access is disabled where intended.
- Confirm diagnostic settings exist for Key Vault, Storage, SQL server, and SQL database.
- Confirm Terratest can find Key Vault in the shared resource group.
| Service | Acceptance criteria |
|---|---|
| Key Vault | Private endpoint exists, public exposure is not required for workloads, diagnostics enabled |
| Storage | HTTPS required, blob public access disabled, network rules match profile |
| SQL | Public network access disabled, Azure-services exception disabled, private DNS resolves |
| Private DNS | Zones are linked to hub and workload VNets that need resolution |
| Private Endpoints | Network interfaces land in the shared PE subnet |
Terratest source: tests/landing_zone_test.go