Skip to content

Home

Jump to bottom
Chris Panagiotidis edited this page Jun 13, 2026 · 3 revisions

Azure Landing Zone Lab Wiki

This wiki is the full operator and architecture documentation for the Azure Landing Zone Lab repository.

Primary Architecture Diagram

Actual Azure Architecture Plan

Visual Guide

The fastest way to understand the full lab is through Visual Architecture Map.

Full environment map

What This Repository Deploys

The project is a Terraform-based Azure Landing Zone lab that models a hub-spoke enterprise platform. It includes:

Area What it covers Main source
Hub networking Hub VNet, gateway subnet, firewall subnet, management subnet, App Gateway subnet, route tables, optional Firewall and VPN Gateway landing-zones/networking
Spoke connectivity Hub-to-spoke VNet peering, optional NAT Gateway, ASGs, VNet flow logs landing-zones/networking/connectivity
Identity Identity VNet and Windows Server domain controller VMs landing-zones/identity-management
Management Jumpbox, Log Analytics, alerts, action groups, diagnostics, workbooks, backup, automation, connection monitor landing-zones/management
Shared services Shared VNet, Key Vault, Storage, SQL, Private DNS, Private Endpoints landing-zones/security
Workloads Prod and dev workload VNets, web/app/data tiers, NSGs, route tables, optional IIS VMs, Load Balancer, AKS, and PaaS services landing-zones/management/workload
Governance Management groups, Azure Policy, cost management, regulatory compliance, custom RBAC landing-zones/governance
CI/CD Terraform format, validate, scanning, policy, graph, module version, cost, plan, apply, destroy, inventory, metrics .github/workflows/terraform.yml
Tests Terratest checks for deployed Azure resources and tags tests

Start Here

  1. Read Quick Start before running anything.
  2. Follow End-to-End Deployment Walkthrough for the complete plan, apply, validate, and destroy path.
  3. Review Visual Architecture Map for diagrams.
  4. Check Full Environment Inventory for every deployable component.
  5. Choose a profile in Deployment Profiles.
  6. Review Terraform Plan Review Guide before approving any apply.
  7. Review Security Model and Security Operations before enabling public access, RDP, App Gateway, VPN, or expensive PaaS services.
  8. Configure GitHub Actions and state using CI/CD Pipeline and Remote State and Secrets.
  9. Run validation from Testing and Validation and Azure Portal Validation Evidence.
  10. Use Operations Runbooks for plan, apply, destroy, cleanup, and incident workflows.

Cloud Engineer Handbook Paths

Task Primary page Evidence page
Deploy the lab for the first time End-to-End Deployment Walkthrough Azure Portal Validation Evidence
Review a Terraform plan Terraform Plan Review Guide Testing and Validation
Explain the architecture Architecture Overview Visual Architecture Map
Review security posture Security Model Security Operations
Prepare production adaptation Production Readiness Review Known Limitations And Design Decisions
Operate the roadmap GitHub Projects and Roadmap Operating Model Roadmap And Backlog

GitHub Project Boards

Board Purpose
Master Roadmap Complete roadmap across every active workstream
Secure Foundation Security, governance, RBAC, policy, management access, and PaaS hardening
CI/CD Validation OIDC, Terraform validation, state, CI gates, and tests
Observability Operations Diagnostics, alerts, workbooks, runbooks, and cost operations
Workload Scenarios Workload spokes, App Gateway, AKS, smoke tests, and production-like scenarios

Current Safety Defaults

The documented branch contains important safe defaults:

  • Public RDP from 0.0.0.0/0 is rejected unless allow_public_rdp_from_internet = true is deliberately set.
  • Public Load Balancer RDP NAT rules are disabled by default through enable_lb_rdp_nat_rules = false.
  • The cheapest learning profile is environments/cheap-lab.tfvars.
  • GitHub Actions uses Azure OIDC through AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_SUBSCRIPTION_ID, not long-lived AZURE_CREDENTIALS.
  • Key security gates are enforced in CI: tfsec, Checkov, Gitleaks, and OPA policy checks.
  • Private-first PaaS defaults are documented for Key Vault, SQL, Storage, Private DNS, and Private Endpoints.

Documentation Paths

Reader Start with Then read
First-time deployer Quick Start Deployment Profiles, Remote State and Secrets
Platform engineer Architecture Overview Full Environment Inventory, Module Reference
Security reviewer Security Model Security Operations, Governance and Policy
CI/CD owner CI/CD Pipeline Testing and Validation, Operations Runbooks
Cost owner Cost Management Deployment Profiles, Roadmap And Backlog
Production reviewer Production Readiness Review Known Limitations And Design Decisions, Disaster Recovery And Resilience

Do Not Do These In A Lab

  • Do not commit real secrets, subscription IDs, tenant IDs, private keys, passwords, or service principal secrets.
  • Do not leave cost_alert_emails = ["replace-me@example.com"] when enabling cost management.
  • Do not enable allow_public_rdp_from_internet unless it is a temporary break-glass test with trusted CIDRs.
  • Do not run terraform destroy outside the controlled GitHub Actions destroy workflow unless you understand backend state and dependencies.
  • Do not use production subscriptions for throwaway testing.

Next page: Quick Start

Azure Landing Zone Lab

Start Here

Architecture

Deployment

Security

Operations

Validation

Reference

Clone this wiki locally