# azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet architecture

> Architecture diagram of the GitHub repository azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet
- Repository: https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet

## Overview

This Terraform product deploys an Azure Landing Zones hub-and-spoke connectivity topology. Users provide configuration, Terraform provisions the network and related connectivity capabilities, and outputs expose deployed resource information. The README explicitly documents the hub-virtual-network-mesh submodule as consumed internally; source excerpts were unavailable, so other module wiring and detailed resource calls are not inferred.

Main entry points: [`main.tf`](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/main.tf) (Root deployment), [`modules/hub-virtual-network-mesh/main.tf`](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/modules/hub-virtual-network-mesh/main.tf) (Hub mesh), [`modules/virtual-network-gateway/main.tf`](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/modules/virtual-network-gateway/main.tf) (Virtual network gateway), [`modules/dns-resolver-policy/main.tf`](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/modules/dns-resolver-policy/main.tf) (DNS resolver policy)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_configuration["Configuration"]
  node_root["Root deployment<br/>[main.tf]"]
  node_locals["Naming and locals<br/>[locals.tf]"]
end

subgraph group_networking["Network topology"]
  node_mesh["Hub mesh<br/>[main.tf]"]
  node_firewall["Firewall and routing<br/>[main.firewall.tf]"]
  node_natgw["NAT gateway<br/>[main.natgw.tf]"]
end

subgraph group_capabilities["Connectivity capabilities"]
  node_gateway["Virtual network gateway<br/>[main.tf]"]
  node_dns_policy["DNS resolver policy<br/>[main.tf]"]
  node_dns_resolver["DNS resolver configuration"]
  node_bastion["Bastion configuration<br/>[locals.bastion.tf]"]
  node_ddos["DDoS configuration<br/>[locals.ddos.tf]"]
end

subgraph group_operations["Outputs and telemetry"]
  node_outputs["Deployment outputs<br/>[outputs.tf]"]
  node_telemetry["Telemetry<br/>[main.telemetry.tf]"]
end

node_operator(("Module consumer"))
node_azure[("Azure")]

node_operator -->|"configures"| node_root
node_root -->|"uses settings"| node_locals
node_root -->|"consumes module"| node_mesh
node_mesh -->|"deploys topology"| node_azure
node_gateway -->|"deploys gateway"| node_azure
node_dns_policy -->|"deploys policy"| node_azure
node_root -->|"exposes results"| node_outputs
node_root -->|"configures telemetry"| node_telemetry

click node_root "https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/main.tf"
click node_locals "https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/locals.tf"
click node_mesh "https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/modules/hub-virtual-network-mesh/main.tf"
click node_firewall "https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/modules/hub-virtual-network-mesh/main.firewall.tf"
click node_natgw "https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/modules/hub-virtual-network-mesh/main.natgw.tf"
click node_gateway "https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/modules/virtual-network-gateway/main.tf"
click node_dns_policy "https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/modules/dns-resolver-policy/main.tf"
click node_dns_resolver "https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/locals.dns_resolver.tf"
click node_bastion "https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/locals.bastion.tf"
click node_ddos "https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/locals.ddos.tf"
click node_outputs "https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/outputs.tf"
click node_telemetry "https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/main.telemetry.tf"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_root,node_locals toneBlue
class node_mesh,node_firewall,node_natgw,node_azure toneAmber
class node_gateway,node_dns_policy,node_dns_resolver,node_bastion,node_ddos toneMint
class node_outputs,node_telemetry toneRose
class node_operator toneIndigo
```

## Components

### Configuration

- [Root deployment](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/main.tf): `main.tf`
- [Naming and locals](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/locals.tf): `locals.tf`

### Network topology

- [Hub mesh](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/modules/hub-virtual-network-mesh/main.tf): `modules/hub-virtual-network-mesh/main.tf`
- [Firewall and routing](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/modules/hub-virtual-network-mesh/main.firewall.tf): `modules/hub-virtual-network-mesh/main.firewall.tf`
- [NAT gateway](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/modules/hub-virtual-network-mesh/main.natgw.tf): `modules/hub-virtual-network-mesh/main.natgw.tf`

### Connectivity capabilities

- [Virtual network gateway](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/modules/virtual-network-gateway/main.tf): `modules/virtual-network-gateway/main.tf`
- [DNS resolver policy](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/modules/dns-resolver-policy/main.tf): `modules/dns-resolver-policy/main.tf`
- [DNS resolver configuration](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/locals.dns_resolver.tf): `locals.dns_resolver.tf`
- [Bastion configuration](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/locals.bastion.tf): `locals.bastion.tf`
- [DDoS configuration](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/locals.ddos.tf): `locals.ddos.tf`

### Outputs and telemetry

- [Deployment outputs](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/outputs.tf): `outputs.tf`
- [Telemetry](https://github.com/azure/terraform-azurerm-avm-ptn-alz-connectivity-hub-and-spoke-vnet/blob/main/main.telemetry.tf): `main.telemetry.tf`

### Other components

- **Module consumer**
- **Azure**

## Connections

- Module consumer → Root deployment: configures
- Root deployment → Naming and locals: uses settings
- Root deployment → Hub mesh: consumes module
- Hub mesh → Azure: deploys topology
- Virtual network gateway → Azure: deploys gateway
- DNS resolver policy → Azure: deploys policy
- Root deployment → Deployment outputs: exposes results
- Root deployment → Telemetry: configures telemetry