How jay-withers/azure-landingzone works
This repository defines a manually applied, single-subscription Azure landing zone. The documented workflow applies management, governance, connectivity, then landingzones: later components look up resources by name rather than consuming Terraform state. Landingzones vends resource groups and scoped identities for workload pipelines to deploy into. The graph preserves the documented monitoring, policy, networking, alerting, and access-grant capabilities. Source excerpts were not provided, so component wiring here relies on the README and paths in the tree; uncertain internal calls are omitted.
Main entry points: governance Governance component · connectivity Connectivity component · landingzones Landingzones component · management Management component
Components 21
Management
- Management component
terraform/management - Log Analytics workspace
terraform/management/main.tf - Ingestion cap alert
terraform/management/main.alerts.tf - Shared action group
terraform/management/main.alerts.tf
Governance
- Governance component
terraform/governance - Policy assignments
terraform/governance/main.tf - Activity log routing
terraform/governance/main.diagnostics.tf - Budget and alerts
terraform/governance/main.alerts.tf
Connectivity
- Connectivity component
terraform/connectivity - Hub network
terraform/connectivity/main.network.tf - Private DNS zones
terraform/connectivity/main.dns.tf - Optional firewall
terraform/connectivity/main.firewall.tf - Firewall alerts
terraform/connectivity/main.alerts.tf
Landing zones
- Landingzones component
terraform/landingzones - Landing zone groups
terraform/landingzones/main.tf - Identity and grants
terraform/landingzones/main.rbac.tf
Other components
- Operator
- Workload pipeline
- Azure subscription
- Workload spokes
- Azure Monitor
Connections 29
- Operator → Management component: applies first
- Operator → Governance component: applies next
- Operator → Connectivity component: applies next
- Operator → Landingzones component: applies last
- Management component → Log Analytics workspace: creates
- Management component → Shared action group: creates
- Management component → Ingestion cap alert: creates
- Management component → Azure subscription: provisions
- Ingestion cap alert → Log Analytics workspace: monitors cap
- Governance component → Log Analytics workspace: looks up
- Governance component → Policy assignments: assigns
- Governance component → Activity log routing: configures
- Governance component → Budget and alerts: configures
- Governance component → Azure subscription: provisions
- Connectivity component → Hub network: creates
- Connectivity component → Private DNS zones: creates
- Connectivity component → Optional firewall: optionally creates
- Connectivity component → Firewall alerts: configures
- Connectivity component → Azure subscription: provisions
- Landingzones component → Hub network: looks up
- Landingzones component → Private DNS zones: discovers
- Landingzones component → Landing zone groups: creates
- Landingzones component → Identity and grants: configures
- Landingzones component → Azure subscription: provisions
- Workload pipeline → Identity and grants: authenticates with
- Workload pipeline → Landing zone groups: deploys into
- Workload pipeline → Workload spokes: deploys
- Activity log routing → Azure Monitor: routes activity logs
- Firewall alerts → Shared action group: uses recipients