# jay-withers/azure-landingzone architecture

> Architecture diagram of the GitHub repository jay-withers/azure-landingzone, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/jay-withers/azure-landingzone
- Repository: https://github.com/jay-withers/azure-landingzone

## Overview

This repository defines a manually applied, single-subscription Azure landing zone. The documented workflow applies management, governance, connectivity, then landingzones: later components look up resources by name rather than consuming Terraform state. Landingzones vends resource groups and scoped identities for workload pipelines to deploy into. The graph preserves the documented monitoring, policy, networking, alerting, and access-grant capabilities. Source excerpts were not provided, so component wiring here relies on the README and paths in the tree; uncertain internal calls are omitted.

Main entry points: [`terraform/governance`](https://github.com/jay-withers/azure-landingzone/tree/main/terraform/governance) (Governance component), [`terraform/connectivity`](https://github.com/jay-withers/azure-landingzone/tree/main/terraform/connectivity) (Connectivity component), [`terraform/landingzones`](https://github.com/jay-withers/azure-landingzone/tree/main/terraform/landingzones) (Landingzones component), [`terraform/management`](https://github.com/jay-withers/azure-landingzone/tree/main/terraform/management) (Management component)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_management["Management"]
  node_management_component["Management component"]
  node_log_analytics[("Log Analytics workspace<br/>[main.tf]")]
  node_management_alerts["Ingestion cap alert<br/>[main.alerts.tf]"]
  node_action_group["Shared action group<br/>[main.alerts.tf]"]
end

subgraph group_governance["Governance"]
  node_governance_component["Governance component"]
  node_policy["Policy assignments<br/>[main.tf]"]
  node_diagnostics["Activity log routing"]
  node_budget_alerts["Budget and alerts<br/>[main.alerts.tf]"]
end

subgraph group_connectivity["Connectivity"]
  node_connectivity_component["Connectivity component"]
  node_hub_network["Hub network<br/>[main.network.tf]"]
  node_dns_zones["Private DNS zones<br/>[main.dns.tf]"]
  node_firewall["Optional firewall<br/>[main.firewall.tf]"]
  node_network_alerts["Firewall alerts<br/>[main.alerts.tf]"]
end

subgraph group_landingzones["Landing zones"]
  node_landingzones_component["Landingzones component"]
  node_vended_groups["Landing zone groups<br/>[main.tf]"]
  node_identity_grants["Identity and grants<br/>[main.rbac.tf]"]
end

node_operator(("Operator"))
node_workload_pipeline(("Workload pipeline"))
node_azure["Azure subscription"]
node_spokes["Workload spokes"]
node_log_service["Azure Monitor"]

node_operator -->|"applies first"| node_management_component
node_operator -->|"applies next"| node_governance_component
node_operator -->|"applies next"| node_connectivity_component
node_operator -->|"applies last"| node_landingzones_component
node_management_component -->|"creates"| node_log_analytics
node_management_component -->|"creates"| node_action_group
node_management_component -->|"creates"| node_management_alerts
node_management_component -->|"provisions"| node_azure
node_management_alerts -->|"monitors cap"| node_log_analytics
node_governance_component -->|"looks up"| node_log_analytics
node_governance_component -->|"assigns"| node_policy
node_governance_component -->|"configures"| node_diagnostics
node_governance_component -->|"configures"| node_budget_alerts
node_governance_component -->|"provisions"| node_azure
node_connectivity_component -->|"creates"| node_hub_network
node_connectivity_component -->|"creates"| node_dns_zones
node_connectivity_component -.->|"optionally creates"| node_firewall
node_connectivity_component -->|"configures"| node_network_alerts
node_connectivity_component -->|"provisions"| node_azure
node_landingzones_component -->|"looks up"| node_hub_network
node_landingzones_component -->|"discovers"| node_dns_zones
node_landingzones_component -->|"creates"| node_vended_groups
node_landingzones_component -->|"configures"| node_identity_grants
node_landingzones_component -->|"provisions"| node_azure
node_workload_pipeline -->|"authenticates with"| node_identity_grants
node_workload_pipeline -->|"deploys into"| node_vended_groups
node_workload_pipeline -->|"deploys"| node_spokes
node_diagnostics -->|"routes activity logs"| node_log_service
node_network_alerts -.->|"uses recipients"| node_action_group

click node_management_component "https://github.com/jay-withers/azure-landingzone/tree/main/terraform/management"
click node_log_analytics "https://github.com/jay-withers/azure-landingzone/blob/main/terraform/management/main.tf"
click node_management_alerts "https://github.com/jay-withers/azure-landingzone/blob/main/terraform/management/main.alerts.tf"
click node_action_group "https://github.com/jay-withers/azure-landingzone/blob/main/terraform/management/main.alerts.tf"
click node_governance_component "https://github.com/jay-withers/azure-landingzone/tree/main/terraform/governance"
click node_policy "https://github.com/jay-withers/azure-landingzone/blob/main/terraform/governance/main.tf"
click node_diagnostics "https://github.com/jay-withers/azure-landingzone/blob/main/terraform/governance/main.diagnostics.tf"
click node_budget_alerts "https://github.com/jay-withers/azure-landingzone/blob/main/terraform/governance/main.alerts.tf"
click node_connectivity_component "https://github.com/jay-withers/azure-landingzone/tree/main/terraform/connectivity"
click node_hub_network "https://github.com/jay-withers/azure-landingzone/blob/main/terraform/connectivity/main.network.tf"
click node_dns_zones "https://github.com/jay-withers/azure-landingzone/blob/main/terraform/connectivity/main.dns.tf"
click node_firewall "https://github.com/jay-withers/azure-landingzone/blob/main/terraform/connectivity/main.firewall.tf"
click node_network_alerts "https://github.com/jay-withers/azure-landingzone/blob/main/terraform/connectivity/main.alerts.tf"
click node_landingzones_component "https://github.com/jay-withers/azure-landingzone/tree/main/terraform/landingzones"
click node_vended_groups "https://github.com/jay-withers/azure-landingzone/blob/main/terraform/landingzones/main.tf"
click node_identity_grants "https://github.com/jay-withers/azure-landingzone/blob/main/terraform/landingzones/main.rbac.tf"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_management_component,node_log_analytics,node_management_alerts,node_action_group toneBlue
class node_governance_component,node_policy,node_diagnostics,node_budget_alerts toneAmber
class node_connectivity_component,node_hub_network,node_dns_zones,node_firewall,node_network_alerts toneMint
class node_landingzones_component,node_vended_groups,node_identity_grants toneRose
class node_operator,node_workload_pipeline,node_azure,node_spokes,node_log_service toneIndigo
```

## Components

### Management

- [Management component](https://github.com/jay-withers/azure-landingzone/tree/main/terraform/management): `terraform/management`
- [Log Analytics workspace](https://github.com/jay-withers/azure-landingzone/blob/main/terraform/management/main.tf): `terraform/management/main.tf`
- [Ingestion cap alert](https://github.com/jay-withers/azure-landingzone/blob/main/terraform/management/main.alerts.tf): `terraform/management/main.alerts.tf`
- [Shared action group](https://github.com/jay-withers/azure-landingzone/blob/main/terraform/management/main.alerts.tf): `terraform/management/main.alerts.tf`

### Governance

- [Governance component](https://github.com/jay-withers/azure-landingzone/tree/main/terraform/governance): `terraform/governance`
- [Policy assignments](https://github.com/jay-withers/azure-landingzone/blob/main/terraform/governance/main.tf): `terraform/governance/main.tf`
- [Activity log routing](https://github.com/jay-withers/azure-landingzone/blob/main/terraform/governance/main.diagnostics.tf): `terraform/governance/main.diagnostics.tf`
- [Budget and alerts](https://github.com/jay-withers/azure-landingzone/blob/main/terraform/governance/main.alerts.tf): `terraform/governance/main.alerts.tf`

### Connectivity

- [Connectivity component](https://github.com/jay-withers/azure-landingzone/tree/main/terraform/connectivity): `terraform/connectivity`
- [Hub network](https://github.com/jay-withers/azure-landingzone/blob/main/terraform/connectivity/main.network.tf): `terraform/connectivity/main.network.tf`
- [Private DNS zones](https://github.com/jay-withers/azure-landingzone/blob/main/terraform/connectivity/main.dns.tf): `terraform/connectivity/main.dns.tf`
- [Optional firewall](https://github.com/jay-withers/azure-landingzone/blob/main/terraform/connectivity/main.firewall.tf): `terraform/connectivity/main.firewall.tf`
- [Firewall alerts](https://github.com/jay-withers/azure-landingzone/blob/main/terraform/connectivity/main.alerts.tf): `terraform/connectivity/main.alerts.tf`

### Landing zones

- [Landingzones component](https://github.com/jay-withers/azure-landingzone/tree/main/terraform/landingzones): `terraform/landingzones`
- [Landing zone groups](https://github.com/jay-withers/azure-landingzone/blob/main/terraform/landingzones/main.tf): `terraform/landingzones/main.tf`
- [Identity and grants](https://github.com/jay-withers/azure-landingzone/blob/main/terraform/landingzones/main.rbac.tf): `terraform/landingzones/main.rbac.tf`

### Other components

- **Operator**
- **Workload pipeline**
- **Azure subscription**
- **Workload spokes**
- **Azure Monitor**

## Connections

- Operator → Management component: applies first
- Operator → Governance component: applies next
- Operator → Connectivity component: applies next
- Operator → Landingzones component: applies last
- Management component → Log Analytics workspace: creates
- Management component → Shared action group: creates
- Management component → Ingestion cap alert: creates
- Management component → Azure subscription: provisions
- Ingestion cap alert → Log Analytics workspace: monitors cap
- Governance component → Log Analytics workspace: looks up
- Governance component → Policy assignments: assigns
- Governance component → Activity log routing: configures
- Governance component → Budget and alerts: configures
- Governance component → Azure subscription: provisions
- Connectivity component → Hub network: creates
- Connectivity component → Private DNS zones: creates
- Connectivity component → Optional firewall: optionally creates
- Connectivity component → Firewall alerts: configures
- Connectivity component → Azure subscription: provisions
- Landingzones component → Hub network: looks up
- Landingzones component → Private DNS zones: discovers
- Landingzones component → Landing zone groups: creates
- Landingzones component → Identity and grants: configures
- Landingzones component → Azure subscription: provisions
- Workload pipeline → Identity and grants: authenticates with
- Workload pipeline → Landing zone groups: deploys into
- Workload pipeline → Workload spokes: deploys
- Activity log routing → Azure Monitor: routes activity logs
- Firewall alerts → Shared action group: uses recipients