# jtracey93/alz-bicep architecture

> Architecture diagram of the GitHub repository jtracey93/alz-bicep, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/jtracey93/alz-bicep
- Repository: https://github.com/jtracey93/alz-bicep

## Overview

ALZ-Bicep Classic is a collection of Bicep modules for deploying Azure Landing Zone platform capabilities. The documented user flow is to deploy modules individually from the command line; the README also describes policy, management-group, subscription-placement, networking, and logging concerns. The tree supports these capability areas, but no source excerpts were provided, so internal module calls and deployment ordering cannot be established here.

Main entry points: [`infra-as-code/bicep/modules/managementGroups/managementGroups.bicep`](https://github.com/jtracey93/alz-bicep/blob/main/infra-as-code/bicep/modules/managementGroups/managementGroups.bicep) (Management groups), [`infra-as-code/bicep/modules/subscriptionPlacement`](https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/subscriptionPlacement) (Subscription placement), [`infra-as-code/bicep/modules/resourceGroup`](https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/resourceGroup) (Resource groups), [`infra-as-code/bicep/modules/policy/definitions`](https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/policy/definitions) (Policy definitions)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_foundation["Platform foundation"]
  node_management["Management groups"]
  node_placement["Subscription placement"]
  node_resourcegroup["Resource groups"]
end

subgraph group_governance["Governance and policy"]
  node_definitions["Policy definitions"]
  node_assignments["Policy assignments"]
  node_roles["Custom roles"]
  node_roleassignments["Role assignments"]
end

subgraph group_network["Connectivity"]
  node_hub["Hub networking"]
  node_spoke["Spoke networking"]
  node_vwan["Virtual WAN"]
  node_peering["VNet peering"]
end

subgraph group_operations["Operations and telemetry"]
  node_logging["Logging services<br/>[logging.bicep]"]
  node_diagnostics["Diagnostic settings"]
  node_attribution["Usage attribution"]
end

node_operator(("Platform engineer"))
node_azure[("Azure resources")]

node_operator -->|"deploys individually"| node_management
node_operator -->|"deploys individually"| node_placement
node_operator -->|"deploys individually"| node_resourcegroup
node_operator -->|"deploys individually"| node_definitions
node_operator -->|"deploys individually"| node_assignments
node_operator -->|"deploys individually"| node_roles
node_operator -->|"deploys individually"| node_roleassignments
node_operator -->|"deploys individually"| node_hub
node_operator -->|"deploys individually"| node_spoke
node_operator -->|"deploys individually"| node_vwan
node_operator -->|"deploys individually"| node_peering
node_operator -->|"deploys individually"| node_logging
node_operator -->|"deploys individually"| node_diagnostics
node_operator -->|"deploys individually"| node_attribution
node_management -->|"deploys resources"| node_azure
node_placement -->|"deploys resources"| node_azure
node_resourcegroup -->|"deploys resources"| node_azure
node_definitions -->|"deploys resources"| node_azure
node_assignments -->|"deploys resources"| node_azure
node_roles -->|"deploys resources"| node_azure
node_roleassignments -->|"deploys resources"| node_azure
node_hub -->|"deploys resources"| node_azure
node_spoke -->|"deploys resources"| node_azure
node_vwan -->|"deploys resources"| node_azure
node_peering -->|"deploys resources"| node_azure
node_logging -->|"deploys resources"| node_azure
node_diagnostics -->|"deploys resources"| node_azure
node_attribution -->|"deploys resources"| node_azure

click node_management "https://github.com/jtracey93/alz-bicep/blob/main/infra-as-code/bicep/modules/managementGroups/managementGroups.bicep"
click node_placement "https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/subscriptionPlacement"
click node_resourcegroup "https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/resourceGroup"
click node_definitions "https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/policy/definitions"
click node_assignments "https://github.com/jtracey93/alz-bicep/blob/main/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep"
click node_roles "https://github.com/jtracey93/alz-bicep/blob/main/infra-as-code/bicep/modules/customRoleDefinitions/customRoleDefinitions.bicep"
click node_roleassignments "https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/roleAssignments"
click node_hub "https://github.com/jtracey93/alz-bicep/blob/main/infra-as-code/bicep/modules/hubNetworking/hubNetworking.bicep"
click node_spoke "https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/spokeNetworking"
click node_vwan "https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/vwanConnectivity"
click node_peering "https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/vnetPeering"
click node_logging "https://github.com/jtracey93/alz-bicep/blob/main/infra-as-code/bicep/modules/logging/logging.bicep"
click node_diagnostics "https://github.com/jtracey93/alz-bicep/blob/main/infra-as-code/bicep/modules/mgDiagSettings/mgDiagSettings.bicep"
click node_attribution "https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/CRML/customerUsageAttribution"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_management,node_placement,node_resourcegroup toneBlue
class node_definitions,node_assignments,node_roles,node_roleassignments,node_azure toneAmber
class node_hub,node_spoke,node_vwan,node_peering toneMint
class node_logging,node_diagnostics,node_attribution toneRose
class node_operator toneIndigo
```

## Components

### Platform foundation

- [Management groups](https://github.com/jtracey93/alz-bicep/blob/main/infra-as-code/bicep/modules/managementGroups/managementGroups.bicep): `infra-as-code/bicep/modules/managementGroups/managementGroups.bicep`
- [Subscription placement](https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/subscriptionPlacement): `infra-as-code/bicep/modules/subscriptionPlacement`
- [Resource groups](https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/resourceGroup): `infra-as-code/bicep/modules/resourceGroup`

### Governance and policy

- [Policy definitions](https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/policy/definitions): `infra-as-code/bicep/modules/policy/definitions`
- [Policy assignments](https://github.com/jtracey93/alz-bicep/blob/main/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep): `infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep`
- [Custom roles](https://github.com/jtracey93/alz-bicep/blob/main/infra-as-code/bicep/modules/customRoleDefinitions/customRoleDefinitions.bicep): `infra-as-code/bicep/modules/customRoleDefinitions/customRoleDefinitions.bicep`
- [Role assignments](https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/roleAssignments): `infra-as-code/bicep/modules/roleAssignments`

### Connectivity

- [Hub networking](https://github.com/jtracey93/alz-bicep/blob/main/infra-as-code/bicep/modules/hubNetworking/hubNetworking.bicep): `infra-as-code/bicep/modules/hubNetworking/hubNetworking.bicep`
- [Spoke networking](https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/spokeNetworking): `infra-as-code/bicep/modules/spokeNetworking`
- [Virtual WAN](https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/vwanConnectivity): `infra-as-code/bicep/modules/vwanConnectivity`
- [VNet peering](https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/modules/vnetPeering): `infra-as-code/bicep/modules/vnetPeering`

### Operations and telemetry

- [Logging services](https://github.com/jtracey93/alz-bicep/blob/main/infra-as-code/bicep/modules/logging/logging.bicep): `infra-as-code/bicep/modules/logging/logging.bicep`
- [Diagnostic settings](https://github.com/jtracey93/alz-bicep/blob/main/infra-as-code/bicep/modules/mgDiagSettings/mgDiagSettings.bicep): `infra-as-code/bicep/modules/mgDiagSettings/mgDiagSettings.bicep`
- [Usage attribution](https://github.com/jtracey93/alz-bicep/tree/main/infra-as-code/bicep/CRML/customerUsageAttribution): `infra-as-code/bicep/CRML/customerUsageAttribution`

### Other components

- **Platform engineer**
- **Azure resources**

## Connections

- Platform engineer → Management groups: deploys individually (evidence: `README.md`)
- Platform engineer → Subscription placement: deploys individually (evidence: `README.md`)
- Platform engineer → Resource groups: deploys individually (evidence: `README.md`)
- Platform engineer → Policy definitions: deploys individually (evidence: `README.md`)
- Platform engineer → Policy assignments: deploys individually (evidence: `README.md`)
- Platform engineer → Custom roles: deploys individually (evidence: `README.md`)
- Platform engineer → Role assignments: deploys individually (evidence: `README.md`)
- Platform engineer → Hub networking: deploys individually (evidence: `README.md`)
- Platform engineer → Spoke networking: deploys individually (evidence: `README.md`)
- Platform engineer → Virtual WAN: deploys individually (evidence: `README.md`)
- Platform engineer → VNet peering: deploys individually (evidence: `README.md`)
- Platform engineer → Logging services: deploys individually (evidence: `README.md`)
- Platform engineer → Diagnostic settings: deploys individually (evidence: `README.md`)
- Platform engineer → Usage attribution: deploys individually (evidence: `README.md`)
- Management groups → Azure resources: deploys resources (evidence: `README.md`)
- Subscription placement → Azure resources: deploys resources (evidence: `README.md`)
- Resource groups → Azure resources: deploys resources (evidence: `README.md`)
- Policy definitions → Azure resources: deploys resources (evidence: `README.md`)
- Policy assignments → Azure resources: deploys resources (evidence: `README.md`)
- Custom roles → Azure resources: deploys resources (evidence: `README.md`)
- Role assignments → Azure resources: deploys resources (evidence: `README.md`)
- Hub networking → Azure resources: deploys resources (evidence: `README.md`)
- Spoke networking → Azure resources: deploys resources (evidence: `README.md`)
- Virtual WAN → Azure resources: deploys resources (evidence: `README.md`)
- VNet peering → Azure resources: deploys resources (evidence: `README.md`)
- Logging services → Azure resources: deploys resources (evidence: `README.md`)
- Diagnostic settings → Azure resources: deploys resources (evidence: `README.md`)
- Usage attribution → Azure resources: deploys resources (evidence: `README.md`)