<- Back to featured projects

Draft Case Study

Azure Landing Zone and Terraform/OpenTofu Automation

Teams need consistent subscription onboarding and policy controls without duplicating infrastructure code.

AzureTerraformOpenTofuGovernance

Problem

Teams need consistent subscription onboarding and policy controls without duplicating infrastructure code.

Architecture

Draft architecture uses modular Terraform/OpenTofu components for management groups, policy assignments, networking, and baseline observability.

Mgmt GroupsPolicyNetworkingObservability
Sanitized diagram of modular landing zone components and governance layers.

Reference/proposed architecture diagram for portfolio demonstration. Not a client production architecture.

View sanitized landing zone diagram

Architecture Explorer

Landing Zone / IaC: Sanitized modular governance and platform baseline.

Proposed

Data flow: Platform policy and network baselines propagate from governance layers to shared services and observability.

Accessible alternative: use the component buttons below to inspect architecture details without zoom.

Legend

  • Ingress / Trigger
  • Orchestration
  • Data / Storage
  • Security
  • Observability
  • Operations
  • Management Groups -> Policy Assignments (governance scope)
  • Policy Assignments -> Shared Networking (policy baseline)
  • Shared Networking -> Workload Subscriptions (shared connectivity)
  • Shared Networking -> Diagnostics Workspace (diagnostic routing)
  • Workload Subscriptions ~> Diagnostics Workspace (platform telemetry)

Component Details

Management Groups

Organize subscription hierarchy and governance inheritance.

Responsibilities: Hierarchy control | Policy scope boundaries

Security controls: Least-privilege role assignments | Policy inheritance governance

Dependencies: Policy Assignments

Design decisions: Use modular hierarchy definitions to avoid monolithic platform templates.

  • Reference diagram uses generic naming only.
  • No tenant, subscription, or private network details included.

Security

Draft security model applies least privilege, policy-as-code, and secure state management patterns.

Verified Outcomes

  • Draft: improved governance consistency across onboarding workflows.
  • Draft: reduced manual configuration drift in platform baselines.

Design Decisions

  • Use module composition over monolithic templates to support environment-specific policy layering.
  • Separate governance controls from workload modules to keep policy updates independent.
  • Adopt deterministic naming and tagging conventions for predictable onboarding automation.

Implementation

  • Create reusable OpenTofu/Terraform modules for hierarchy, networking, policy assignment, and diagnostics.
  • Define environment overlays to standardize defaults while allowing approved exceptions.
  • Validate module behavior with plan checks before promotion to shared module registries.

Trade-offs

  • Stronger governance can slow edge-case onboarding when exceptions are not pre-modeled.
  • Reusable modules increase consistency but require disciplined version management.

Engineering Evidence

Implemented demo evidence

Implemented Source Files

Architecture Evidence

Diagram classification: Proposed

Sanitized data flow: Governance hierarchy applies policy and shared networking baselines, then workload subscriptions emit diagnostics to centralized observability.

Diagram source id: azure-landing-zone-iac-modules

Evidence pending: no implemented demo route is linked for this case study.

Automated Tests and Results

  • IaC file presence, module composition, validation rules, and README command coverage

    tests/landing-zone-iac.test.ts

  • Diagram data schema and sanitization checks

    tests/architecture-explorer.test.ts

Latest test run (2026-09-26): Repository tests pass, including landing-zone file/module/validation-command checks. Terraform/OpenTofu CLI checks are not performed in this environment because the CLIs are unavailable.

Command: node_modules/.bin/tsc.cmd -p tsconfig.test.json && node --test .test-dist/tests/**/*.test.js (includes landing-zone-iac tests)

Latest build run (2026-09-26): Production build completed successfully with prerendered case-study routes and both interactive demo routes.

Command: node_modules/.bin/next.cmd build

Limitations and Verification Gaps

  • This is a sanitized local demonstration and does not execute terraform apply in this repository workflow.
  • Azure deployment verification is explicitly not performed in this repository evidence set.

Evidence Pending

  • Run terraform/tofu fmt, init, validate, and plan locally where Terraform/OpenTofu CLI is installed, then capture outputs.
  • Azure deployment verification: Not performed / Evidence pending.

Evidence Status

  • Local checks: Local repository checks executed (lint, typecheck, node tests, Next.js build). Terraform/OpenTofu CLI checks not performed in this environment.
  • CI checks: CI workflow added for fmt/init/validate/plan/tfsec without Azure credentials.
  • Azure deployment: Not performed / Evidence pending. No Azure subscription deployment executed.

Reproduction and Dependencies

Dependencies

  • Node.js (current project uses Next.js 16.x, React 19.x, TypeScript 6.x)
  • npm install
  • Local binaries under node_modules/.bin for lint/typecheck/test/build

Reproduction steps

  1. cd infrastructure/landing-zone
  2. terraform fmt -check -recursive
  3. terraform init -backend=false
  4. terraform validate
  5. terraform plan -refresh=false -var-file=terraform.tfvars.example -out=tfplan
  6. Open /projects/azure-landing-zone-iac-modules and /diagrams/landing-zone-sanitized.svg