repository·main·Indexed 40 days ago
https://github.com/azure/azure-landing-zones-libraryA collection of resources and implementations for establishing scalable, secure, and well-architected Azure environments. It includes the ALZ Terraform provider, management group architectures, and a comprehensive set of archetypes with Azure Policy definitions, set definitions, and assignments. Additionally, it provides the AMBA (Azure Monitor Baseline Alerts for Azure Landing Zones) library for implementing baseline monitoring, alerting, and notification configurations across the landing zone hierarchy.
The complete documentation for the Azure Landing Zones Library is hosted on GitHub Pages. For detailed guides, technical specifications, and usage instructions, visit the official site.
https://azure.github.io/Azure-Landing-Zones-Library/The Azure Landing Zones Library is a collection of resources designed to assist in building and managing Azure governance. It consists of two primary components:
A concrete implementation example can be found in the platform/alz directory of the repository.
schemas/ directory contains JSON schemas for data types used within the Azure Landing Zones Library. These schemas are specifically provided for data structures that are not already defined by standard Azure resource schemas. Developers can use these schemas to validate custom configuration data or internal project objects used during the deployment or management processes.An archetype is a collection of assets that can be deployed to an Azure management group. To support extensibility, multiple archetypes can be deployed to the same management group.
An archetype definition must include a unique name and can reference associated assets such as policy definitions, policy set definitions, policy assignments, and role definitions. These assets are referenced by their exact name (the JSON .name property).
Archetype definition files must follow these filename patterns:
*.alz_archetype_definition.json*.alz_archetype_definition.yaml*.alz_archetype_definition.ymlname: "landing_zones"
policy_assignments:
- "Audit-AppGW-WAF"
- "Deny-IP-forwarding"
policy_definitions: []
policy_set_definitions: []
role_definitions: []An archetype override is a delta applied to an existing archetype. It allows you to modify the behavior of an archetype (adding or removing policy definitions, policy sets, assignments, or role definitions) without modifying the original archetype itself.
Best Practices:
name of the override is unique across all archetypes and override archetypes.name (the JSON .name property).name: "landing_zones_override"
base_archetype: "landing_zones"
policy_assignments_to_add: []
policy_assignments_to_remove:
- "Deny-IP-forwarding"
policy_definitions_to_add: []
policy_definitions_to_remove: []
policy_set_definitions_to_add: []
policy_set_definitions_to_remove: []
role_definitions_to_add: []
role_definitions_to_remove: []The Sovereign Landing Zone (SLZ) uses Archetypes to group related Azure Policy assignments. Each archetype represents a specific functional area or environment type (e.g., connectivity, corp, landing_zones, platform) and carries a set of guardrails to enforce security, compliance, and operational standards.
When deploying or managing an SLZ, you select archetypes to apply the corresponding policy assignments to your environment. For example, the landing_zones archetype provides extensive guardrails for various Azure services, while the connectivity archetype focuses on network-level protections like DDoS enablement.
The SLZ library provides two primary management group architectures. Both architectures are deployed as children of the user-supplied root management group.
alzThis architecture follows a standard hierarchy including:
decommissioned)landing_zones)corp)platform)connectivity)identity)sandbox)slzThis architecture is designed for sovereign requirements and includes specific control archetypes applied to management groups:
sovereign_l1_controls)decommissioned)landing_zones)corp, sovereign_l2_controls, sovereign_l3_controls)online, sovereign_l2_controls, sovereign_l3_controls)corp, sovereign_l2_controls)online, sovereign_l2_controls)platform)connectivity, sovereign_l2_controls)identity, sovereign_l2_controls)management, sovereign_l2_controls)security, sovereign_l2_controls)sandbox)When hosting your own version of the library, you can manage dependencies and naming conflicts using the following methods:
alz_library_metadata.json file in the root of your library directory to provide metadata and list any dependencies. Dependencies are transitive; you only need to list direct dependencies.library_references field of the provider configuration.By default, clients prevent adding assets that already exist in the library (e.g., creating an architecture named alz when using the platform/alz library). To resolve this:
library_overwrite_enabled to true.The alz architecture organizes management groups into a specific hierarchy. The root management group (Azure Landing Zones) contains several top-level branches:
decommissioned archetype).corp archetype).local archetype).platform archetype), which includes sub-branches for:connectivity archetype)identity archetype)sandbox archetype).The Azure Landing Zones Library uses a Calendar Versioning (CalVer) strategy for all library members. Versions follow the pattern library/path/YYYY.0M.P-modifier.
YYYY: The year of the release.0M: The zero-padded month of the release.P: The patch number, starting at 0.modifier: An optional suffix for pre-releases (e.g., alpha, beta, or rc).Breaking Changes Policy:
2024.01.x to 2024.02.x).2024.01.0 to 2024.01.1) are expected to be non-breaking.library/path/YYYY.0M.P-modifierAssets in the library are identified by filename patterns and read from library member directories. While you can organize files into directories for clarity, the directory structure is not considered during processing; assets are processed based on their names.
Key constraints and behaviors:
.name JSON property) of an asset must be unique for any given asset type. For example, you cannot have two policy definitions with the same name.