IaC Bazaar
AzureLive-tested

Azure Landing Zone Core

Management-group hierarchy, policy baseline (ALZ-aligned), centralized logging and RBAC scaffolding - the flagship enterprise starter.

terraformAzure#azure
azure-landing-zone-coreterraform v1.7

Verification

Live-tested

Really deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.

Conformance

  • Static validation (fmt · validate · tflint)
  • Security scan clean (Checkov)
  • Plan test superseded by live test

Provenance

Functional

  • Live-tested - applied, verified, destroyed

Last verified 2026-06-29 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o azure-landing-zone-core-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/azure-landing-zone-core/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle azure-landing-zone-core-1.0.0.sigstore.json \
  azure-landing-zone-core-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "d9ee1bde04ac67a395b65ad53593a7aa369ca52f445832c57a3e0c20b06a7c3c  azure-landing-zone-core-1.0.0.tar.gz" | sha256sum -c
Signature bundlePublic keyMachine-readable receiptHow we verify

Use it from the registry

terraform · opentofu
module "landing_zone_core" {
  source  = "www.iac-bazaar.com/iac-bazaar/azure-landing-zone-core/azure"
  version = "1.0.0"
}

Paid module — needs a purchase (or a subscription that covers it) plus a registry token from /account/tokens. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract — every input name, type, default and description, plus every output — is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every Free module. This one is Architecture, so its contract unlocks when you buy it.

Create a free account →Sign in

Documentation

azure-landing-zone-core

Status: static-validated, live-test pending. Ships under live-test quarantine — a live apply needs tenant-root / Management Group Contributor permissions in a dedicated test tenant, so the apply→verify→destroy gate runs once such a sandbox is available. Statically validated (fmt, validate, tflint).

The flagship enterprise starter: a management-group hierarchy, an optional centralized Log Analytics workspace, custom Azure Policy definitions with management-group-scoped assignments, and custom RBAC role definitions and assignments. ALZ-aligned by default, but small, transparent and fully parameterised — original work, not a wrapper over avm-ptn-alz, so you own the graph and can read every resource it creates.

Design & secure defaults

  • ALZ-aligned default hierarchy under your root MG: Platform, Landing Zones (with Corp and Online children), Sandbox, Decommissioned. Override child_management_groups to reshape it; child parent references are validated so you can't point at a missing parent.
  • Key-based references throughout. Subscriptions, policy assignments and role assignments target management groups by key (root or a child key), resolved to IDs internally — preconditions fail the plan on a typo'd key instead of producing a misplaced assignment.
  • Policies enforced by default (enforce = true) — not audit-only. Custom definitions are created at the root MG and can be referenced from an assignment as custom:<name>; built-in policy/initiative IDs work directly.
  • Centralized workspace: Entra-only auth (local_authentication_enabled = false), bounded retention (90 days), optional daily cap.
  • Least-privilege custom roles: defined and assignable at the root MG; assignments accept either a built-in role_definition_name or a custom_role_key, and a precondition enforces exactly one.

Works with Terraform and OpenTofu (>= 1.6), azurerm provider >= 4.0, < 5.0.

Requirements

RequirementVersion
Terraform / OpenTofu>= 1.6
hashicorp/azurerm>= 4.0, < 5.0

License

Commercial — LicenseRef-IaCBazaar-Commercial. © IaC Bazaar. Original work (not derived from a third-party module).

Usage code & full reference unlock after purchase

The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.

  • Usage
  • Inputs
  • Outputs
  • Notes