Azure Production Landing Zone
Tiered foundation, one apply — toggle on edge, compute, and data.
The Azure sibling of the landing-zone pattern. Foundation (always on): a resource-group baseline, a VNet with a single NAT gateway, Key Vault (keys and secrets), a hardened storage account, a workload managed identity, and a Monitor baseline (Log Analytics + App Insights + alerting). Flip enable_edge for a DNS zone + TLS cert, enable_compute for an Application Gateway (WAF_v2) in front of Container Apps, and enable_data for PostgreSQL Flexible Server + Redis Cache. tofu validate is clean with everything off and everything on.
How it composes
Foundation (always on): the resource group is created first and threads its name + location through every module; the VNet carries app/gateway/data subnets; Key Vault holds keys and secrets; Monitor collects logs and alerts. enable_edge adds a DNS zone + edge TLS cert; enable_compute adds an Application Gateway (WAF_v2) fronting Container Apps; enable_data adds Burstable PostgreSQL Flexible Server + Basic Redis Cache.
Composed root - live-tested 2026-08-04
This stack ships a single OpenTofu/Terraform root module that wires its modules together, statically validated with tofu validate. Set your domain and CIDRs in terraform.tfvars, then tofu init && tofu apply. We also ran the root itself through a real apply → verify → destroy cycle. Foundation tier (all toggles off): 27 resources applied against a real Azure subscription, every foundation output verified, and everything destroyed back to an empty state.
Modules in this stack
- 1Resource Group + Naming/Tagging Baseline✓ live-testedOpinionated resource group factory with CAF-compliant naming, mandatory tags, locks and budget alert.$29.00
- 2Azure Virtual Network (hub-ready)✓ live-testedProduction VNet with subnets, NSGs, route tables, peering and optional NAT Gateway - the network backbone every Azure deployment starts with.$59.00
- 3Azure Key Vault✓ live-testedRBAC-mode Key Vault with private endpoint, diagnostics, and managed keys/secrets/certificates scaffolding.$29.00
- 4Azure Storage Account (secure-by-default)✓ live-testedStorage account with containers/file shares, lifecycle rules, network rules, CMK encryption and private endpoint options - Azure's most-deployed resource done right.$29.00
- 5User-Assigned Managed Identities✓ live-testedA map-driven module creating one or many user-assigned managed identities, each with optional workload identity federation (OIDC) and least-privilege RBAC role assignments - no secrets to rotate.$29.00
- 6Azure Monitor & Log Analytics Baseline✓ live-testedCentral Log Analytics workspace, diagnostic-settings-everywhere pattern, action groups and starter alert pack (metric + log + activity).$59.00
- 7Azure Public DNS Zone & Records✓ live-testedAn Azure public DNS zone plus a map-driven set of record sets - A, AAAA, CNAME, TXT, MX, NS, CAA and SRV - with relative naming, verbatim TXT values, and apex footgun guards.$0.00
- 8Application Gateway v2 + WAF✓ live-testedRegional L7 load balancer with WAF v2 policy, TLS termination from Key Vault, autoscaling and health probes.$59.00
- 9Azure Container Apps Environment✓ live-testedContainer Apps environment with workload profiles, Dapr, KEDA scale rules, ACR pull identity and custom domain.$179.00
- 10PostgreSQL Flexible Server✓ live-testedFlexible Server with HA option, private VNet delegation, Entra auth, firewall and tuned server parameters.$179.00
- 11Azure Cache for Redisstatic-validatedAzure Cache for Redis done cheap by default - the Basic C0 tier with TLS 1.2 minimum and the non-SSL port disabled - scaling cleanly up to Standard and Premium via precondition-guarded inputs.$179.00