Skip to content

Azure Landing Zone Cheat Sheet

Search keywords: Azure landing zone hub spoke Terraform CDKTF architecture governance security networking

30-second answer

An Azure landing zone is a standardized foundation for running workloads in Azure. It defines how environments and regions are organized, networking and connectivity, security controls, governance, identity, monitoring and shared services. In my project, Terraform/CDKTF was used to codify those patterns and make them reusable across environments and regions.

Mental model

Landing Zone
├── Organization / Management
├── Identity & Access
├── Governance
├── Networking
├── Security
├── Monitoring / Operations
└── Workload foundations

Why use one?

Consistency → Security → Governance → Isolation → Scalability

Hub-and-spoke

                 HUB
        ┌─────────┼─────────┐
        │         │         │
     Firewall    DNS      Bastion
        │
   ─────┼────────────────────
        │              │
     Spoke 1        Spoke 2
        │              │
     Workload       Workload

Hub: shared services such as firewall, DNS, Bastion, shared connectivity and centralized security controls.

Spokes: workload isolation, application environments and controlled connectivity to shared services.

Your actual project

Based on your current recollection:

  • Typically test + production environments.
  • Regions could include EMEA, America and Asia.
  • Each region had a hub structure.
  • Shared services included firewall, DNS, Bastion and security controls.
  • Your main hands-on responsibility was Terraform/CDKTF module implementation.

Your role — safe interview answer

My main responsibility was implementing the landing zone architecture through Terraform/CDKTF. I wasn't the sole architect of the entire landing zone, but I needed to understand how networking, shared services, environments and workload resources fitted together in order to implement the modules correctly.

New region

Think:

Existing modules → region-specific configuration → required resources → deployment

Key phrase:

Configuration and module composition rather than rebuilding from scratch.

Landing Zone vs Terraform

Landing Zone
    ↓
Architecture / operating model
    ↓
Networking / security / governance / identity / operations
    ↓
Terraform / CDKTF
    ↓
Implementation mechanism

Architecture vs implementation

If asked whether you designed it:

I was primarily on the implementation side, particularly the Terraform/CDKTF modules. However, I had to understand the architecture and dependencies because the modules had to fit into the overall landing zone design. I wouldn't claim that I was the sole architect of the entire landing zone. My strength was taking the architecture and turning it into reusable, deployable infrastructure-as-code.

Troubleshooting: workload → Internet

Workload
  ↓
NSG
  ↓
Route / Subnet
  ↓
Spoke
  ↓
Hub / connectivity
  ↓
Firewall / outbound path
  ↓
Internet

Check each hop rather than jumping immediately to the application.

Architecture questions to ask yourself

  1. Why? What business/technical problem are we solving?
  2. Boundary? What is the isolation boundary?
  3. Network? How does traffic flow?
  4. Security? Where are preventive and detective controls?
  5. Governance? Who can deploy what, where and under which policies?
  6. Operations? How do we monitor, log, back up and troubleshoot?
  7. Automation? How do we reproduce it?
  8. Scale? What happens when we add an app, environment or region?
  9. Trade-off? What complexity are we introducing?