Project: Terraform Azure Landing Zone Lite

This is a compact Azure landing-zone project that shows how I approach a cloud foundation, not just individual resource deployment. The code is being prepared for publication; this page tracks the scope and controls included in the project.

The goal is a small Azure landing zone that is realistic enough to show engineering judgement, but safe enough to run as a public portfolio project without exposing secrets or creating unnecessary cost.

What the project includes

1. Reusable Terraform modules for resource groups, networking, diagnostics, policy assignments, budgets, and standard tags.
2. Example environments for dev, test, and prod.
3. GitHub Actions checks for terraform fmt, terraform validate, tflint, and Checkov.
4. A short security decision record for each baseline control.
5. GitHub OIDC documentation so CI does not rely on static Azure credentials.

Controls included

• Mandatory tags for ownership and cost allocation.
• Diagnostic settings enabled by default.
• Policy assignments that block risky defaults.
• Budget alerts so cost governance is part of the platform.
• Least-privilege deployment identity through federated credentials.

Why this matters

Landing zones are where DevSecOps either becomes easy or becomes theatre. If the platform gives teams secure defaults, teams ship faster. If every project starts from a blank subscription, security becomes a review meeting instead of an engineering control.

The public version stays deliberately small, with a pattern that keeps the compliant path straightforward for teams using it.