add-automation-job

Type: regulative

Decision

A new automation job must run as the landing zone identity, against the ARM API, from a publicly pullable image.

A job needing its own identity, a data-plane path, or an authenticated base image cannot run unattended in every landing zone.

Automation job authenticating with its own secret instead of the landing zone identity.
Job image hosted in a registry requiring authentication.

Read the rules this process is governed by, to understand access, identity, and image constraints before writing any code.
Implement the job logic under landing-zones/automation/, using the ARM API alone with no data-plane or VNet-dependent calls.
Add a Dockerfile whose base image is pullable from a public registry without authentication.
Register the job in landing-zones/bicep/modules/landingzone-automation.bicep, following the existing job definition pattern.
Verify the job authenticates as the landing zone identity, with no separate identity or secret.
Present a complete draft of all changes before implementing.