destroy-landing-zone

Type: regulative

Decision

A landing zone must be decommissioned through lz-flow-destroy-landing-zone, which returns its subscription to the bank.

Why

Deleting resources by hand cancels the subscription instead of returning it, and the quota is not released.

Violations

• Landing zone resources deleted by hand instead of through the workflow.
• Subscription cancelled rather than returned to the bank.

Anchor

no-platform-ops

Implements

• landing-zone

Steps

1. Read the rules this process is governed by, to understand what is being destroyed and what constraints apply.
2. Collect from the user: subscription ID of the landing zone to decommission.
3. Verify the bicepparam file and the lz-oasis-{appName}-{env} workflow both exist. Stop if either is missing.
4. Present what will be permanently destroyed: deployment stack, resource groups, role assignments, budget, Defender settings. Confirm the subscription returns to the bank. Wait for explicit confirmation.
5. Trigger lz-flow-destroy-landing-zone via workflow_dispatch with the subscription ID. Leave the file deletions to the workflow.

Files

• landing-zones/oases-prod/
• .github/workflows/

Links

• deployment-declarative-lifecycle (governed-by)
• application-teams-own-the-cost (governed-by)

← Back to knowledge graph