landing-zone-vnet

Type: decision

Decision

Each landing zone gets an isolated VNet, with no connectivity to other landing zones or on-premises networks.

Why

A shared networking solution would introduce fixed costs, breaking the zero-cost-on-idle principle.

Links

• deny-security-controls — PaaS service firewalls must restrict public network access.
• ipam — IPAM allocates the VNet's address space, defaulting to a /24.
• landing-zone-github-runners — Each VNet hosts its own runner subnet, registered with GitHub as a dedicated runner group.
• single-region — The VNet is provisioned in AZURE_DEFAULT_LOCATION; a second region would require a new VNet and a separate regional IPAM allocation.

← Back to all decisions