landing-zone-vnet

Type: decision

Decision

Each landing zone has its own isolated VNet with no connectivity to other landing zones or on-premises networks.

Why

A shared networking solution would introduce fixed costs, breaking the no-fixed-cost principle.

Violations

• VNet provisioned outside the landing-zone-resources stack.
• Private Link/endpoint configuration on platform managed services.

Links

• azure-policy-hard-deny — Deny policies enforce PaaS firewall restrictions — without them, VNet is accessible from public endpoints.
• landing-zone-ipam — IPAM allocates the VNet's address space, defaulting to a /24.
• landing-zone-github-runners — Github runners is what requires a dedicated subnet to exist in the VNet.
• landing-zone-ownership — The stack's deny settings lock the VNet but exclude subnet actions — subnet configuration belongs to the application team.

← Back to knowledge graph