plan-forge landing-zone.instructions.md

Azure Landing Zone Standards

Based on the Azure Landing Zone conceptual architecture. Landing Zones are the enterprise rulebook — the infrastructure baselines that every workload subscription must conform to before workload code is deployed.

---

Architecture Overview

                    ┌──────────────────────────────────┐
                    │         Management Baseline       │
                    │  Log Analytics · Automation ·    │
                    │  Backup · Update Mgmt · ASC       │
                    └────────────────┬─────────────────┘
                                     │ feeds
┌───────────────┐   ┌────────────────▼─────────────────┐   ┌──────────────────┐
│ Identity      │   │         Security Baseline         │   │ Network Baseline │
│ Baseline      │──►│  Defender · Sentinel · JIT ·     │◄──│ Hub-Spoke · AFW  │
│ AAD · PIM ·   │   │  SIEM · CVA · Secure Score       │   │ NSG · UDR · DNS  │
│ CA · MFA      │   └────────────────┬─────────────────┘   └──────────────────┘
└───────────────┘                    │ enforced by
                    ┌────────────────▼─────────────────┐
                    │         Policy Baseline           │
                    │  Initiatives · Deny · Audit ·    │
                    │  DeployIfNotExists · Remediation  │
                    └────────────────┬─────────────────┘
                                     │ governs
                    ┌────────────────▼─────────────────┐
                    │  Workload Subscriptions           │
                    │  (Corp · Online · Sandbox)        │
                    └──────────────────────────────────┘

---

Identity Baseline

// ✅ User-assigned managed identity per workload (not system-assigned)
// ✅ No service principals with client_secret in production
// ✅ PIM for all Owner/Contributor role assignments (no standing access)

// PIM role assignment via Bicep (eligible, not active)
resource pimRoleEligibility 'Microsoft.Authorization/roleEligibilityScheduleRequests@2022-04-01-preview' = {
  name: guid(subscription().id, principalId, contributorRoleId)
  properties: {
    principalId: principalId
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', contributorRoleId)
    requestType: 'AdminAssign'
    scheduleInfo: {
      startDateTime: utcNow()
      expiration: { type: 'NoExpiration' }
    }
    ticketInfo: {}
  }
}