landing-zone-vending

Landing zone (subscription) vending

Overview

Subscription vending standardizes how an organization requests, deploys, and governs subscriptions so application teams get a ready-to-use application landing zone quickly while the platform team retains governance. The platform team owns an automated pipeline that collects a validated request, creates the subscription with infrastructure as code, applies networking, identity, RBAC, policy, and a preliminary budget, and then hands the subscription off to the application team. This is the implementation pattern that operationalizes subscription democratization at scale; it builds on the resource organization and governance design areas and deploys with the AVM sub-vending modules.

When to use this skill

• Designing or reviewing a self-service subscription vending process.
• Defining the data to collect for a subscription request and how it is validated and approved.
• Building the Gitflow + parameter-file automation that creates subscriptions.
• Designing the deployment pipeline tasks (identity, governance, networking, budgets, reporting).
• Planning the platform-team → application-team handoff and ongoing governance.
• Implementing with the Bicep or Terraform sub-vending modules.

Key concepts

• Three automation tasks (the article's workflow):
  1. Collect data — gather and validate the request (authorizer, cost center, connectivity needs, environments, data sensitivity) via an ITSM/Power Apps/portal tool; produce a trackable, approved request that triggers automation.
  2. Initiate platform automation — a request pipeline turns the approved request into a single subscription parameter file (JSON/YAML/TFVARS), opens a pull request into main; merging triggers deployment (Gitflow).
  3. Create the subscription — a deployment pipeline runs the IaC sub-vending module to create and configure the subscription.
• One parameter file per subscription — the subscription is the unit of deployment. For Terraform, use a dedicated state file per subscription to limit blast radius and speed up plan/apply.
• Deployment pipeline task categories — Identity (ownership, workload identities), Governance (management-group placement, RBAC, policy assignment, Defender for Cloud), Networking (VNet + peering to the regional hub), Budgets (preliminary budget), Reporting (IPAM commit, notify the app team).
• Commercial agreement required — programmatic subscription creation needs an EA/MCA billing scope; without one, the creation step is manual but everything else can still be automated.
• Workload identity — the pipeline authenticates with managed identity or OIDC, never stored secrets.
• Handoff — the platform team hands the configured subscription to the app team, which updates the budget and deploys the workload; the platform team keeps governance ownership.