Azure/caf-enterprise-scale

Azure landing zones Terraform module.

Terraform module
Azure
available
Placeholder. This template is not in the library yet. Deploy opens the platform so you can start from your own repository; tell us there if you want this one.
Downloads
1.6M
Version
6.3.1
Published
2025-07-28
License
MIT
Maintainer
Azure
Verified

About

Azure landing zones Terraform module.

Maintained by Azure (verified publisher) on the Terraform Registry. Latest version 6.3.1, 1.6M downloads. Requires providers: azurerm ~> 3.108; azapi ~> 1.13; random ~> 3.6; time ~> 0.11.

Deploy creates a StackGuardian workflow from the module's GitHub repository, pinned to this version. You set the inputs, see the plan, then approve the apply.

Use cases

  • Accounts, projects or subscriptions vended with guardrails already in place.
  • Compute and container platforms that teams can request from a catalog.
  • Organization-wide controls applied through code with approvals.

Inputs

Required inputs:

  • root_parent_id — string
  • default_location — string

39 inputs, 31 outputs in total. The full list, with defaults and descriptions, is on the registry page.

What it creates

  • azurerm_management_group × 6
  • azurerm_role_assignment × 6
  • azurerm_subscription_template_deployment × 4
  • azurerm_resource_group × 3
  • azapi_resource × 2
  • azurerm_firewall × 2
  • azurerm_firewall_policy × 2
  • azurerm_automation_account
  • azurerm_dns_zone
  • time_sleep × 6

How it runs on StackGuardian

Terraform workflow from the module's GitHub repository: plan, policy check, approval, then apply.

Plan
Policy check
Approval
Apply

Approvals happen in StackGuardian. An agent can never approve its own run. Every run keeps its plan, policy results and approver in the audit log.

Pick a template. Deploy it with guardrails.

Deploy your first templateBrowse templates