Sovereign Landing Zone (SLZ) implementation options

The Sovereign Landing Zone (SLZ) is a variant of the Azure landing zone that helps organizations implement sovereign controls, such as data residency, customer managed keys, externally managed encryption keys, encryption at rest, encryption in transit, confidential computing, and operational oversight. There's no single mandated deployment path. Organizations can adopt SLZ capabilities incrementally or as a full variant of an existing Azure landing zone.

Important

SLZ is an architectural variant. You don't need to replace your Azure landing zone implementation. Instead, layer sovereign design choices, controls, and policies. Start from your existing landing zone unless critical structural gaps exist.

Implementation options

To deploy and manage your Sovereign landing zone (SLZ), use any of the following implementation options.

Terraform

The Sovereign Landing Zone (SLZ) implementation is currently available only through the Terraform Azure Verified Modules for the platform landing zone. You can deploy these modules either manually or by using the (recommended) Azure landing zone accelerator.

Azure landing zone accelerator high-level process overview

The best way to deploy Sovereign Platform Landing Zone (SLZ) is via the Azure landing zone accelerator. It provides a guided experience to help you set up a landing zone aligned to your organization's needs. The following list describes the high-level steps to follow.

Important

You must follow the steps in the user guide. The following steps are a high-level summary only.

  1. Select Infrastructure-as-Code (IaC) tool - Terraform
  2. Select Version Control System (VCS) - GitHub or Azure DevOps
  3. Select a Scenario
  4. Select Options to tweak your platform landing zone deployment
  5. Ensure prerequisites are met
  6. Deploy Bootstrap
  7. Run CD to deploy platform landing zone
  8. Iterate, customize, and extend your landing zone via your chosen VCS and Continuous integration and continuous delivery (CI/CD) pipelines

Bicep

You can implement the Sovereign Landing Zone (SLZ) using Bicep. This option follows the Azure landing zone accelerator deployment pattern and uses a compact SLZ package to add the sovereign management group and policies to a platform landing zone.

The SLZ package includes the required .config and templates folders from the Azure/alz-bicep-accelerator repository. By using these files, you can overlay SLZ-specific configuration during bootstrap and deploy the platform landing zone through the generated CI/CD workflow.

Before you deploy the bootstrap, run the following PowerShell script to copy the SLZ package to the accelerator configuration folder:

$tempFolderName = "~/temp"
New-Item -ItemType "directory" $tempFolderName
$tempFolder = Resolve-Path -Path $tempFolderName
git clone -n --depth=1 --filter=tree:0 "https://github.com/Azure/alz-bicep-accelerator" "$tempFolder"
cd $tempFolder
$configFolderPath = "examples/slz/.config"
$templatesFolderPath = "examples/slz/templates"
git sparse-checkout set --no-cone $configFolderPath $templatesFolderPath
git checkout
cd ~
Copy-Item `
 -Path "$tempFolder/$configFolderPath" `
 -Destination "~/accelerator/config" `
 -Recurse `
 -Force
Copy-Item `
 -Path "$tempFolder/$templatesFolderPath" `
 -Destination "~/accelerator/config" `
 -Recurse `
 -Force
Remove-Item -Path $tempFolder -Recurse -Force

Important

Follow the complete instructions in the user guide. The following steps provide only a high-level overview.

  1. Select Infrastructure-as-Code (IaC) tool - Bicep
  2. Select Version Control System (VCS) - GitHub or Azure DevOps
  3. Select a Scenario
  4. Overlay the SLZ-specific configuration from the examples/slz/.config and examples/slz/templates folders
  5. Ensure prerequisites are met
  6. Deploy Bootstrap
  7. Run CD to deploy platform landing zone
  8. Iterate, customize, and extend your landing zone through your chosen VCS and CI/CD pipelines.

Azure landing zone library

Both Terraform and Bicep implementations of SLZ use the Azure landing zone library, a collection of resources to help you build and manage governance on Azure.

The library includes Azure Policy assets, together with a series of constructs that result in a deployable architecture. It's extensible, customizable, and flexible. It supports many implementation approaches and scenarios.

You can find the SLZ library assets in the platform/slz directory of the Azure landing zone library.

Note

The SLZ library takes a dependency, as detailed further here, on the Azure landing zone library (platform/alz directory) as you can see in the dependencies section of the SLZ's alz_library_metadata.json file.

For more information, see the following sections in the Azure landing zone library documentation:

Next steps

See also

  • Last updated on