Platform Features (Enable / Disable)¶
Standard change: Update Azure Cloud Landing Zone features/Resource
Effect: an existing platform feature (VPN gateway, Bastion, Application Gateway, private DNS zones, DDoS plan, Sentinel, …) is switched on or off. Switching on creates its resources. Switching off destroys them.
Scope boundary. Only features that already exist in the codebase are a standard change, which means a flag in the feature flags reference. Anything that needs new Terraform is a development change in the code repository.
Request fields¶
| Field | Use |
|---|---|
| Feature / Resource type | Which flag (see the reference) |
| Rationale | pull request |
| Environment | Platform environment and region(s) |
| Comments | Required companion values (SKU, address ranges, peer IPs, …) |
Steps¶
- Find the flag in the feature flags reference and open its variables file in
infra/deploy/<layer>/. Note: - its default;
- the companion variables the feature needs (names, SKU, subnet, address space, peer configuration).
- Check the current value in
<env-folder>/<region>/<layer>.auto.tfvars. If the variable is not set, the default applies. - Edit the tfvars of each region where the feature should change:
# <env-folder>/weu/connectivity.auto.tfvars
create_bastion_host = true
Add the companion variables in the same file.
4. Plan with hub (mode Plan or ApproveModifications). The changes should be limited to the layer and region
you edited.
- Enabling: only + resources for the feature.
- Disabling: only - resources for the feature. Check nothing else depends on them, for example: firewall rules on a
firewall that is removed, App Gateway listeners in use, VPN tunnels with on-premises sites.
5. Apply to canary, verify, then prod.
Examples¶
| Feature | Flag (layer) | Companion settings to review | Notes |
|---|---|---|---|
| Azure Bastion | create_bastion_host (connectivity) |
Bastion variables in variables_virtual_network_hub.tf |
|
| Site-to-site VPN | create_vpn_gateway (connectivity) |
variables_virtual_hub.tf VPN settings (sites, links, BGP) |
Coordinate with the on-premises network team. |
| Private DNS resolver forwarding rules | private_dns_resolver_forwarding_rules (connectivity) |
see DNS conditional forwarder | Adds conditional forwarding to DNS servers outside Azure. |
| Point-to-site VPN | create_point_to_site_vpn_gateway (connectivity) |
point_to_site_vpn_* variables, point_to_site_vpn_gateway_dns_servers |
The DNS baseline config test requires the P2S DNS server to equal virtual_network_dns_servers. See also Enable the point-to-site VPN feature and Reach private resources from a dev container. |
| ExpressRoute | create_express_route_gateway, create_express_route_connection, use_express_route_circuit_module (connectivity) |
circuit/peering variables | |
| Application Gateway | use_application_gateway_module, use_web_application_firewall_policy_module (connectivity) |
JSON folders and patterns, public IP zones | See Application Gateway. |
| Private DNS zones | create_private_dns_zones (connectivity) |
Private DNS zones are global resources. The sample configuration enables them in one region only. | |
| DDoS protection | create_network_ddos_protection_plan (foundation), virtual_network_hub_ddos_protection_plan_enable (connectivity/management) |
A DDoS plan has a significant fixed monthly cost. | |
| Sentinel | deploy_sentinel (management) |
||
| Defender for spokes | enable_defender_for_cloud_for_spokes (postdeployment) |
Adds Defender cost per spoke subscription. | |
| Hub 24/7 alert routing | hub_247_support (connectivity) |
webhook_url (required when enabled), time window |
See Monitoring rules. |
Cost-saving in canary¶
ADR-0006 describes switching off expensive components in the canary environment (Azure Firewall, Application Gateway) with these flags, and switching them back on when needed. The ADR estimates the recreation time at 20–30 minutes. The scheduled clean-up template it mentions is not in this repository.
Verify¶
The resource exists (enable) or is gone (disable) in the Azure portal, and the next hub plan shows no changes for it.
Roll back¶
Set the flag back and run hub. A re-created resource is new: it gets new public IPs, new keys and an empty
configuration where state lived only in Azure. Plan for that.