What the Platform Deploys: Azure Resource Catalogue¶

A reference of the Azure resources that the hub layers deploy, with the layer and the switch that controls each one. Use it to answer "is this part of the platform?", to scope an inventory (Asset management), and to find the flag to switch a feature on or off.

This page is a map. The settings are in the feature flags reference, the layer order is in Deployment layers, and the ways to change a feature are in Platform features.

Which resources exist depends on your configuration

Most resources are optional and are created only when their flag is on. The sample defaults in the reference are not your configuration. Read your <region>/<layer>.auto.tfvars files.

Networking¶

Azure resource	Role in the platform	Layer	Switch
Virtual WAN	Global transit network that connects regions, branches, users and spokes	`connectivity`	`create_virtual_wan`
Virtual hub	The regional hub in the Virtual WAN. A secured hub carries the firewall	`connectivity`	`use_virtual_hub_module`
Hub virtual network	Subnets, network security groups and route tables of the hub (Bastion, DNS resolver, Application Gateway)	`connectivity`	`use_virtual_network_hub_module`
Management and identity virtual networks	Networks of the management and identity subscriptions, connected to the hub	`management`, `identity`	`create_virtual_network`
VPN gateway (site-to-site)	Encrypted connectivity to on-premises sites	`connectivity`	`create_vpn_gateway`
Point-to-site VPN gateway	Remote users and developers, see Developer access	`connectivity`	`create_point_to_site_vpn_gateway`
ExpressRoute circuit, gateway and connection	Private connectivity to on-premises	`connectivity`	`use_express_route_circuit_module`, `create_express_route_gateway`, `create_express_route_connection`
Classic virtual network gateway	A gateway outside the Virtual WAN	`connectivity`	`use_virtual_network_gateway_module`
Private DNS resolver and forwarding ruleset	Hybrid DNS: conditional forwarding between Azure and on-premises (DNS design)	`connectivity`	`create_private_dns_resolver`, `create_private_dns_resolver_dns_forwarding_ruleset`
Private DNS zones	The central `privatelink.*` zones for private endpoints	`connectivity`	`create_private_dns_zones`
Azure Bastion	Browser-based RDP and SSH to VMs without public IPs	`connectivity`	`create_bastion_host`
Network Watcher	Network diagnostics	`connectivity`	`create_network_watcher`
DDoS protection plan	Protection for public IPs on attached virtual networks	`foundation`, attached in `connectivity`/`management`	`create_network_ddos_protection_plan`, `virtual_network_hub_ddos_protection_plan_enable`
Azure Virtual Network Manager (optional)	IPAM pools and security admin rules	`foundation`, `firewall`	`deploy_network_manager`, `deploy_network_manager_security_admin_rules`

Network security and application delivery¶

Azure resource	Role in the platform	Layer	Switch
Azure Firewall	Central filtering of traffic between spokes, to on-premises and to the internet, with DNS proxy	`connectivity`	`use_firewall_module`
Firewall policy	The policy that holds the rule collection groups	`connectivity`	`use_firewall_policy_module`
IP groups, rule collection groups, rules	Network, application and NAT rules from JSON	`firewall`	Always, unless `use_third_party_firewall_solution` (Firewall rules)
Application Gateway	Layer 7 load balancing, TLS termination and publishing of web workloads	`connectivity`	`use_application_gateway_module`
Web Application Firewall policies	Protection of the gateway against common web attacks	`connectivity`	`use_web_application_firewall_policy_module`
Public IP addresses	For the gateway, VPN and other public endpoints	`connectivity`	With their resource

Governance and security¶

Azure resource	Role in the platform	Layer	Switch
Management groups	The hierarchy that policies and RBAC inherit through	`foundation` (once per tenant)	`management_group_structure`
Policy definitions and initiatives	Custom policies and initiatives from JSON	`foundation`	Files in the policy folders
Policy assignments and remediation	Built-in compliance initiatives, custom assignments, remediation tasks	`postdeployment`	Files in the assignment folders; `automatically_start_policy_remediation`
Policy exemptions	Time-bound exceptions at four scopes	`postdeployment`	Files in the exemption folders (Exemptions)
Private DNS zone policies	Register private endpoints in the central zones	`foundation` definitions, `postdeployment` assignment	`enable_private_dns_zone_policies`
Microsoft Defender for Cloud	Security posture and threat protection for the platform subscriptions, optionally for spokes	`postdeployment`	`enable_defender_for_cloud_for_spokes`; settings by policy
Key Vault	Secrets, keys and certificates for the platform and the gateway	`management`, `connectivity`	`use_management_module`
Role assignments and managed identities	Access for the pipelines and the gateway	Per layer	With their resource

Monitoring and operations¶

Azure resource	Role in the platform	Layer	Switch
Log Analytics workspace	Central logs and queries (KQL). Retention and daily cap are settings	`management`	`use_management_module`
Diagnostic settings	Send logs and metrics to the workspace, mostly by policy	`postdeployment` and policy	Policy assignments
Action groups	Receivers of alerts	`foundation`	Receiver variables (Roll out monitoring)
Alert rules and alert processing rules	Baseline alerts and routing	`foundation`, `connectivity`, `identity`, `management`, `postdeployment`	`enable_activity_log_alerts`, `alerting_management_groups` (How alerting works)
Hub 24/7 alert route	Dedicated action group and processing rule for after-hours alerts	`connectivity`	`hub_247_support.enabled`
Automation account	Runbooks for operational tasks	`management`	`use_management_module`
Storage account	Diagnostic log storage	`management`	`create_storage_account`
Microsoft Sentinel	SIEM on the Log Analytics workspace	`management`	`deploy_sentinel`

Optional layers that are not part of the hub pipeline¶

Layer	Purpose
`ghrunners`	A virtual network with network security groups for self-hosted GitHub Actions runners, so runners reach Azure through private endpoints
`policy_exemptions`	Policy exemptions with expiry dates. The `postdeployment` layer deploys exemptions today
Shared services addons	Application Gateway, container registry, container agent pool and others in a shared services spoke, deployed from their own pipeline. See Shared services

See Deployment layers.

Multi-region¶

Scope	Resources
Once per tenant or platform environment	Management groups, policy definitions and assignments, alert initiatives, the Virtual WAN, and the private DNS zones, which are global resources
Per region	A virtual hub and its firewall, the regional action groups, the hub virtual network with its gateways, DNS resolver and Application Gateway, and the management and identity networks

A platform can run in one region or several, and in any combination of Azure public regions (Add a region, Region expansion).

Private endpoint DNS coverage¶

The platform deploys the privatelink.* zones and policies so that private endpoints resolve in the central zones without manual DNS work (DNS design). A configuration test checks that the zones that connectivity creates and the zones that the policies use stay in line, so they cannot drift apart.

Service families that are covered:

Family	Services
Storage	Blob, File, Queue, Table, Data Lake Storage
Databases	SQL Database, SQL Managed Instance, Cosmos DB, MySQL, PostgreSQL, MariaDB
Data and analytics	Synapse Analytics, Data Factory, Event Hubs, Service Bus, Data Explorer
AI and machine learning	Cognitive Services, Azure OpenAI, AI Foundry, Machine Learning, Bot Service
Web and mobile	App Service, Function Apps, Static Web Apps, API Management
Integration	Event Grid, Service Bus, Relay
Security	Key Vault, Managed HSM, App Configuration
IoT	IoT Hub, Digital Twins, Device Provisioning, IoT Central
Management	Automation, Backup, Site Recovery, Azure Monitor private link scope, Azure Arc

Things to know:

Some zones depend on the region (for example for AKS, Container Apps, Data Explorer and Backup). The code expands them with the region name and code.
Static Web Apps use a partition number in the zone name. Connectivity pre-creates the zones for partitions 0 to 10, and the policy binds to the right one.
Services that need several zones in one zone group (Azure Monitor private link scope, Azure Arc, Machine Learning, Power BI, Data Explorer, Redis Enterprise, Managed Redis) have their own policy modules.
Cognitive Services, Azure OpenAI and AI Foundry are special cases with explicit zone IDs.
SQL Managed Instance and Data Explorer policies skip remediation when the right zone is already configured.
IoT Hub needs two private endpoints: one for device and service traffic (privatelink.azure-devices.net) and one for the Event Hubs-compatible endpoint (privatelink.servicebus.windows.net).
The validation covers the Azure public cloud only.

Resource providers¶

The platform needs these resource providers to be registered: Microsoft.Network, Microsoft.Compute, Microsoft.Storage, Microsoft.KeyVault, Microsoft.OperationalInsights, Microsoft.Insights, Microsoft.Automation, Microsoft.Security, Microsoft.Authorization, Microsoft.Management and Microsoft.ResourceGraph. The foundation layer registers resource providers (Deployment layers). In a subscription that it does not manage, register them first. A script to register resource providers for new implementations exists since v4.5.1 (history).

Logs and Defender¶

These resources send logs to the Log Analytics workspace: activity logs, Azure Firewall, Application Gateway, Key Vault and storage accounts. Defender for Cloud covers servers, SQL databases, storage accounts, Key Vaults, container registries and Kubernetes services where enabled.