15 - Implement Sovereign Landing Zone (SLZ) controls

The Sovereign Landing Zone (SLZ) is a compliance-focused implementation designed for regulated industries that demand high data sovereignty. It incorporates specific controls and configurations to meet stringent regulatory requirements. The SLZ policies can be reviewd here:

• Sovereignty Baseline - Global Policies
  • Applied at the root management group level
• Sovereignty Baseline - Confidential Policies
  • Applied at the Confidential Corp and Confidential Online management group levels

The steps to follow are:

1. Copy the SLZ lib files over the top of your existing lib folder. This will add the necessary configuration files to enable the SLZ management groups and policies.

   $tempFolderName = "~/accelerator/temp"
   New-Item -ItemType "directory" $tempFolderName
   $tempFolder = Resolve-Path -Path $tempFolderName
   git clone -n --depth=1 --filter=tree:0 "https://github.com/Azure/alz-terraform-accelerator" "$tempFolder"
   cd $tempFolder
   
   $libFolderPath = "templates/platform_landing_zone/examples/slz/lib"
   git sparse-checkout set --no-cone $libFolderPath
   git checkout
   
   cd ~
   Copy-Item -Path "$tempFolder/$libFolderPath" -Destination "~/accelerator/config" -Recurse -Force
   Remove-Item -Path $tempFolder -Recurse -Force
   

2. Open your platform-landing-zone.tfvars file in Visual Studio Code (or your preferred editor) and update the following inputs:

   Setting Type	Parent block(s)	Key	Action	Count	Notes
   block	management_group_settings > policy_default_values	allowed_locations	Uncomment the block and add any extra locations you want to allow into the array	1

Warning

By default we name the SLZ architecture file lib/architecture_definitions/alz_custom.alz_architecture_definition.yaml. We recommend you do not update the name of this file as it will result in duplicate architecture files that you may want to clean up. However, if you must rename it, then you must also set the terraform_architecture_file_path variable to point to the new file name and path in your bootstrap configuration file (inputs.yaml). For example:

terraform_architecture_file_path: "lib/architecture_definitions/my_custom.alz_architecture_definition.yaml"