Sovereign Landing Zone library with overrides

This is the similar to the default created by the accelerator. Uses the maintained SLZ library as above, but adds a local library to allow overrides on the extended set of archetypes as well as a space to create additional assets.

Need to rework this. See here. It is designed to overwrite an existing local library.

Run as a two step?

Description

This configuration stacks a local override library in ./lib which is stacked on top of the Sovereign Landing Zone.

From a partner perspective this is great for defining specific archetype overrides for individual customers, and it also allows bespoke assets - e.g. custom policies or RBAC roles - to be added for that customer.

The local library contains a set of uniquely named archetypes (using override files) and a different architecture name (slz_custom rather than slz). You would specify this architecture name in the module block.

Creating a local library

These commands are designed for Bash on a Linux/macOS system. Ensure that you are in the root of your Azure Landing Zone repo.

tmp=$(mktemp -d)
git clone -n --depth=1 --filter=tree:0 "https://github.com/Azure/alz-terraform-accelerator" "$tmp"
lib_folder_path="templates/platform_landing_zone/lib"
git -C "$tmp" sparse-checkout set --no-cone "$lib_folder_path"
git -C "$tmp" checkout
cp -r "$tmp/$lib_folder_path" .
rm -rf "$tmp"

These commands are designed for PowerShell on a Windows system. Ensure that you are in the root of your Azure Landing Zone repo.

$tmp = Join-Path $env:TEMP (New-Guid)
New-Item -ItemType Directory -Path $tmp
git clone -n --depth=1 --filter=tree:0 "https://github.com/Azure/alz-terraform-accelerator" "$tmp"
$lib = "templates/platform_landing_zone/lib"
git -C $tmp sparse-checkout set --no-cone $lib
git -C $tmp checkout
Copy-Item -Path "$tmp/$lib" -Recurse -Force
Remove-Item -Path $tmp -Recurse -Force

The code blocks creates a local library using similar logic to the documentation for the Azure Landing Zone accelerator, and pulls the example lib folder from the ALZ Accelerator repo.

Architecture and Archetypes

The architecture name is slz_custom, as defined in the local slz_custom.alz_architecture_definition.yaml that you’ll find in lib/architecture_definitions.

flowchart TD slz["Sovereign Landing Zone (root, sovereign_root)"] slz --> decommissioned decommissioned["Decommissioned (decommissioned)"] slz --> landingzones landingzones["Landing zones (landing_zones)"] landingzones --> confidential_corp confidential_corp["Confidential Corp (confidential_corp)"] landingzones --> confidential_online confidential_online["Confidential Online (confidential_online)"] landingzones --> corp corp["Corp (corp)"] landingzones --> online online["Online (online)"] landingzones --> public public["Public (public)"] slz --> platform platform["Platform (platform)"] platform --> connectivity connectivity["Connectivity (connectivity)"] platform --> identity identity["Identity (identity)"] platform --> management management["Management (management)"] platform --> security security["Security (security)"] slz --> sandbox sandbox["Sandbox (sandbox)"]

Note that the architecture refers to the uniquely named custom override archetypes. Each archetype shortcode is now, for example, corp_custom rather than corp. This relates to the corresponding files in the lib/archetype_definitions folder, e.g. corp_custom.alz_archetype_override.yaml.

Provider block

The provider block here refers to the override library, in the local lib folder.

provider "alz" {
  library_overwrite_enabled = true
  library_references = [
    {
      custom_url = "${path.root}/lib"
    }
  ]
}

Metadata

The local metadata filename is lib/alz_library_metadata.json.

{
  "$schema": "https://raw.githubusercontent.com/Azure/Azure-Landing-Zones-Library/main/schemas/library_metadata.json",
  "name": "local",
  "display_name": "ALZ Accelerator - Azure Verified Modules for ALZ Platform Landing Zone",
  "description": "This library allows overriding policies, archetypes, and management group architecture in the ALZ Accelerator.",
  "dependencies": [
    {
      "path": "platform/alz",
      "ref": "2025.09.3"
    }
  ]
}

The dependency is also semantically versioned. In this case it is again dependant on https://github.com/Azure/Azure-Landing-Zones-Library/tree/platform/alz/2025.09.3/platform/alz.

If you need to pull in a more recent version of the Azure Landing Zone library then you would update the ref here.

See the previous page for more detail on the architecture, archetypes, and assets for the main Azure Landing Zone library repo.

Override files

The individual override files are in lib/archetype_definitions. For example, the one for corp is named corp_custom.alz_archetype_override.yaml, and is shown below.

base_archetype: corp
name: corp_custom
policy_assignments_to_add: []
policy_assignments_to_remove: [
# To remove the private DNS zones policy for private endpoints
  # Deploy-Private-DNS-Zones,
]
policy_definitions_to_add: []
policy_definitions_to_remove: []
policy_set_definitions_to_add: []
policy_set_definitions_to_remove: []
role_definitions_to_add: []
role_definitions_to_remove: []

These are used to define a custom delta against the base archetype. The most common is to remove unwanted policy assignments, or add one that is not part of the default archetype.

Removing assignments

Remember that the Azure Landing Zone library details the available archetypes and assets when you go to platform/alz, and you can select the tag for specific versions.

The base archetype specified in the example override file is corp. You’ll find the corp.alz_archetype_definition.json file in the archetype_definitions folder. Here it is.

{
  "$schema": "https://raw.githubusercontent.com/Azure/Azure-Landing-Zones-Library/main/schemas/archetype_definition.json",
  "name": "corp",
  "policy_assignments": [
    "Audit-PeDnsZones",
    "Deny-HybridNetworking",
    "Deny-Public-Endpoints",
    "Deny-Public-IP-On-NIC",
    "Deploy-Private-DNS-Zones"
  ],
  "policy_definitions": [],
  "policy_set_definitions": [],
  "role_definitions": []
}

Adding assignments

Return back to the platform/alz folder, then you can browse the policy_assignments. The naming convention includes the name before the first full stop or period.

For example, the name for the Enforce-TLS-SSL-Q225.alz_policy_assignment.json policy would be Enforce-TLS-SSL-Q225. You could add this to the override if you wanted to assign that policy initiative to enforce encryption in flight for a set of services.