Lab status
An Azure landing zone and Entra ID baseline as Terraform, sized for a regulated organisation, with AI workload security to follow.
Last updated 4 November 2026. The code will be public once a full secret scan has passed.
| Area | What it covers | Status |
|---|---|---|
| Pipeline gates | Format, validate, lint, infrastructure scan, secret scan and mock-provider tests on every pull request. | Built |
| HCP Terraform workspaces | Projects, workspaces and state sharing defined in YAML, with tests that reject upward reads. | Built |
| Decision records | Version pinning, the HCP access model and where state lives. | Built |
| Bootstrap and cost guardrails | Pipeline identities, federated credentials, budgets and a one-step destroy. | Planned |
| Azure platform | Management groups, policy baseline, logging, network and DNS. | Planned |
| Entra ID baseline | Conditional Access in report-only first, and break-glass checks. | Planned |
| AI workload security | Foundry, AI Gateway, agent guardrails and Defender for AI Services. | Planned |
| Regulatory mappings | MAS TRM, the MAS AI risk guidelines and APRA CPS 234. Illustrative only. | Planned |
Scope
This is a personal lab on my own tenant and subscription. It holds no employer code or configuration. Where it maps controls to regulatory frameworks, it says the design supports a control, never that it complies.