Unique Landing Zone — Unique AI Documentation
Unique Landing Zone
Overview
This page describes the Unique Landing Zone — a customized Azure Landing Zone designed to meet the specific security, compliance, and operational requirements of Unique deployments in Customer Managed Tenants. It covers the rationale for deviating from the standard Azure Landing Zone, the resource group structure, roles and access control, required Azure services, and supporting tooling.
Audience: Cloud Architects, DevOps Engineers, Security Engineers, IT Administrators, and client stakeholders involved in cloud environment design and operations.
Introduction to Azure Landing Zone
Azure (Application) Landing Zone is Microsoft’s framework for adopting Azure services with best practices for governance, security, scalability, and cost management. It provides blueprints for creating production-ready cloud environments with structured governance, automated deployments, resource organization, security baselines, and cost controls.
See Azure Landing Zone documentation.
Reasons for Deviation from Azure Landing Zone
While the Azure Landing Zone provides a solid foundation, certain client-specific requirements necessitate deviations. The Unique Landing Zone addresses these by:
- Focused Risk Mitigation: Targeting specific risks — data exfiltration, Kubernetes data plane security, and cost management — critical for our client base.
- Enhanced Automation: Prioritizing automation to improve security, reduce human error, and ensure consistent policy enforcement.
- Customized Resource Segregation: Organizing resources to minimize risk exposure and tighten control over sensitive data.
- Tailored Role Management: Implementing custom roles aligned with specific operational and security requirements.
Unique Landing Zone Architecture
The Unique Landing Zone is designed around three principles: a risk-based approach, automation-first operations, and strict resource segregation.
Risk-Based Approach
- Data Exfiltration: Comprehensive measures to prevent unauthorized data extraction.
- Kubernetes Data Plane: Security controls for data exfiltration through the Kubernetes data plane.
- Privileged Roles: Secure use of privileged roles via Privileged Identity Management (PIM) or Just-in-Time (JIT) access.
- Cloud Resource Misconfiguration: Prevention and detection of misconfigurations.
- Cost Management: Strategies to prevent over-provisioning and manage costs effectively.
- Third-party Security: Management of vulnerabilities in third-party applications.
Automation First
Automation is foundational to the Unique Landing Zone. It enhances change control, minimizes lateral movement risks, enforces least privilege, maintains comprehensive audit trails, and promotes modern collaboration practices. Automation also reduces the need for manual roles and permissions, positively impacting costs and timelines.
Automation and Source Control:
- GitHub Repository (Client GitHub): Central repository where the client manages infrastructure as code (IaC).
- CI/CD Pipeline (e.g., Azure DevOps): Pull requests are submitted, reviewed, merged, and trigger automation scripts for provisioning.
- PIM RBAC Assignments: Privileged Identity Management assigns RBAC roles dynamically, granting JIT access.
Deployment Workflow
- Code Delivery: Unique employees submit infrastructure changes via pull requests to the client’s GitHub repository. Changes are reviewed and approved by client administrators.
- CI/CD Pipeline: On approval, the pipeline pulls the latest code and triggers automation scripts to provision or update resources.
- Provisioning: Provisioners deploy resources into Main and Sensitive resource groups. Automation ensures sensitive data is handled securely with restricted access.
- Access Control: Observers have read-only access to their respective groups. Client Control has full oversight for compliance and security adjustments.
- Audit and Compliance: All operations are logged in the Audit Resource Group (write-only for Unique, fully accessible by client administrators). Regular reviews ensure policy compliance.
Resource Groups
Resources are segregated into groups based on risk management, following the principle of least privilege.
| Group | Content | Permissions |
|---|---|---|
| Main | Primary resources for core services — no customer data | Managed by responsible party (Unique or client, per Responsibilities). Includes basic infrastructure and non-sensitive configurations. |
| Sensitive | All customer data: prompts, uploaded files, encryption keys | Least privilege via JIT. Automation highly recommended to minimize human intervention. |
| Audit | Centralized, tamper-proof audit logs | Write-only by Unique and their workloads. Modifications by client or automated processes only. |
| Vnet | Networking setup, including limited internet access for pulling necessary content | Typically client-managed due to security impact. Automation preferred. |
| Terraform | Terraform state files | Restricted to a few individuals or automation. State securely maintained with tracked modifications. |
Roles and Access Control
A robust RBAC framework enforces least privilege, segregates duties, and minimizes risk. Azure PIM and JIT access dynamically manage permissions.
| Role | Resource Group Main | Resource Group Sensitive | Key Responsibilities |
|---|---|---|---|
| Observer | Read | — | Monitor resources and access secrets in Main Key Vault. |
| Maintainer | Read, Write, Delete | — | Maintain and manage resources. Handle secrets in Main Key Vault. |
| Provisioner | Read, Write, Delete | Read, Write, Delete | Deploy and configure resources in both groups. Transfer config values from Main to Sensitive Key Vault (ensuring maintainers never access sensitive data directly). |
| Sensitive Data Observer | — | Read | View and monitor sensitive data and resources. Read-only. |
Secrets Management:
- Main Key Vault: Stores secrets required for operations in the Main resource group.
- Sensitive Key Vault: Stores sensitive keys and data with strict access controls. Provisioners handle transfers from Main to Sensitive Key Vault.
Configuration Workflow: Unique employees are assigned roles (Observer, Maintainer, Provisioner, Sensitive Data Observer) based on responsibilities. Provisioners place configuration values in the Main Key Vault and handle secure transfers — maintainers never see sensitive data.
Required Services — "Chat" Use Case
Clients must provision the following Azure services to support the Chat application within the Unique Landing Zone.
| Service | Use Case | Best Practices |
|---|---|---|
| Container Orchestrator (AKS) | Host chat application services | Use AKS for scalability. Implement network policies and RBAC for secure access control. |
| Telemetry (Azure Monitor) | Monitor application performance | Use Azure Monitor and Log Analytics for telemetry. Set up alerts for real-time incident response. |
| Logging Solution | Retain application logs | Deploy Azure Log Analytics for centralized log management. Configure retention policies per data governance standards. |
| Secure Audit Log Storage | Retain audit logs | Use Azure Blob Storage with immutability policies. Encrypt at rest and in transit. |
| PostgreSQL | Persist application data | Use Azure Database for PostgreSQL. Enable automated backups and geo-replication. |
| Redis Cache | Session state, caching, Tyk API Gateway, frontend WebSockets | Use Azure Cache for Redis. Configure high availability and disaster recovery. |
| LLMs | Chat features, reporting features | Integrate Azure OpenAI Service. Ensure proper authentication and access control. |
| Compatible Storage (Blob/ADLS) | Chat logs, media, Knowledge features, SharePoint Connector | Use Azure Blob Storage or Data Lake Storage. Implement lifecycle management for cost optimization. |
| Azure AD App Registration | User authentication and authorization | Register in Azure AD for SSO. Implement Conditional Access policies. |
Supporting Tooling
Both Customer Managed Tenants and on-premise installations require the following tools for deployment management, security, and compliance.
| Tool | Use Case | Best Practices | Examples |
|---|---|---|---|
| Git / VCS | Versioned Unique artefacts, IaC, customization, automation, audits | Branch protection rules. PR-based reviews. Regular backups. | GitHub, GitHub Enterprise, Azure DevOps, GitLab Enterprise |
| CI/CD Automation | Apply code changes published by Unique | Pipeline as code. Automated testing and security scans. Rollback strategies. | GitHub Actions, Azure DevOps, GitLab CI, FluxCD, ArgoCD |
| Container Registry | Cache, scan, analyze container images from Unique releases | Vulnerability scanning. Signed images. RBAC. | Azure Container Registry, Harbor, DockerHub, GitHub Packages |
| Helm Chart Gallery | Cache, validate Helm charts from Unique releases | Regular updates. Staging validation before production. Access controls. | Azure Container Registry, Harbor, Chart Museum |