Resources · Integration patterns
Landing zone and hub-spoke networking
An account or subscription hierarchy, a central network, policies and logging as the foundation for workloads.
Integration status: Documented pattern
A documented pattern. The product creates no cloud resources.
Description
The hub holds shared services (firewall, DNS, on-premises connectivity); spoke networks hold workloads; policies and logging apply centrally through code.
Prerequisites
- An identity provider.
- Infrastructure as code.
- An IP address plan.
When to use it
- Several teams or workloads in the cloud.
- Security and audit requirements.
- Planned growth.
When not to use it
- One small application — a simpler model is enough.
- Nobody to maintain the platform.
- A short-lived experiment.
Reference diagram
An illustration of the components and the flow — not a running system.
01Governance
- Hierarchy
- Policies
- Budgets
02Hub
- Firewall
- DNS
- On-premises connectivity
03Spokes
- Workloads
- Private endpoints
04Monitoring
- Central logs
- Security posture
The diagram as a list
| Stage | Components |
|---|---|
| Governance | Hierarchy, Policies, Budgets |
| Hub | Firewall, DNS, On-premises connectivity |
| Spokes | Workloads, Private endpoints |
| Monitoring | Central logs, Security posture |
Security controls
- Policies against public access.
- Minimal and temporary permissions.
- Central logs that cannot be deleted.
Observability
- Policy deviations.
- Traffic through the hub.
- Cost per spoke.
Failure modes
| Failure | Mitigation |
|---|---|
| The hub firewall is a bottleneck | Scaling and capacity monitoring. |
| Overlapping IP ranges | An address plan from the start. |
| Manual exceptions | Exceptions as code with expiry. |