{"id":21484922,"url":"https://github.com/azure/azure-spring-apps-landing-zone-accelerator","last_synced_at":"2025-08-22T01:32:46.908Z","repository":{"id":39577777,"uuid":"314090018","full_name":"Azure/azure-spring-apps-landing-zone-accelerator","owner":"Azure","description":"The Azure Spring Apps landing zone accelerator is an open-source collection of architectural guidance and reference implementation to accelerate deployment of Azure Spring Apps at scale.","archived":false,"fork":false,"pushed_at":"2024-02-15T14:21:57.000Z","size":7656,"stargazers_count":80,"open_issues_count":7,"forks_count":75,"subscribers_count":14,"default_branch":"main","last_synced_at":"2024-11-18T21:52:56.277Z","etag":null,"topics":["application-gateway","arm-templates","azure","azure-cli","azure-spring-apps","azure-spring-cloud","bicep","cloud","database","firewall","lza","on-premises","spring-apps","spring-boot","spring-cloud","tanzu","terraform","virtual-network","vmware","zero-trust"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Azure.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":"SUPPORT.md","governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-11-19T00:08:31.000Z","updated_at":"2024-05-02T16:37:17.000Z","dependencies_parsed_at":"2024-01-11T20:59:14.801Z","dependency_job_id":"5d53bfda-d195-4ff8-9188-8f1a9f77e4d7","html_url":"https://github.com/Azure/azure-spring-apps-landing-zone-accelerator","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Azure%2Fazure-spring-apps-landing-zone-accelerator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Azure%2Fazure-spring-apps-landing-zone-accelerator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Azure%2Fazure-spring-apps-landing-zone-accelerator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Azure%2Fazure-spring-apps-landing-zone-accelerator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Azure","download_url":"https://codeload.github.com/Azure/azure-spring-apps-landing-zone-accelerator/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":230547678,"owners_count":18243227,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["application-gateway","arm-templates","azure","azure-cli","azure-spring-apps","azure-spring-cloud","bicep","cloud","database","firewall","lza","on-premises","spring-apps","spring-boot","spring-cloud","tanzu","terraform","virtual-network","vmware","zero-trust"],"created_at":"2024-11-23T13:13:01.959Z","updated_at":"2024-12-20T07:07:07.559Z","avatar_url":"https://github.com/Azure.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Azure Spring Apps Landing Zone Accelerator\n\nAzure Landing Zone Accelerators are architectural guidance, reference architecture, reference implementations and automation packaged to deploy workload platforms on Azure at Scale and aligned with industry proven practices.\n\nAzure Spring apps Landing Zone Accelerator represents the strategic design path and target technical state for an Azure Spring Apps Service deployment. \n\nThis repository provides packaged guidance for customer scenarios, reference architecture, reference implementation, tooling, design area guidance, sample spring apps deployed after provisioning the infrastructure using the accelerator. The architectural approach can be used as design guidance for greenfield implementation and as an assessment for brownfield customers already using Spring boot apps. \n\n## Enterprise-Scale Architecture\n\nThe enterprise architecture is broken down into key design areas, where you can find the links to each at:\n|             Design Area              |                                                                      Considerations and Recommendations                                                                      |\n| :----------------------------------: | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------: |\n|    Identity and Access Management    |  [Design Considerations and Recommendations](https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/spring-apps/identity-and-access-management)   |\n|  Network Topology and Connectivity   | [Design Considerations and Recommendations](https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/spring-apps/network-topology-and-connectivity) |\n|      Management and Monitoring       |            [Design Considerations and Recommendations](https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/spring-apps/management)             |\n| Security, Governance, and Compliance |             [Design Considerations and Recommendations](https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/spring-apps/security)              |\n\n## Enterprise-Scale Reference Implementation\n\n\nThis repository contains instructions for creating an \n[Azure Spring Apps](https://docs.microsoft.com/azure/spring-cloud/spring-cloud-overview)\nreference architecture that can be used for deploying Spring Boot \napplications in a typical enterprise landing zone design. \nIt uses a [hub and spoke architecture](https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke) \nwith a single spoke.  East/West traffic (traffic between resources in the hub and resources in the \nspoke) is filtered with Network Security Groups and North/South traffic (traffic between the \nInternet and resources in the hub or spoke) is routed through and mediated with an instance of \nAzure Firewall. \n\n![Architectural diagram for the secure baseline scenario.](/Scenarios/ASA-Secure-Baseline/media/asa-eslz-securebaseline.jpg)\n\n* Azure Spring Apps is deployed using [vnet-injection](https://docs.microsoft.com/azure/spring-cloud/spring-cloud-tutorial-deploy-in-azure-virtual-network) \nto allow for mediation inbound and outbound traffic to the Azure Spring Apps Instance and deployed applications.\n* The Azure Firewall instance has been configured to write its logs to a Log Analytics Workspace. \nYou can leverage [these Kusto queries](https://docs.microsoft.com/azure/firewall/log-analytics-samples) \nto analyze Azure Firewall log data written to Log Analytics.\n* Hub and Spoke Virtual Networks are configured to use Azure Firewall for DNS queries \nutilizing the [DNS Proxy feature](https://docs.microsoft.com/azure/firewall/dns-settings#dns-proxy) \nof Azure Firewall.\n* Azure Private DNS zones for Azure Spring Apps and support services deployed with Private Endpoints\n* A single Windows Server 2022 Virtual Machine the hub Virtual Network for testing access to \napplications deployed into the Azure Spring Apps instance.  This virtual machine is configured \nwith the Microsoft Monitoring Agent and is integrated with the Log Analytics Workspace. This VM is \nnot exposed to the internet and is only accessible via Azure Bastion (for brevity, both the VM and Azure\nBastion are not shown in the diagram).\n* Log Analytics Workspace where Azure Spring Apps, Azure Firewall, and the virtual machine deliver \nlogs and metrics.\n* Instance of Azure Key Vault deployed with a Private Endpoint for secrets and certificates storage \nfor applications deployed to Azure Spring Apps\n* Instance of Azure Bastion for connection to the Windows Server 2022 virtual machine running in the hub virtual network.\n\nFor Azure Spring Apps Standard SKU:\n* Instance of Azure Database for MySQL flexible server deployed with VNET Integration.  This can be used to deploy the PetClinic sample app described in this document.\n\nFor Azure Spring Apps Enterprise SKU:\n* Instance of Azure Database for PostgreSQL flexible server deployed with VNET Integration and Azure Cache for Redis with Private endpoint.  \n\n\n## Next Steps to implement Azure Spring Apps Landing Zone Accelerator\n\nPick the below scenario to get started on a reference implementation. \n\n:arrow_forward: [Azure Spring Apps Secure Baseline](/Scenarios/ASA-Secure-Baseline/README.md)\n\nDeployment Details:\n| Azure Spring Apps SKU | Deployment Methodology | GitHub Actions                                                                                       |\n| --------------------- | ---------------------- | ---------------------------------------------------------------------------------------------------- |\n| Standard              | Terraform              | [Published](./Scenarios/ASA-Secure-Baseline/Terraform/09-e2e-githubaction-standard.md)               |\n|                       | Bicep                  | [Power shell available](./Scenarios/ASA-Secure-Baseline/Bicep/README.md), GitHub Actions Coming soon |\n| Enterprise            | Terraform              | [Published](./Scenarios/ASA-Secure-Baseline/Terraform/09-e2e-githubaction-enterprise.md)             |\n|                       | Bicep                  | Power shell available, GitHub Actions Coming soon                                                    |\n\n## Got a feedback\nPlease leverage issues if you have any feedback or request on how we can improve on this repository.\n\n## Data Collection\nThe software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft's privacy statement. Our privacy statement is located at https://go.microsoft.com/fwlink/?LinkId=521839. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.\n\n## Telemetry Configuration\nTelemetry collection is on by default.\n\nTo opt-out, set the variable enableTelemetry to false in Bicep/ARM file and disable_terraform_partner_id to false on Terraform files.\n\n## Contributing\n\nThis project welcomes contributions and suggestions.  Most contributions require you to agree to a\nContributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us\nthe rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.\n\nWhen you submit a pull request, a CLA bot will automatically determine whether you need to provide\na CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions\nprovided by the bot. You will only need to do this once across all repos using our CLA.\n\nThis project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).\nFor more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or\ncontact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.\n\n## Trademarks\n\nThis project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft \ntrademarks or logos is subject to and must follow \n[Microsoft's Trademark \u0026 Brand Guidelines](https://www.microsoft.com/legal/intellectualproperty/trademarks/usage/general).\nUse of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship.\nAny use of third-party trademarks or logos are subject to those third-party's policies.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fazure%2Fazure-spring-apps-landing-zone-accelerator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fazure%2Fazure-spring-apps-landing-zone-accelerator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fazure%2Fazure-spring-apps-landing-zone-accelerator/lists"}