Sovereign Landing Zone library with overrides

Description

This configuration stacks a local override library in ./lib which is stacked on top of the Sovereign Landing Zone.

From a partner perspective this is great for defining specific archetype overrides for individual customers, and it also allows bespoke assets - e.g. custom policies or RBAC roles - to be added for that customer.

The local library contains a set of uniquely named archetypes (using override files) and a different architecture name (slz_custom rather than slz). You would specify this architecture name in the module block.

Creating a local library

tmp=$(mktemp -d)
git clone -n --depth=1 --filter=tree:0 "https://github.com/Azure/alz-terraform-accelerator" "$tmp"
lib_folder_path="templates/platform_landing_zone/lib"
git -C "$tmp" sparse-checkout set --no-cone "$lib_folder_path"
git -C "$tmp" checkout
cp -r "$tmp/$lib_folder_path" .
rm -rf "$tmp"

$tmp = Join-Path $env:TEMP (New-Guid)
New-Item -ItemType Directory -Path $tmp
git clone -n --depth=1 --filter=tree:0 "https://github.com/Azure/alz-terraform-accelerator" "$tmp"
$lib = "templates/platform_landing_zone/lib"
git -C $tmp sparse-checkout set --no-cone $lib
git -C $tmp checkout
Copy-Item -Path "$tmp/$lib" -Recurse -Force
Remove-Item -Path $tmp -Recurse -Force

The code blocks creates a local library using similar logic to the documentation for the Azure Landing Zone accelerator, and pulls the example lib folder from the ALZ Accelerator repo.

Extend the library for Sovereign Landing Zone

As you are using the Sovereign Landing Zone then run these commands to extend the default local library with additional override files for the additional archetypes found in the Sovereign Landing Zone.

tmp=$(mktemp -d)
git clone -n --depth=1 --filter=tree:0 "https://github.com/Azure/alz-terraform-accelerator" "$tmp"
lib_folder_path="templates/platform_landing_zone/examples/slz/lib"
git -C "$tmp" sparse-checkout set --no-cone "$lib_folder_path"
git -C "$tmp" checkout
cp -r "$tmp/$lib_folder_path" .
rm -rf "$tmp"

$tmp = Join-Path $env:TEMP (New-Guid)
New-Item -ItemType Directory -Path $tmp
git clone -n --depth=1 --filter=tree:0 "https://github.com/Azure/alz-terraform-accelerator" "$tmp"
$lib = "templates/platform_landing_zone/examples/slz/lib"
git -C $tmp sparse-checkout set --no-cone $lib
git -C $tmp checkout
Copy-Item -Path "$tmp/$lib" -Recurse -Force
Remove-Item -Path $tmp -Recurse -Force

These code blocks are fundamentally the same as the ones used to initialise the local library, but extend it using the slz lib add on folder from the same ALZ Accelerator repo.

Note that the architecture file is still called alz_custom.alz_architecture_definition.yaml and the architecture name is alz_custom. The reason for this is that the Sovereign Landing Zone scenario is designed to handle brownfield scenarios.

Architecture and Archetypes

The architecture name is slz_custom, as defined in the local slz_custom.alz_architecture_definition.yaml that you’ll find in lib/architecture_definitions.

Note the Sovereign Landing Zone at the top has two archetypes assigned:

• root_custom
• sovereign_root_custom

and you will find override files for both in the lib’s archetype_definitions folder.

Provider block

The provider block here refers to the override library, in the local lib folder.

provider "alz" {
  library_overwrite_enabled = true
  library_references = [
    {
      custom_url = "${path.root}/lib"
    }
  ]
}

Metadata

The local metadata filename is lib/alz_library_metadata.json.

{
  "$schema": "https://raw.githubusercontent.com/Azure/Azure-Landing-Zones-Library/main/schemas/library_metadata.json",
  "name": "local",
  "display_name": "ALZ Accelerator - Azure Verified Modules for SLZ Platform Landing Zone",
  "description": "This library allows overriding policies, archetypes, and management group architecture in the ALZ Accelerator.",
  "dependencies": [
    {
      "path": "platform/slz",
      "ref": "2025.10.1"
    }
  ]
}

The dependency is also semantically versioned. It is dependant on https://github.com/Azure/Azure-Landing-Zones-Library/tree/platform/slz/2025.10.1/platform/slz, which is itself stacked on top of https://github.com/Azure/Azure-Landing-Zones-Library/tree/platform/alz/2025.9.3/platform/alz.

If you need to pull in a more recent version of the Sovereign Landing Zone library then you would update the ref here.

See the previous page for more detail on the architecture, archetypes, and assets for the main Azure Landing Zone library repo.

Override files

The individual override files are in lib/archetype_definitions. For example, the one for confidential_online is named confidential_online_custom.alz_archetype_override.yaml, and is shown below.

{
  "name": "confidential_online",
  "policy_assignments": [
    "Enforce-Sovereign-Conf"
  ],
  "policy_definitions": [],
  "policy_set_definitions": [],
  "role_definitions": []
}

These are used to define a custom delta against the base archetype. The most common is to remove unwanted policy assignments, or add one that is not part of the default archetype.

Removing assignments

Remember that the the available archetypes and assets may now being pulled from three libraries - your custom library in (./lib), the Sovereign Landing Zone library, and the underlying Azure Landing Zones library. You can see the archetype definitions in

• https://github.com/Azure/Azure-Landing-Zones-Library/tree/main/platform/slz#archetypes
• https://github.com/Azure/Azure-Landing-Zones-Library/tree/main/platform/alz#archetypes

And don’t forget to change main in the drop down to a specific version if not using the latest.

Adding assignments

In the previous example we looked at adding an assignment from the main library, which you can still do.

In addition, you now you have the ability to create your own assets in the local library and adding those to existing archetypes, or create new