Sovereign landing zone library with overrides

This is the similar to the default created by the accelerator. Uses the maintained SLZ library as above, but adds a local library to allow overrides on the extended set of archetypes as well as a space to create additional assets.

Description

This configuration stacks a local override library in ./lib which is stacked on top of the Sovereign landing zone.

From a partner perspective this is great for defining specific archetype overrides for individual customers, and it also allows bespoke assets - e.g. custom policies or RBAC roles - to be added for that customer.

The local library contains a set of uniquely named archetypes (using override files) and a different architecture name (slz_custom rather than slz). You would specify this architecture name in the module block.

Local override library

Included if you need to add in a local override library first.

If not then you can skip down to Architecture and Archetypes, or right down to Metadata which is the start of the most important section.

Create the default local override library

These commands are designed for Bash on a Linux/macOS system. Ensure that you are in the root of your Azure landing zone repo.

tmp=$(mktemp -d)
git clone -n --depth=1 --filter=tree:0 "https://github.com/Azure/alz-terraform-accelerator" "$tmp"
lib_folder_path="templates/platform_landing_zone/lib"
git -C "$tmp" sparse-checkout set --no-cone "$lib_folder_path"
git -C "$tmp" checkout
cp -r "$tmp/$lib_folder_path" .
rm -rf "$tmp"

These commands are designed for PowerShell on a Windows system. Ensure that you are in the root of your Azure landing zone repo.

$tmp = Join-Path $env:TEMP (New-Guid)
New-Item -ItemType Directory -Path $tmp
git clone -n --depth=1 --filter=tree:0 "https://github.com/Azure/alz-terraform-accelerator" "$tmp"
$lib = "templates/platform_landing_zone/lib"
git -C $tmp sparse-checkout set --no-cone $lib
git -C $tmp checkout
Copy-Item -Path "$tmp/$lib" -Recurse -Force
Remove-Item -Path $tmp -Recurse -Force

The code blocks creates a local library using similar logic to the documentation for the Azure landing zone accelerator, and pulls the example lib folder from the ALZ Accelerator repo.

Extend the library for Sovereign landing zone

As you are using the Sovereign landing zone then run these commands to extend the default local library with additional override files for the additional archetypes found in the Sovereign landing zone.

⚠️ As well as adding the additional override files, these commands will also overwrite the following files:

lib/alz_library_metadata.json - library dependency on the Sovereign landing zone, which has its own dependency on the Azure landing zone
lib/architecture_definitions/alz_custom.alz_architecture_definition.yaml - additional archetype overrides

These commands are designed for Bash on a Linux/macOS system. Ensure that you are in the root of your Azure landing zone repo.

tmp=$(mktemp -d)
git clone -n --depth=1 --filter=tree:0 "https://github.com/Azure/alz-terraform-accelerator" "$tmp"
lib_folder_path="templates/platform_landing_zone/examples/slz/lib"
git -C "$tmp" sparse-checkout set --no-cone "$lib_folder_path"
git -C "$tmp" checkout
cp -r "$tmp/$lib_folder_path" .
rm -rf "$tmp"

These commands are designed for PowerShell on a Windows system. Ensure that you are in the root of your Azure landing zone repo.

$tmp = Join-Path $env:TEMP (New-Guid)
New-Item -ItemType Directory -Path $tmp
git clone -n --depth=1 --filter=tree:0 "https://github.com/Azure/alz-terraform-accelerator" "$tmp"
$lib = "templates/platform_landing_zone/examples/slz/lib"
git -C $tmp sparse-checkout set --no-cone $lib
git -C $tmp checkout
Copy-Item -Path "$tmp/$lib" -Recurse -Force
Remove-Item -Path $tmp -Recurse -Force

These code blocks are fundamentally the same as the ones used to initialise the local library, but extend it using the slz lib add on folder from the same ALZ Accelerator repo.

Note that the architecture file is still called alz_custom.alz_architecture_definition.yaml and the architecture name is alz_custom. The reason for this is that the Sovereign landing zone scenario is designed to handle brownfield scenarios.

The individual archetype override can be found in lib/archetype_definitions.

Architecture and Archetypes

The architecture name is slz_custom, as defined in the local slz_custom.alz_architecture_definition.yaml that you’ll find in lib/architecture_definitions.

flowchart TD slz["Sovereign landing zone (root_custom, sovereign_root_custom)"] slz --> decommissioned decommissioned["Decommissioned (decommissioned_custom)"] slz --> landingzones landingzones["Landing zones (landing_zones_custom)"] landingzones --> confidential_corp confidential_corp["Confidential Corp (confidential_corp_custom)"] landingzones --> confidential_online confidential_online["Confidential Online (confidential_online_custom)"] landingzones --> corp corp["Corp (corp_custom)"] landingzones --> online online["Online (online_custom)"] landingzones --> public public["Public (public_custom)"] slz --> platform platform["Platform (platform_custom)"] platform --> connectivity connectivity["Connectivity (connectivity_custom)"] platform --> identity identity["Identity (identity_custom)"] platform --> management management["Management (management_custom)"] platform --> security security["Security (security_custom)"] slz --> sandbox sandbox["Sandbox (sandbox_custom)"]

Note the Sovereign landing zone at the top has two archetypes assigned:

root_custom
sovereign_root_custom

and you will find override files for both in the lib’s archetype_definitions folder.

Provider block

The provider block here refers to the override library, in the local lib folder.

provider "alz" {
  library_overwrite_enabled = true
  library_references = [
    {
      custom_url = "${path.root}/lib"
    }
  ]
}

Metadata

The local metadata filename is lib/alz_library_metadata.json.

{
  "$schema": "https://raw.githubusercontent.com/Azure/Azure-Landing-Zones-Library/main/schemas/library_metadata.json",
  "name": "local",
  "display_name": "ALZ Accelerator - Azure Verified Modules for SLZ Platform Landing Zone",
  "description": "This library allows overriding policies, archetypes, and management group architecture in the ALZ Accelerator.",
  "dependencies": [
    {
      "path": "platform/slz",
      "ref": "2026.02.0"
    }
  ]
}

The dependency is also semantically versioned. The first dependency is Sovereign landing zone 2025.10.1, which is itself stacked on top of Azure landing zone 2025.9.3.

If you need to pull in a more recent version of the Sovereign landing zone library then you would update the ref here.

See the previous page for more detail on the architecture, archetypes, and assets for the main Azure landing zone library repo.

Module block

The architecture name is in lib/alz_library_metadata.json. Update the module block to match.

module "management_groups" {
  source  = "Azure/avm-ptn-alz/azurerm"
  version = "0.20.2"
  architecture_name  = "alz_custom"