Skip to content

Landing Zone Platform

A GitHub-native way to deploy and operate Azure landing zones for many customers, with Terraform and Terragrunt, driven entirely from pull request comments.

No external orchestrator. No SaaS control plane. No third-party binary in the critical path. Just GitHub Actions reusable workflows, a small set of shell scripts, and your own Azure tenants.



A pull request, from open to applied and merged, in about a minute.

For managed service providers

This platform is built and delivered by NRIT Solutions. It is designed for managed service providers who deploy and run landing zones on behalf of their own customers.

  • Plan and apply from a PR

    Open a pull request and every affected unit is planned automatically. Review the plan in the comment, type /apply, and it applies in dependency order. A merge gate keeps unapplied changes out of the main branch.

    Plan and apply

  • Drift detection

    A daily sweep plans every unit read-only against the live tenant and opens a GitHub Issue per drifted unit, closing it again when the unit comes back clean.

    Drift detection

  • Policy, security, and cost gates

    Every plan runs conftest policy checks, a checkov security scan, and an infracost cost estimate. Findings land in the PR comment. Start advisory, enforce when ready.

    The gates

  • Repeatable per customer

    One reusable engine, one landing-zone repository template. Stand up a new customer by running the bootstrap, which generates the repo and wires the identities, then pin versions and set a handful of secrets.

    Setup

What it is

The platform is a shared engine and a per-customer repository:

Repository Role
PR-ops engine The shared automation: GitHub Actions reusable workflows and shell scripts that plan, apply, detect drift, and run the gates. Customer repos call it at a pinned tag.
Landing-zone repository A per-customer Terragrunt monorepo describing the Azure landing zone. It holds the infrastructure plus two thin caller workflows that invoke the engine.

The result is the same review-driven workflow teams already know from Digger or Atlantis, but with nothing running outside your GitHub organisation and your Azure tenants.

Where to start