Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
  - destroy

Terraform will perform the following actions:

  # module.management_groups.azurerm_management_group.root will be created
  + resource "azurerm_management_group" "root" {
      + display_name               = "Lyon IT Consulting"
      + id                         = (known after apply)
      + name                       = "lyonit-root"
      + parent_management_group_id = "/providers/Microsoft.Management/managementGroups/tenant-root-id"
    }

  # module.management_groups.azurerm_management_group.platform will be created
  + resource "azurerm_management_group" "platform" {
      + display_name               = "Platform"
      + id                         = (known after apply)
      + name                       = "lyonit-platform"
      + parent_management_group_id = (known after apply)
    }

  # module.management_groups.azurerm_management_group.landing_zones will be created
  + resource "azurerm_management_group" "landing_zones" {
      + display_name               = "Landing Zones"
      + id                         = (known after apply)
      + name                       = "lyonit-landingzones"
      + parent_management_group_id = (known after apply)
    }

  # module.management_groups.azurerm_management_group.connectivity will be created
  + resource "azurerm_management_group" "connectivity" {
      + display_name               = "Connectivity"
      + id                         = (known after apply)
      + name                       = "lyonit-connectivity"
      + parent_management_group_id = (known after apply)
    }

  # module.management_groups.azurerm_management_group.sandbox will be created
  + resource "azurerm_management_group" "sandbox" {
      + display_name               = "Sandbox"
      + id                         = (known after apply)
      + name                       = "lyonit-sandbox"
      + parent_management_group_id = (known after apply)
    }

  # module.policy.azurerm_policy_set_definition.landing_zone_baseline will be created
  + resource "azurerm_policy_set_definition" "landing_zone_baseline" {
      + description           = "Baseline governance policies for all landing zones"
      + display_name          = "Landing Zone Baseline"
      + id                    = (known after apply)
      + management_group_name = "lyonit-root"
      + name                  = "landing-zone-baseline"
      + policy_type           = "Custom"
    }

  # module.policy.azurerm_policy_assignment.require_tags["lyonit-landingzones"] will be created
  + resource "azurerm_policy_assignment" "require_tags" {
      + description          = "Enforce mandatory resource tags across all workloads"
      + display_name         = "Require mandatory resource tags"
      + enforcement_mode     = "Default"
      + id                   = (known after apply)
      + name                 = "require-mandatory-tags"
      + policy_definition_id = "/providers/Microsoft.Authorization/policySetDefinitions/..."
      + scope                = (known after apply)

      + parameters = jsonencode({
          + tagNames = {
              + value = ["Environment", "CostCenter", "ManagedBy", "Owner"]
            }
        })
    }

  # module.policy.azurerm_policy_assignment.defender_for_cloud will be created
  + resource "azurerm_policy_assignment" "defender_for_cloud" {
      + display_name         = "Enable Microsoft Defender for Cloud"
      + enforcement_mode     = "Default"
      + id                   = (known after apply)
      + name                 = "enable-defender-for-cloud"
      + policy_definition_id = "/providers/Microsoft.Authorization/policySetDefinitions/..."
      + scope                = (known after apply)
    }

  # module.policy.azurerm_policy_assignment.deny_public_storage will be created
  + resource "azurerm_policy_assignment" "deny_public_storage" {
      + display_name         = "Deny public access to storage accounts"
      + enforcement_mode     = "Default"
      + id                   = (known after apply)
      + name                 = "deny-public-storage-access"
      + policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/..."
      + scope                = (known after apply)
    }

  # module.connectivity.azurerm_resource_group.hub will be created
  + resource "azurerm_resource_group" "hub" {
      + id       = (known after apply)
      + location = "uksouth"
      + name     = "rg-connectivity-hub-uks-001"
      + tags     = {
          + "CostCenter"  = "CC-0010"
          + "Environment" = "Production"
          + "ManagedBy"   = "Terraform"
          + "Module"      = "connectivity"
        }
    }

  # module.connectivity.azurerm_virtual_network.hub will be created
  + resource "azurerm_virtual_network" "hub" {
      + address_space       = ["10.0.0.0/16"]
      + dns_servers         = ["10.0.1.4", "10.0.1.5"]
      + id                  = (known after apply)
      + location            = "uksouth"
      + name                = "vnet-hub-uks-001"
      + resource_group_name = "rg-connectivity-hub-uks-001"
      + tags                = {
          + "Environment" = "Production"
          + "ManagedBy"   = "Terraform"
        }
    }

  # module.connectivity.azurerm_subnet.gateway will be created
  + resource "azurerm_subnet" "gateway" {
      + address_prefixes     = ["10.0.0.0/27"]
      + id                   = (known after apply)
      + name                 = "GatewaySubnet"
      + resource_group_name  = "rg-connectivity-hub-uks-001"
      + virtual_network_name = "vnet-hub-uks-001"
    }

  # module.connectivity.azurerm_subnet.firewall will be created
  + resource "azurerm_subnet" "firewall" {
      + address_prefixes     = ["10.0.0.64/26"]
      + id                   = (known after apply)
      + name                 = "AzureFirewallSubnet"
      + resource_group_name  = "rg-connectivity-hub-uks-001"
      + virtual_network_name = "vnet-hub-uks-001"
    }

  # module.connectivity.azurerm_subnet.management will be created
  + resource "azurerm_subnet" "management" {
      + address_prefixes     = ["10.0.1.0/24"]
      + id                   = (known after apply)
      + name                 = "snet-management-001"
      + resource_group_name  = "rg-connectivity-hub-uks-001"
      + virtual_network_name = "vnet-hub-uks-001"
    }

  # module.connectivity.azurerm_public_ip.firewall will be created
  + resource "azurerm_public_ip" "firewall" {
      + allocation_method   = "Static"
      + id                  = (known after apply)
      + ip_address          = (known after apply)
      + location            = "uksouth"
      + name                = "pip-azfw-hub-uks-001"
      + resource_group_name = "rg-connectivity-hub-uks-001"
      + sku                 = "Standard"
    }

  # module.connectivity.azurerm_firewall.hub will be created
  + resource "azurerm_firewall" "hub" {
      + id                  = (known after apply)
      + location            = "uksouth"
      + name                = "afw-hub-uks-001"
      + resource_group_name = "rg-connectivity-hub-uks-001"
      + sku_name            = "AZFW_VNet"
      + sku_tier            = "Premium"
      + threat_intel_mode   = "Alert"
      + tags                = {
          + "Environment" = "Production"
          + "ManagedBy"   = "Terraform"
        }

      + ip_configuration {
          + name                 = "configuration"
          + public_ip_address_id = (known after apply)
          + subnet_id            = (known after apply)
        }
    }

  # module.connectivity.azurerm_firewall_policy.hub will be created
  + resource "azurerm_firewall_policy" "hub" {
      + id                       = (known after apply)
      + location                 = "uksouth"
      + name                     = "afwp-hub-uks-001"
      + resource_group_name      = "rg-connectivity-hub-uks-001"
      + sku                      = "Premium"
      + threat_intelligence_mode = "Alert"
    }

  # module.connectivity.azurerm_virtual_network_gateway.vpn will be created
  + resource "azurerm_virtual_network_gateway" "vpn" {
      + id                  = (known after apply)
      + location            = "uksouth"
      + name                = "vgw-hub-uks-001"
      + resource_group_name = "rg-connectivity-hub-uks-001"
      + sku                 = "VpnGw2AZ"
      + type                = "Vpn"
      + vpn_type            = "RouteBased"

      + ip_configuration {
          + id                            = (known after apply)
          + name                          = "vnetGatewayConfig"
          + private_ip_address_allocation = "Dynamic"
          + public_ip_address_id          = (known after apply)
          + subnet_id                     = (known after apply)
        }
    }

  # module.connectivity.azurerm_route_table.spokes will be created
  + resource "azurerm_route_table" "spokes" {
      + disable_bgp_route_propagation = false
      + id                            = (known after apply)
      + location                      = "uksouth"
      + name                          = "rt-hub-spokes-uks-001"
      + resource_group_name           = "rg-connectivity-hub-uks-001"

      + route {
          + address_prefix         = "0.0.0.0/0"
          + name                   = "default-to-firewall"
          + next_hop_in_ip_address = (known after apply)
          + next_hop_type          = "VirtualAppliance"
        }
    }

  # module.connectivity.azurerm_private_dns_zone.zones["privatelink.blob.core.windows.net"] will be created
  + resource "azurerm_private_dns_zone" "zones" {
      + id                        = (known after apply)
      + max_number_of_record_sets = (known after apply)
      + name                      = "privatelink.blob.core.windows.net"
      + number_of_record_sets     = (known after apply)
      + resource_group_name       = "rg-connectivity-hub-uks-001"
    }

  # module.connectivity.azurerm_private_dns_zone.zones["privatelink.vaultcore.azure.net"] will be created
  + resource "azurerm_private_dns_zone" "zones" {
      + id                        = (known after apply)
      + name                      = "privatelink.vaultcore.azure.net"
      + number_of_record_sets     = (known after apply)
      + resource_group_name       = "rg-connectivity-hub-uks-001"
    }

  # module.connectivity.azurerm_private_dns_zone.zones["privatelink.azurecr.io"] will be created
  + resource "azurerm_private_dns_zone" "zones" {
      + id                        = (known after apply)
      + name                      = "privatelink.azurecr.io"
      + number_of_record_sets     = (known after apply)
      + resource_group_name       = "rg-connectivity-hub-uks-001"
    }

  # module.connectivity.azurerm_private_dns_zone.zones["privatelink.database.windows.net"] will be created
  + resource "azurerm_private_dns_zone" "zones" {
      + id                        = (known after apply)
      + name                      = "privatelink.database.windows.net"
      + number_of_record_sets     = (known after apply)
      + resource_group_name       = "rg-connectivity-hub-uks-001"
    }

  # module.subscription_vending.azurerm_subscription.workload["corp-app-01"] will be created
  + resource "azurerm_subscription" "workload" {
      + alias             = "sub-corp-app-01"
      + billing_scope_id  = "/providers/Microsoft.Billing/billingAccounts/12345678/billingProfiles/ABCD-1234/invoiceSections/EFGH-5678"
      + id                = (known after apply)
      + subscription_id   = (known after apply)
      + subscription_name = "sub-corp-app-01"
      + tags              = {
          + "BusinessUnit" = "Corporate Applications"
          + "CostCenter"   = "CC-1042"
          + "Environment"  = "Production"
          + "ManagedBy"    = "Terraform"
          + "Owner"        = "platform-team"
        }
    }

  # module.subscription_vending.azurerm_management_group_subscription_association.workload["corp-app-01"] will be created
  + resource "azurerm_management_group_subscription_association" "workload" {
      + id                  = (known after apply)
      + management_group_id = (known after apply)
      + subscription_id     = (known after apply)
    }

  # module.subscription_vending.azurerm_virtual_network.spoke["corp-app-01"] will be created
  + resource "azurerm_virtual_network" "spoke" {
      + address_space       = ["10.10.0.0/22"]
      + id                  = (known after apply)
      + location            = "uksouth"
      + name                = "vnet-spoke-corp-app-01-uks"
      + resource_group_name = (known after apply)
    }

  # module.subscription_vending.azurerm_virtual_network_peering.hub_to_spoke["corp-app-01"] will be created
  + resource "azurerm_virtual_network_peering" "hub_to_spoke" {
      + allow_forwarded_traffic   = true
      + allow_gateway_transit     = true
      + id                        = (known after apply)
      + name                      = "peer-hub-to-corp-app-01"
      + remote_virtual_network_id = (known after apply)
      + resource_group_name       = "rg-connectivity-hub-uks-001"
      + use_remote_gateways       = false
      + virtual_network_name      = "vnet-hub-uks-001"
    }

  # module.subscription_vending.azurerm_virtual_network_peering.spoke_to_hub["corp-app-01"] will be created
  + resource "azurerm_virtual_network_peering" "spoke_to_hub" {
      + allow_forwarded_traffic   = true
      + allow_gateway_transit     = false
      + id                        = (known after apply)
      + name                      = "peer-corp-app-01-to-hub"
      + remote_virtual_network_id = (known after apply)
      + resource_group_name       = (known after apply)
      + use_remote_gateways       = true
      + virtual_network_name      = "vnet-spoke-corp-app-01-uks"
    }

  # module.role_assignments.azurerm_role_assignment.platform_owners will be created
  + resource "azurerm_role_assignment" "platform_owners" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "00000000-0000-0000-0000-000000000001"
      + principal_type                   = "Group"
      + role_definition_name             = "Owner"
      + scope                            = (known after apply)
      + skip_service_principal_aad_check = false
    }

  # module.role_assignments.azurerm_role_assignment.network_contributor will be created
  + resource "azurerm_role_assignment" "network_contributor" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "00000000-0000-0000-0000-000000000002"
      + principal_type                   = "Group"
      + role_definition_name             = "Network Contributor"
      + scope                            = (known after apply)
      + skip_service_principal_aad_check = false
    }

  # module.role_assignments.azurerm_role_assignment.billing_reader will be created
  + resource "azurerm_role_assignment" "billing_reader" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "00000000-0000-0000-0000-000000000003"
      + principal_type                   = "Group"
      + role_definition_name             = "Billing Reader"
      + scope                            = (known after apply)
      + skip_service_principal_aad_check = false
    }

  # module.management.azurerm_resource_group.management will be created
  + resource "azurerm_resource_group" "management" {
      + id       = (known after apply)
      + location = "uksouth"
      + name     = "rg-management-uks-001"
      + tags     = {
          + "Environment" = "Production"
          + "ManagedBy"   = "Terraform"
        }
    }

  # module.management.azurerm_log_analytics_workspace.central will be created
  + resource "azurerm_log_analytics_workspace" "central" {
      + id                  = (known after apply)
      + location            = "uksouth"
      + name                = "law-platform-uks-001"
      + resource_group_name = "rg-management-uks-001"
      + retention_in_days   = 90
      + sku                 = "PerGB2018"
      + tags                = {
          + "Environment" = "Production"
          + "ManagedBy"   = "Terraform"
        }
    }

  # module.management.azurerm_automation_account.platform will be created
  + resource "azurerm_automation_account" "platform" {
      + dsc_primary_access_key = (sensitive value)
      + dsc_server_endpoint    = (known after apply)
      + id                     = (known after apply)
      + location               = "uksouth"
      + name                   = "aa-platform-uks-001"
      + resource_group_name    = "rg-management-uks-001"
      + sku_name               = "Basic"
    }

  # module.management.azurerm_monitor_diagnostic_setting.firewall will be updated in-place
  ~ resource "azurerm_monitor_diagnostic_setting" "firewall" {
        id   = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-connectivity-hub-uks-001/providers/Microsoft.Insights/diagnosticSettings/afw-diag"
      ~ log_analytics_workspace_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-management-old/providers/Microsoft.OperationalInsights/workspaces/law-platform-old"
                                  -> "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-management-uks-001/providers/Microsoft.OperationalInsights/workspaces/law-platform-uks-001"
        name = "afw-diagnostics"
        # (5 unchanged attributes hidden)
    }

  # module.management.azurerm_security_center_workspace.platform will be updated in-place
  ~ resource "azurerm_security_center_workspace" "platform" {
        id           = "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Security/workspaceSettings/default"
      ~ workspace_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-management-old/providers/Microsoft.OperationalInsights/workspaces/law-platform-old"
                     -> "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-management-uks-001/providers/Microsoft.OperationalInsights/workspaces/law-platform-uks-001"
    }

  # module.management.azurerm_monitor_action_group.platform will be updated in-place
  ~ resource "azurerm_monitor_action_group" "platform" {
        id         = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-management-uks-001/providers/Microsoft.Insights/actionGroups/ag-platform-alerts"
        name       = "ag-platform-alerts"
      ~ short_name = "PlatformAlt"
                  -> "PlatAlerts"
        # (3 unchanged attributes hidden)
    }

  # module.policy.azurerm_policy_assignment.no_public_ip["lyonit-landingzones"] will be destroyed
  - resource "azurerm_policy_assignment" "no_public_ip" {
      - display_name         = "Deny Public IP Addresses (Legacy)"
      - enforcement_mode     = "Default"
      - id                   = "/providers/Microsoft.Management/managementGroups/lyonit-landingzones/providers/Microsoft.Authorization/policyAssignments/deny-public-ip-legacy"
      - name                 = "deny-public-ip-legacy"
      - policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/83a86a26-fd1f-447c-b59d-e51f44264114"
      - scope                = "/providers/Microsoft.Management/managementGroups/lyonit-landingzones"
    }

Plan: 38 to add, 3 to change, 1 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
  - destroy

Terraform will perform the following actions:

  # module.management_groups.azurerm_management_group.root will be created
  + resource "azurerm_management_group" "root" {
      + display_name               = "Lyon IT Consulting"
      + id                         = (known after apply)
      + name                       = "lyonit-root"
      + parent_management_group_id = "/providers/Microsoft.Management/managementGroups/tenant-root-id"
    }

  # module.management_groups.azurerm_management_group.platform will be created
  + resource "azurerm_management_group" "platform" {
      + display_name               = "Platform"
      + id                         = (known after apply)
      + name                       = "lyonit-platform"
      + parent_management_group_id = (known after apply)
    }

  # module.management_groups.azurerm_management_group.landing_zones will be created
  + resource "azurerm_management_group" "landing_zones" {
      + display_name               = "Landing Zones"
      + id                         = (known after apply)
      + name                       = "lyonit-landingzones"
      + parent_management_group_id = (known after apply)
    }

  # module.management_groups.azurerm_management_group.connectivity will be created
  + resource "azurerm_management_group" "connectivity" {
      + display_name               = "Connectivity"
      + id                         = (known after apply)
      + name                       = "lyonit-connectivity"
      + parent_management_group_id = (known after apply)
    }

  # module.management_groups.azurerm_management_group.sandbox will be created
  + resource "azurerm_management_group" "sandbox" {
      + display_name               = "Sandbox"
      + id                         = (known after apply)
      + name                       = "lyonit-sandbox"
      + parent_management_group_id = (known after apply)
    }

  # module.policy.azurerm_policy_set_definition.landing_zone_baseline will be created
  + resource "azurerm_policy_set_definition" "landing_zone_baseline" {
      + description           = "Baseline governance policies for all landing zones"
      + display_name          = "Landing Zone Baseline"
      + id                    = (known after apply)
      + management_group_name = "lyonit-root"
      + name                  = "landing-zone-baseline"
      + policy_type           = "Custom"
    }

  # module.policy.azurerm_policy_assignment.require_tags["lyonit-landingzones"] will be created
  + resource "azurerm_policy_assignment" "require_tags" {
      + description          = "Enforce mandatory resource tags across all workloads"
      + display_name         = "Require mandatory resource tags"
      + enforcement_mode     = "Default"
      + id                   = (known after apply)
      + name                 = "require-mandatory-tags"
      + policy_definition_id = "/providers/Microsoft.Authorization/policySetDefinitions/..."
      + scope                = (known after apply)

      + parameters = jsonencode({
          + tagNames = {
              + value = ["Environment", "CostCenter", "ManagedBy", "Owner"]
            }
        })
    }

  # module.policy.azurerm_policy_assignment.defender_for_cloud will be created
  + resource "azurerm_policy_assignment" "defender_for_cloud" {
      + display_name         = "Enable Microsoft Defender for Cloud"
      + enforcement_mode     = "Default"
      + id                   = (known after apply)
      + name                 = "enable-defender-for-cloud"
      + policy_definition_id = "/providers/Microsoft.Authorization/policySetDefinitions/..."
      + scope                = (known after apply)
    }

  # module.policy.azurerm_policy_assignment.deny_public_storage will be created
  + resource "azurerm_policy_assignment" "deny_public_storage" {
      + display_name         = "Deny public access to storage accounts"
      + enforcement_mode     = "Default"
      + id                   = (known after apply)
      + name                 = "deny-public-storage-access"
      + policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/..."
      + scope                = (known after apply)
    }

  # module.connectivity.azurerm_resource_group.hub will be created
  + resource "azurerm_resource_group" "hub" {
      + id       = (known after apply)
      + location = "uksouth"
      + name     = "rg-connectivity-hub-uks-001"
      + tags     = {
          + "CostCenter"  = "CC-0010"
          + "Environment" = "Production"
          + "ManagedBy"   = "Terraform"
          + "Module"      = "connectivity"
        }
    }

  # module.connectivity.azurerm_virtual_network.hub will be created
  + resource "azurerm_virtual_network" "hub" {
      + address_space       = ["10.0.0.0/16"]
      + dns_servers         = ["10.0.1.4", "10.0.1.5"]
      + id                  = (known after apply)
      + location            = "uksouth"
      + name                = "vnet-hub-uks-001"
      + resource_group_name = "rg-connectivity-hub-uks-001"
      + tags                = {
          + "Environment" = "Production"
          + "ManagedBy"   = "Terraform"
        }
    }

  # module.connectivity.azurerm_subnet.gateway will be created
  + resource "azurerm_subnet" "gateway" {
      + address_prefixes     = ["10.0.0.0/27"]
      + id                   = (known after apply)
      + name                 = "GatewaySubnet"
      + resource_group_name  = "rg-connectivity-hub-uks-001"
      + virtual_network_name = "vnet-hub-uks-001"
    }

  # module.connectivity.azurerm_subnet.firewall will be created
  + resource "azurerm_subnet" "firewall" {
      + address_prefixes     = ["10.0.0.64/26"]
      + id                   = (known after apply)
      + name                 = "AzureFirewallSubnet"
      + resource_group_name  = "rg-connectivity-hub-uks-001"
      + virtual_network_name = "vnet-hub-uks-001"
    }

  # module.connectivity.azurerm_subnet.management will be created
  + resource "azurerm_subnet" "management" {
      + address_prefixes     = ["10.0.1.0/24"]
      + id                   = (known after apply)
      + name                 = "snet-management-001"
      + resource_group_name  = "rg-connectivity-hub-uks-001"
      + virtual_network_name = "vnet-hub-uks-001"
    }

  # module.connectivity.azurerm_public_ip.firewall will be created
  + resource "azurerm_public_ip" "firewall" {
      + allocation_method   = "Static"
      + id                  = (known after apply)
      + ip_address          = (known after apply)
      + location            = "uksouth"
      + name                = "pip-azfw-hub-uks-001"
      + resource_group_name = "rg-connectivity-hub-uks-001"
      + sku                 = "Standard"
    }

  # module.connectivity.azurerm_firewall.hub will be created
  + resource "azurerm_firewall" "hub" {
      + id                  = (known after apply)
      + location            = "uksouth"
      + name                = "afw-hub-uks-001"
      + resource_group_name = "rg-connectivity-hub-uks-001"
      + sku_name            = "AZFW_VNet"
      + sku_tier            = "Premium"
      + threat_intel_mode   = "Alert"
      + tags                = {
          + "Environment" = "Production"
          + "ManagedBy"   = "Terraform"
        }

      + ip_configuration {
          + name                 = "configuration"
          + public_ip_address_id = (known after apply)
          + subnet_id            = (known after apply)
        }
    }

  # module.connectivity.azurerm_firewall_policy.hub will be created
  + resource "azurerm_firewall_policy" "hub" {
      + id                       = (known after apply)
      + location                 = "uksouth"
      + name                     = "afwp-hub-uks-001"
      + resource_group_name      = "rg-connectivity-hub-uks-001"
      + sku                      = "Premium"
      + threat_intelligence_mode = "Alert"
    }

  # module.connectivity.azurerm_virtual_network_gateway.vpn will be created
  + resource "azurerm_virtual_network_gateway" "vpn" {
      + id                  = (known after apply)
      + location            = "uksouth"
      + name                = "vgw-hub-uks-001"
      + resource_group_name = "rg-connectivity-hub-uks-001"
      + sku                 = "VpnGw2AZ"
      + type                = "Vpn"
      + vpn_type            = "RouteBased"

      + ip_configuration {
          + id                            = (known after apply)
          + name                          = "vnetGatewayConfig"
          + private_ip_address_allocation = "Dynamic"
          + public_ip_address_id          = (known after apply)
          + subnet_id                     = (known after apply)
        }
    }

  # module.connectivity.azurerm_route_table.spokes will be created
  + resource "azurerm_route_table" "spokes" {
      + disable_bgp_route_propagation = false
      + id                            = (known after apply)
      + location                      = "uksouth"
      + name                          = "rt-hub-spokes-uks-001"
      + resource_group_name           = "rg-connectivity-hub-uks-001"

      + route {
          + address_prefix         = "0.0.0.0/0"
          + name                   = "default-to-firewall"
          + next_hop_in_ip_address = (known after apply)
          + next_hop_type          = "VirtualAppliance"
        }
    }

  # module.connectivity.azurerm_private_dns_zone.zones["privatelink.blob.core.windows.net"] will be created
  + resource "azurerm_private_dns_zone" "zones" {
      + id                        = (known after apply)
      + max_number_of_record_sets = (known after apply)
      + name                      = "privatelink.blob.core.windows.net"
      + number_of_record_sets     = (known after apply)
      + resource_group_name       = "rg-connectivity-hub-uks-001"
    }

  # module.connectivity.azurerm_private_dns_zone.zones["privatelink.vaultcore.azure.net"] will be created
  + resource "azurerm_private_dns_zone" "zones" {
      + id                        = (known after apply)
      + name                      = "privatelink.vaultcore.azure.net"
      + number_of_record_sets     = (known after apply)
      + resource_group_name       = "rg-connectivity-hub-uks-001"
    }

  # module.connectivity.azurerm_private_dns_zone.zones["privatelink.azurecr.io"] will be created
  + resource "azurerm_private_dns_zone" "zones" {
      + id                        = (known after apply)
      + name                      = "privatelink.azurecr.io"
      + number_of_record_sets     = (known after apply)
      + resource_group_name       = "rg-connectivity-hub-uks-001"
    }

  # module.connectivity.azurerm_private_dns_zone.zones["privatelink.database.windows.net"] will be created
  + resource "azurerm_private_dns_zone" "zones" {
      + id                        = (known after apply)
      + name                      = "privatelink.database.windows.net"
      + number_of_record_sets     = (known after apply)
      + resource_group_name       = "rg-connectivity-hub-uks-001"
    }

  # module.subscription_vending.azurerm_subscription.workload["corp-app-01"] will be created
  + resource "azurerm_subscription" "workload" {
      + alias             = "sub-corp-app-01"
      + billing_scope_id  = "/providers/Microsoft.Billing/billingAccounts/12345678/billingProfiles/ABCD-1234/invoiceSections/EFGH-5678"
      + id                = (known after apply)
      + subscription_id   = (known after apply)
      + subscription_name = "sub-corp-app-01"
      + tags              = {
          + "BusinessUnit" = "Corporate Applications"
          + "CostCenter"   = "CC-1042"
          + "Environment"  = "Production"
          + "ManagedBy"    = "Terraform"
          + "Owner"        = "platform-team"
        }
    }

  # module.subscription_vending.azurerm_management_group_subscription_association.workload["corp-app-01"] will be created
  + resource "azurerm_management_group_subscription_association" "workload" {
      + id                  = (known after apply)
      + management_group_id = (known after apply)
      + subscription_id     = (known after apply)
    }

  # module.subscription_vending.azurerm_virtual_network.spoke["corp-app-01"] will be created
  + resource "azurerm_virtual_network" "spoke" {
      + address_space       = ["10.10.0.0/22"]
      + id                  = (known after apply)
      + location            = "uksouth"
      + name                = "vnet-spoke-corp-app-01-uks"
      + resource_group_name = (known after apply)
    }

  # module.subscription_vending.azurerm_virtual_network_peering.hub_to_spoke["corp-app-01"] will be created
  + resource "azurerm_virtual_network_peering" "hub_to_spoke" {
      + allow_forwarded_traffic   = true
      + allow_gateway_transit     = true
      + id                        = (known after apply)
      + name                      = "peer-hub-to-corp-app-01"
      + remote_virtual_network_id = (known after apply)
      + resource_group_name       = "rg-connectivity-hub-uks-001"
      + use_remote_gateways       = false
      + virtual_network_name      = "vnet-hub-uks-001"
    }

  # module.subscription_vending.azurerm_virtual_network_peering.spoke_to_hub["corp-app-01"] will be created
  + resource "azurerm_virtual_network_peering" "spoke_to_hub" {
      + allow_forwarded_traffic   = true
      + allow_gateway_transit     = false
      + id                        = (known after apply)
      + name                      = "peer-corp-app-01-to-hub"
      + remote_virtual_network_id = (known after apply)
      + resource_group_name       = (known after apply)
      + use_remote_gateways       = true
      + virtual_network_name      = "vnet-spoke-corp-app-01-uks"
    }

  # module.role_assignments.azurerm_role_assignment.platform_owners will be created
  + resource "azurerm_role_assignment" "platform_owners" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "00000000-0000-0000-0000-000000000001"
      + principal_type                   = "Group"
      + role_definition_name             = "Owner"
      + scope                            = (known after apply)
      + skip_service_principal_aad_check = false
    }

  # module.role_assignments.azurerm_role_assignment.network_contributor will be created
  + resource "azurerm_role_assignment" "network_contributor" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "00000000-0000-0000-0000-000000000002"
      + principal_type                   = "Group"
      + role_definition_name             = "Network Contributor"
      + scope                            = (known after apply)
      + skip_service_principal_aad_check = false
    }

  # module.role_assignments.azurerm_role_assignment.billing_reader will be created
  + resource "azurerm_role_assignment" "billing_reader" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "00000000-0000-0000-0000-000000000003"
      + principal_type                   = "Group"
      + role_definition_name             = "Billing Reader"
      + scope                            = (known after apply)
      + skip_service_principal_aad_check = false
    }

  # module.management.azurerm_resource_group.management will be created
  + resource "azurerm_resource_group" "management" {
      + id       = (known after apply)
      + location = "uksouth"
      + name     = "rg-management-uks-001"
      + tags     = {
          + "Environment" = "Production"
          + "ManagedBy"   = "Terraform"
        }
    }

  # module.management.azurerm_log_analytics_workspace.central will be created
  + resource "azurerm_log_analytics_workspace" "central" {
      + id                  = (known after apply)
      + location            = "uksouth"
      + name                = "law-platform-uks-001"
      + resource_group_name = "rg-management-uks-001"
      + retention_in_days   = 90
      + sku                 = "PerGB2018"
      + tags                = {
          + "Environment" = "Production"
          + "ManagedBy"   = "Terraform"
        }
    }

  # module.management.azurerm_automation_account.platform will be created
  + resource "azurerm_automation_account" "platform" {
      + dsc_primary_access_key = (sensitive value)
      + dsc_server_endpoint    = (known after apply)
      + id                     = (known after apply)
      + location               = "uksouth"
      + name                   = "aa-platform-uks-001"
      + resource_group_name    = "rg-management-uks-001"
      + sku_name               = "Basic"
    }

  # module.management.azurerm_monitor_diagnostic_setting.firewall will be updated in-place
  ~ resource "azurerm_monitor_diagnostic_setting" "firewall" {
        id   = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-connectivity-hub-uks-001/providers/Microsoft.Insights/diagnosticSettings/afw-diag"
      ~ log_analytics_workspace_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-management-old/providers/Microsoft.OperationalInsights/workspaces/law-platform-old"
                                  -> "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-management-uks-001/providers/Microsoft.OperationalInsights/workspaces/law-platform-uks-001"
        name = "afw-diagnostics"
        # (5 unchanged attributes hidden)
    }

  # module.management.azurerm_security_center_workspace.platform will be updated in-place
  ~ resource "azurerm_security_center_workspace" "platform" {
        id           = "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Security/workspaceSettings/default"
      ~ workspace_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-management-old/providers/Microsoft.OperationalInsights/workspaces/law-platform-old"
                     -> "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-management-uks-001/providers/Microsoft.OperationalInsights/workspaces/law-platform-uks-001"
    }

  # module.management.azurerm_monitor_action_group.platform will be updated in-place
  ~ resource "azurerm_monitor_action_group" "platform" {
        id         = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-management-uks-001/providers/Microsoft.Insights/actionGroups/ag-platform-alerts"
        name       = "ag-platform-alerts"
      ~ short_name = "PlatformAlt"
                  -> "PlatAlerts"
        # (3 unchanged attributes hidden)
    }

  # module.policy.azurerm_policy_assignment.no_public_ip["lyonit-landingzones"] will be destroyed
  - resource "azurerm_policy_assignment" "no_public_ip" {
      - display_name         = "Deny Public IP Addresses (Legacy)"
      - enforcement_mode     = "Default"
      - id                   = "/providers/Microsoft.Management/managementGroups/lyonit-landingzones/providers/Microsoft.Authorization/policyAssignments/deny-public-ip-legacy"
      - name                 = "deny-public-ip-legacy"
      - policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/83a86a26-fd1f-447c-b59d-e51f44264114"
      - scope                = "/providers/Microsoft.Management/managementGroups/lyonit-landingzones"
    }

Plan: 38 to add, 3 to change, 1 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

DevOps & Platform Engineering Consultant

Lyon IT Consulting designs and delivers secure, scalable cloud platforms across Azure and GCP - from landing zones and Kubernetes to Terraform, CI/CD, and the guardrails needed to operate at scale.

Alex Lyon · Lyon IT Consulting · Azure & GCP · Kubernetes · Terraform / IaC · 10+ years' experience

Get in touch View experience

Approach

About

I'm an independent DevOps and platform engineering consultant with over 10 years' experience delivering cloud and platform work across financial services, consulting, and UK government.

Most of my work sits at the platform layer - designing cloud foundations, Kubernetes platforms, infrastructure as code, and the delivery patterns that engineering teams build on.

I work hands-on and close to the problem. That means shaping architecture where needed, but also implementing the pipelines, guardrails, and platform components that make it real.

I'm typically brought in by regulated, enterprise, and public sector organisations that need stronger cloud foundations, clearer standards, and a more scalable way to operate - without unnecessary complexity.

Connect on LinkedIn

Technical stack

Cloud Platforms

Microsoft Azure Google Cloud Platform

IaC & Automation

Terraform OpenTofu Bicep Ansible

CI/CD

GitHub Actions Azure DevOps ArgoCD

Containers & Orchestration

Kubernetes AKS GKE Helm Docker

Governance & Security

Azure Policy Defender for Cloud Entra ID IAM

Observability

Azure Monitor Log Analytics Prometheus Grafana

Certifications

Verified credentials from Microsoft and Google.

Microsoft Certified

Azure Administrator Associate

Microsoft Certified

DevOps Engineer Expert

Google Certified

Professional Cloud DevOps Engineer

What I deliver

Core capabilities

Engagements are outcome-focused. I deliver working infrastructure and documented, maintainable platforms - not slide decks.

Cloud Platform Architecture

AzureGCPArchitectureHub-and-spokeMulti-cloud

Platform design across Azure and GCP - network topology, identity, access model, multi-account or multi-subscription structure, and the foundational decisions that everything else builds on.

Landing Zones & Cloud Foundations

End-to-end landing zone design and delivery on Azure and GCP. Management group hierarchies, project structures, policy, networking, RBAC, and governance guardrails that scale with the organisation.

Azure Landing ZonesGCP Landing ZoneCAFPolicyRBAC

Kubernetes Platforms (AKS / GKE)

Production Kubernetes from the ground up - multi-tenant clusters, GitOps-driven deployments, service mesh, and observability. Workload onboarding patterns and operator runbooks included.

AKSGKEKubernetesArgoCDHelmPrometheusGrafana

Infrastructure as Code & Automation

Terraform modules, state management, and CI/CD pipelines built to production standards. PR-based workflows, policy-as-code gates, drift detection, and module libraries your team can own.

TerraformOpenTofuBicepGitHub ActionsAzure DevOps

CI/CD & Developer Platform Enablement

Standardised pipelines, platform tooling, and self-service patterns that reduce friction for engineering teams. GitHub Actions, Azure DevOps, and ArgoCD at the centre.

GitHub ActionsAzure DevOpsArgoCDSelf-serviceGitOps

Cloud Governance, Security & Compliance

Identity and access management, Azure Policy, GCP Org Policy, Defender for Cloud, and the operational controls that keep platforms secure at scale. Guardrails that enable teams, not ones that block them.

Azure PolicyGCP Org PolicyDefender for CloudEntra IDIAM

What I work on

Typical engagements

The type of work I typically take on - across Azure, GCP, Kubernetes, and infrastructure as code.

Cloud foundations

Azure Landing Zone design and delivery - identity, networking, and governance built in from day one
Multi-region GCP Landing Zone design with IAM boundaries, project structure, and service controls

Kubernetes platforms

Production AKS and GKE platforms - multi-tenant, GitOps-driven, hardened for real workloads
Onboarding patterns, namespace provisioning, and operational runbooks that remove platform friction

Infrastructure as code

Terraform estates with reusable modules, PR workflows, and policy gates
Legacy environment migration into version-controlled IaC to reduce drift and enable safer change

Governance & security

Identity, access, and governance controls across Azure and GCP that don't slow engineering teams down
Cost controls, tagging standards, and reporting pipelines for visible, manageable cloud usage

Developer platforms & CI/CD

Standardised CI/CD pipelines and developer workflows that reduce friction and improve delivery speed
Self-service platform patterns that remove bottlenecks and reduce reliance on central platform teams

Advisory & architecture

Platform and cloud architecture reviews - identifying risk, technical debt, and practical improvement paths
Technical direction, decisions, and standards that engineering teams actually adopt

Work in depth

Case studies

Detailed breakdowns of past engagements - the context, approach, and outcomes. Full write-ups coming soon.

UK Government

Azure Landing Zone - UK Central Government

Coming soon

Design and delivery of a compliant, multi-subscription Azure Landing Zone for a UK central government department
Policy guardrails, identity controls, and hub-and-spoke network topology aligned to NCSC and GDS standards
GitOps-driven IaC pipeline enabling controlled, auditable change across the platform

AzureLanding ZonePolicyGovernanceTerraform

Professional Services

GKE Platform Engineering - Global Consulting

Coming soon

End-to-end GKE platform design for a globally distributed engineering organisation
Multi-tenant cluster architecture with GitOps-driven workload onboarding and self-service namespace provisioning
Observability stack, cost controls, and operator runbooks enabling the platform team to scale without headcount

GCPGKEKubernetesArgoCDTerraform

What clients say

Recommendations

Feedback from engineering leaders and platform teams across financial services, consulting, and government.

“Alex was one of the key contributors to our Azure team. He was instrumental in designing and implementing our Azure Landing Zone, providing expertise that enabled us to build a secure, scalable, and well-governed cloud platform. What sets Alex apart is not only his technical capability but also his approach to teamwork. He is dependable, collaborative, and always willing to support colleagues and share his knowledge. I would not hesitate to recommend Alex to any organisation looking for a skilled Azure professional.”

Venus Bailey

Head of Engineering · Cabinet Office

“Alex had the privilege of working with Alex for over two years, where he was instrumental in building the infrastructure and CI/CD processes across four AI B2B SaaS products on GCP. As one of the first DevOps engineers on the team, Alex set up DevOps practices, built the team, and established processes from the ground up. His expertise in infrastructure, particularly for Machine Learning environments, was remarkable. His ability to collaborate effectively across functions made him an invaluable partner.”

Sachin Shah

Founding CTO · Bain & Co Venture

“Alex is a very knowledgeable DevOps professional, who has a knack for cutting through the technical minutia and getting it over the line. A great team player and pleasant humour.”

Mo Tahir

Platform Engineering & DevOps Lead · ASOS

“Lyon IT Consulting helped us accelerate our move from continuous delivery to continuous deployment by putting in place a robust Kubernetes ecosystem, enabling us to move from 2 weekly deployments to multiple per day.”

Joe Muldoon

Software Engineering Director · INTO Global

Delivered as Lead DevOps Engineer via Broadlight Global

View LinkedIn profile

Engagement structure

Working with Lyon IT Consulting

Lyon IT Consulting operates as a UK limited company, engaged on a business-to-business basis to deliver defined outcomes.

Outcome-focused delivery

Engagements are scoped around specific deliverables - a working platform, a deployed landing zone, a CI/CD pipeline - not time and attendance.

Independent operation

Lyon IT Consulting uses its own equipment, tooling, and software licences, and operates independently of client IT estates where possible.

Commercially structured

All engagements run under a business-to-business contract, backed by professional indemnity and public liability insurance.

Get in touch

Start a conversation

If you need senior hands-on help with platform engineering, Azure or GCP, Kubernetes, Terraform, or cloud architecture, get in touch. I’m happy to discuss scope, timelines, and whether I’m the right fit.

[email protected]

All enquiries are treated as confidential. I’m typically available for new contract start dates with 2 to 4 weeks’ notice.