security.networkExposure = public
The generator names the guaranteed control and writes no Terraform.
Azure landing zones with guardrails built in
Design the shared Azure platform, then deploy application landing zones that use its network, logging, and security controls. See how CloudWellArchitected handles a private Azure Databricks workspace.
Azure platform landing zone
Hub network, shared logging, and platform guardrails
Platform contract
Hub, address ranges, logging, and DNS inputs
Databricks application zone
Workspace in a spoke, connected to the hub
One change that blocks a confidential design
The example hub handles confidential workloads. Its baseline requires private network exposure under control SEC-005.
security.networkExposure = private
The corrected dry run lists 35 files it would generate. Deployment and runtime checks follow separately.
Private Azure Databricks application landing zone
CloudWellArchitected uses the platform contract to generate Terraform for a VNet-injected Azure Databricks workspace with public access disabled. The example uses private connectivity and depends on the shared hub for the platform services it declares.
What the platform supplies
A hub and address authority, a log destination, private DNS inputs, and the shared browser-authentication endpoint required by this private workspace pattern.
What the application team receives
Terraform for the supported workspace and network pattern. The tested analyticsprod dry run accepted the supplied platform contract and listed 41 files.
Where the generator stops
The repo’s rehearsal includes missing prerequisites such as the browser-authentication endpoint or private DNS zone. The generator reports which dependency needs to be resolved.
What to scope separately
Catalog administration and data permissions, production workloads, operating procedures, and runtime validation depend on the environment and engagement.
See the platform contract schema for the inputs the shared platform supplies and the Azure Databricks baseline for the controls used to evaluate the design.
Show the verified Databricks dry-run command
cwa generate --request examples/analyticsprod.json --architecture azure/application-databricks@2026.10.json --baseline azure/application-databricks@2026.10.json --platform platform-hub-prod --contracts examples/contracts --dry-runRun from the repo root with the current CLI available. The example uses the included platform contract and deploys no resources.
Technical references
The CloudWellArchitected schema catalog publishes the versioned formats for requests and evidence, along with framework mappings and architecture baselines. See how SEC-005 maps to the Azure Well-Architected Framework.
Price the platform and workload separately
The sample hub dry run deploys nothing. The repo’s cached model put the hub’s fixed components at about $1,205 per month, including $912.50 for Azure Firewall. That is illustrative model output, not a quote. Databricks workload compute, storage, and shared service usage are separate cost inputs. Size them for the actual workload before deployment.
Talk through your Azure design
Bring your network constraints, workload requirements, and the decision you need to make.