Keep Azure in the right regions: the allowed-locations policy

Stop resources landing in the wrong region. Azure's built-in allowed-locations policy is a real compliance control you can assign in a few lines of Terraform.