1524 07 Design Document 9c3413f4

# 🏛️ Step 7: Design Document - Static Web Application

![Step](https://img.shields.io/badge/Step--7-purple?style=for-the-badge)
![Status](https://img.shields.io/badge/Status-Complete-green?style=for-the-badge)
![Agent](https://img.shields.io/badge/Agent-As--Built-indigo?style=for-the-badge)

<details open>
<summary><strong>📑 As-Built Documentation</strong></summary>

- [📝 1. Introduction](#-1-introduction)
- [🏛️ 2. Azure Architecture Overview](#️-2-azure-architecture-overview)
- [🌐 3. Networking](#-3-networking)
- [💾 4. Storage](#-4-storage)
- [💻 5. Compute](#-5-compute)
- [👤 6. Identity & Access](#-6-identity--access)
- [🔐 7. Security & Compliance](#-7-security--compliance)
- [🔄 8. Backup & Disaster Recovery](#-8-backup--disaster-recovery)
- [📊 9. Management & Monitoring](#-9-management--monitoring)
- [📎 10. Appendix](#-10-appendix)

</details>

> Generated by @as-built agent | 2025-12-17

| ⬅️ Previous                                        | 📑 Index            | Next ➡️                                                |
| -------------------------------------------------- | ------------------- | ------------------------------------------------------ |
| [07-compliance-matrix.md](07-compliance-matrix.md) | [README](README.md) | [07-documentation-index.md](07-documentation-index.md) |

**Version**: 1.0 | **Status**: Draft | **Author**: Azure Agentic InfraOps

---

## 📝 1. Introduction

### 1.1 Document Purpose

This document provides a comprehensive design overview of the static-webapp-test infrastructure deployed on Azure.
It serves as the technical reference for operations, maintenance, and future enhancements.

### 1.2 Project Overview

| Attribute            | Value                                         |
| -------------------- | --------------------------------------------- |
| **Project Name**     | static-webapp-test                            |
| **Project Type**     | Static Web Application with Database Backend  |
| **Business Context** | Internal tool for workflow validation testing |
| **Environment**      | Development                                   |
| **Timeline**         | Demo/Test deployment                          |

### 1.3 Design Objectives

- Minimize cost while maintaining acceptable reliability
- Simple architecture suitable for internal tools
- Azure AD authentication for secure access
- Infrastructure as Code for repeatability

### 1.4 Constraints & Assumptions

| Constraint/Assumption | Description                                |
| --------------------- | ------------------------------------------ |
| Budget                | Maximum $50/month                          |
| User base             | 5-10 internal users                        |
| Data volume           | <5 GB total                                |
| Availability          | Non-critical (99.9% SLA acceptable)        |
| Compliance            | No regulatory requirements (internal tool) |

### 1.5 Stakeholders

| Role               | Team        | Responsibility   |
| ------------------ | ----------- | ---------------- |
| Solution Architect | DevOps Team | Design approval  |
| Operations         | DevOps Team | Day-2 operations |
| Development        | Dev Team    | Application code |

---

## 🏛️ 2. Azure Architecture Overview

### 2.1 Architecture Diagram

![Architecture Diagram](./07-ab-diagram.png)

### 2.2 Subscription & Resource Organization

| Level          | Name                      | Purpose                  |
| -------------- | ------------------------- | ------------------------ |
| Subscription   | Development               | Non-production workloads |
| Resource Group | rg-static-webapp-test-dev | All project resources    |

### 2.3 Region Selection

| Region        | Role    | Rationale                                  |
| ------------- | ------- | ------------------------------------------ |
| swedencentral | Primary | Sustainable operations, GDPR-compliant, EU |

### 2.4 Naming Conventions

| Resource Type  | Pattern                        | Example                      |
| -------------- | ------------------------------ | ---------------------------- |
| Resource Group | rg-{project}-{env}             | rg-static-webapp-test-dev    |
| Static Web App | stapp-{project}-{env}          | stapp-static-webapp-test-dev |
| SQL Server     | sql-{shortname}-{env}-{suffix} | sql-staticweba-dev-abc123    |
| SQL Database   | sqldb-{project}-{env}          | sqldb-static-webapp-test-dev |
| Log Analytics  | log-{project}-{env}            | log-static-webapp-test-dev   |
| App Insights   | appi-{project}-{env}           | appi-static-webapp-test-dev  |

### 2.5 Tagging Strategy

| Tag         | Purpose             | Values             |
| ----------- | ------------------- | ------------------ |
| Environment | Deployment stage    | dev                |
| Project     | Workload identifier | static-webapp-test |
| Owner       | Responsible team    | DevOps Team        |
| ManagedBy   | IaC tool            | Bicep              |

---

## 🌐 3. Networking

### 3.1 Network Topology

This is a **PaaS-only architecture** with no custom virtual network.
All services use public endpoints with firewall rules.

### 3.2 Network Security

| Service        | Access Control                            |
| -------------- | ----------------------------------------- |
| Static Web App | Public (Azure AD authentication required) |
| SQL Database   | Firewall: Allow Azure services only       |

### 3.3 DNS Configuration

| Service        | FQDN                                             |
| -------------- | ------------------------------------------------ |
| Static Web App | https://{random}.azurestaticapps.net             |
| SQL Server     | sql-staticweba-dev-{suffix}.database.windows.net |

---

## 💾 4. Storage

### 4.1 Data Storage

| Data Type        | Storage Service | Configuration       |
| ---------------- | --------------- | ------------------- |
| Application Data | Azure SQL       | S0 tier, 250 GB max |
| Static Assets    | SWA (built-in)  | Global CDN          |

### 4.2 Encryption

| Layer      | Method                       |
| ---------- | ---------------------------- |
| At Rest    | Azure-managed keys (default) |
| In Transit | TLS 1.2 enforced             |

---

## 💻 5. Compute

### 5.1 Compute Resources

| Resource       | Type            | SKU  | Purpose                  |
| -------------- | --------------- | ---- | ------------------------ |
| Static Web App | Static Web Apps | Free | HTML/CSS/JS hosting      |
| API Functions  | Azure Functions | Free | Backend API (integrated) |

### 5.2 Scaling Configuration

| Resource       | Scaling Mode | Limits                     |
| -------------- | ------------ | -------------------------- |
| Static Web App | Automatic    | Global CDN distribution    |
| SQL Database   | Manual       | 10 DTU (upgrade if needed) |

### 5.3 Availability

| Resource       | SLA    | Zone Redundancy |
| -------------- | ------ | --------------- |
| Static Web App | 99.95% | Yes (built-in)  |
| SQL Database   | 99.99% | No (Basic tier) |

---

## 👤 6. Identity & Access

### 6.1 Authentication

| Method              | Configuration                |
| ------------------- | ---------------------------- |
| Identity Provider   | Azure Active Directory       |
| Authentication Flow | OAuth 2.0 / OIDC             |
| MFA                 | Not required (internal tool) |

### 6.2 Authorization (RBAC)

| Principal       | Role               | Scope          |
| --------------- | ------------------ | -------------- |
| DevOps Team     | Contributor        | Resource Group |
| SQL Admin (AAD) | SQL DB Contributor | SQL Server     |
| Application     | Managed Identity   | SQL Database   |

### 6.3 Managed Identities

| Resource       | Identity Type   | Purpose                 |
| -------------- | --------------- | ----------------------- |
| Static Web App | System-assigned | SQL Database connection |

---

## 🔐 7. Security & Compliance

### 7.1 Security Baseline

| Control                 | Status | Notes               |
| ----------------------- | ------ | ------------------- |
| HTTPS enforced          | ✅     | SWA default         |
| TLS 1.2 minimum         | ✅     | All services        |
| Azure AD authentication | ✅     | Required for access |
| SQL firewall            | ✅     | Azure services only |
| No public SQL access    | ✅     | Firewall configured |

### 7.2 Compliance Requirements

No regulatory compliance required (internal tool).

### 7.3 Azure Policy

Standard development subscription policies apply.

---

## 🔄 8. Backup & Disaster Recovery

### 8.1 Backup Strategy

| Resource     | Method               | Retention | RPO     |
| ------------ | -------------------- | --------- | ------- |
| SQL Database | Automated (Azure)    | 7 days    | 1 hour  |
| Static App   | GitHub repo (source) | Unlimited | Minutes |

### 8.2 Recovery Targets

| Metric | Target  | Notes                            |
| ------ | ------- | -------------------------------- |
| RTO    | 4 hours | Acceptable for non-critical tool |
| RPO    | 1 hour  | SQL automated backup frequency   |

### 8.3 Failover Strategy

Single region deployment - no automated failover.
Recovery via redeployment from IaC + database restore.

---

## 📊 9. Management & Monitoring

### 9.1 Monitoring Strategy

| Component      | Tool                 | Metrics                    |
| -------------- | -------------------- | -------------------------- |
| Application    | Application Insights | Requests, failures, perf   |
| Infrastructure | Azure Monitor        | Resource health, DTU usage |
| Logs           | Log Analytics        | All diagnostic logs        |

### 9.2 Alerting

| Alert             | Condition       | Severity | Action        |
| ----------------- | --------------- | -------- | ------------- |
| SQL DTU > 80%     | DTU utilization | Warning  | Email team    |
| App failures > 5% | HTTP 5xx rate   | Critical | Email + Slack |

### 9.3 Diagnostics

All resources configured to send diagnostic logs to Log Analytics workspace.

---

## 📎 10. Appendix

### 10.1 Full Resource Inventory

See [07-resource-inventory.md](./07-resource-inventory.md)

### 10.2 Cost Breakdown

See [03-des-cost-estimate.md](./03-des-cost-estimate.md)

| Service         | Monthly Cost |
| --------------- | ------------ |
| Static Web App  | $0.00        |
| SQL Database S0 | $14.52       |
| Monitoring      | $0.20        |
| **Total**       | **~$15/mo**  |

### 10.3 References

- [Azure Static Web Apps Documentation](https://learn.microsoft.com/azure/static-web-apps/)
- [Azure SQL Database Documentation](https://learn.microsoft.com/azure/azure-sql/)
- [Azure Well-Architected Framework](https://learn.microsoft.com/azure/well-architected/)

---

<div align="center">

_Generated by **Azure Agentic InfraOps** | [GitHub](https://github.com/jonathan-vella/azure-agentic-infraops)_

</div>