1524 07 Design Document Ada431cf

# Azure Design Document: static-webapp-test

**Version**: 1.0
**Date**: December 17, 2025
**Author**: Generated by Workload Documentation Generator
**Status**: Draft

---

## 1. Introduction

### 1.1 Document Purpose

This document provides a comprehensive design overview of the static-webapp-test infrastructure deployed on Azure.
It serves as the technical reference for operations, maintenance, and future enhancements.

### 1.2 Project Overview

| Attribute            | Value                                         |
| -------------------- | --------------------------------------------- |
| **Project Name**     | static-webapp-test                            |
| **Project Type**     | Static Web Application with Database Backend  |
| **Business Context** | Internal tool for workflow validation testing |
| **Environment**      | Development                                   |
| **Timeline**         | Demo/Test deployment                          |

### 1.3 Design Objectives

- Minimize cost while maintaining acceptable reliability
- Simple architecture suitable for internal tools
- Azure AD authentication for secure access
- Infrastructure as Code for repeatability

### 1.4 Constraints & Assumptions

| Constraint/Assumption | Description                                |
| --------------------- | ------------------------------------------ |
| Budget                | Maximum $50/month                          |
| User base             | 5-10 internal users                        |
| Data volume           | <5 GB total                                |
| Availability          | Non-critical (99.9% SLA acceptable)        |
| Compliance            | No regulatory requirements (internal tool) |

### 1.5 Stakeholders

| Role               | Team        | Responsibility   |
| ------------------ | ----------- | ---------------- |
| Solution Architect | DevOps Team | Design approval  |
| Operations         | DevOps Team | Day-2 operations |
| Development        | Dev Team    | Application code |

---

## 2. Azure Architecture Overview

### 2.1 Architecture Diagram

![Architecture Diagram](./07-ab-diagram.png)

### 2.2 Subscription & Resource Organization

| Level          | Name                      | Purpose                  |
| -------------- | ------------------------- | ------------------------ |
| Subscription   | Development               | Non-production workloads |
| Resource Group | rg-static-webapp-test-dev | All project resources    |

### 2.3 Region Selection

| Region        | Role    | Rationale                                  |
| ------------- | ------- | ------------------------------------------ |
| swedencentral | Primary | Sustainable operations, GDPR-compliant, EU |

### 2.4 Naming Conventions

| Resource Type  | Pattern                        | Example                      |
| -------------- | ------------------------------ | ---------------------------- |
| Resource Group | rg-{project}-{env}             | rg-static-webapp-test-dev    |
| Static Web App | stapp-{project}-{env}          | stapp-static-webapp-test-dev |
| SQL Server     | sql-{shortname}-{env}-{suffix} | sql-staticweba-dev-abc123    |
| SQL Database   | sqldb-{project}-{env}          | sqldb-static-webapp-test-dev |
| Log Analytics  | log-{project}-{env}            | log-static-webapp-test-dev   |
| App Insights   | appi-{project}-{env}           | appi-static-webapp-test-dev  |

### 2.5 Tagging Strategy

| Tag         | Purpose             | Values             |
| ----------- | ------------------- | ------------------ |
| Environment | Deployment stage    | dev                |
| Project     | Workload identifier | static-webapp-test |
| Owner       | Responsible team    | DevOps Team        |
| ManagedBy   | IaC tool            | Bicep              |

---

## 3. Networking

### 3.1 Network Topology

This is a **PaaS-only architecture** with no custom virtual network.
All services use public endpoints with firewall rules.

### 3.2 Network Security

| Service        | Access Control                            |
| -------------- | ----------------------------------------- |
| Static Web App | Public (Azure AD authentication required) |
| SQL Database   | Firewall: Allow Azure services only       |

### 3.3 DNS Configuration

| Service        | FQDN                                             |
| -------------- | ------------------------------------------------ |
| Static Web App | https://{random}.azurestaticapps.net             |
| SQL Server     | sql-staticweba-dev-{suffix}.database.windows.net |

---

## 4. Storage

### 4.1 Data Storage

| Data Type        | Storage Service | Configuration       |
| ---------------- | --------------- | ------------------- |
| Application Data | Azure SQL       | S0 tier, 250 GB max |
| Static Assets    | SWA (built-in)  | Global CDN          |

### 4.2 Encryption

| Layer      | Method                       |
| ---------- | ---------------------------- |
| At Rest    | Azure-managed keys (default) |
| In Transit | TLS 1.2 enforced             |

---

## 5. Compute

### 5.1 Compute Resources

| Resource       | Type            | SKU  | Purpose                  |
| -------------- | --------------- | ---- | ------------------------ |
| Static Web App | Static Web Apps | Free | HTML/CSS/JS hosting      |
| API Functions  | Azure Functions | Free | Backend API (integrated) |

### 5.2 Scaling Configuration

| Resource       | Scaling Mode | Limits                     |
| -------------- | ------------ | -------------------------- |
| Static Web App | Automatic    | Global CDN distribution    |
| SQL Database   | Manual       | 10 DTU (upgrade if needed) |

### 5.3 Availability

| Resource       | SLA    | Zone Redundancy |
| -------------- | ------ | --------------- |
| Static Web App | 99.95% | Yes (built-in)  |
| SQL Database   | 99.99% | No (Basic tier) |

---

## 6. Identity & Access

### 6.1 Authentication

| Method              | Configuration                |
| ------------------- | ---------------------------- |
| Identity Provider   | Azure Active Directory       |
| Authentication Flow | OAuth 2.0 / OIDC             |
| MFA                 | Not required (internal tool) |

### 6.2 Authorization (RBAC)

| Principal       | Role               | Scope          |
| --------------- | ------------------ | -------------- |
| DevOps Team     | Contributor        | Resource Group |
| SQL Admin (AAD) | SQL DB Contributor | SQL Server     |
| Application     | Managed Identity   | SQL Database   |

### 6.3 Managed Identities

| Resource       | Identity Type   | Purpose                 |
| -------------- | --------------- | ----------------------- |
| Static Web App | System-assigned | SQL Database connection |

---

## 7. Security & Compliance

### 7.1 Security Baseline

| Control                 | Status | Notes               |
| ----------------------- | ------ | ------------------- |
| HTTPS enforced          | ✅     | SWA default         |
| TLS 1.2 minimum         | ✅     | All services        |
| Azure AD authentication | ✅     | Required for access |
| SQL firewall            | ✅     | Azure services only |
| No public SQL access    | ✅     | Firewall configured |

### 7.2 Compliance Requirements

No regulatory compliance required (internal tool).

### 7.3 Azure Policy

Standard development subscription policies apply.

---

## 8. Backup & Disaster Recovery

### 8.1 Backup Strategy

| Resource     | Method               | Retention | RPO     |
| ------------ | -------------------- | --------- | ------- |
| SQL Database | Automated (Azure)    | 7 days    | 1 hour  |
| Static App   | GitHub repo (source) | Unlimited | Minutes |

### 8.2 Recovery Targets

| Metric | Target  | Notes                            |
| ------ | ------- | -------------------------------- |
| RTO    | 4 hours | Acceptable for non-critical tool |
| RPO    | 1 hour  | SQL automated backup frequency   |

### 8.3 Failover Strategy

Single region deployment - no automated failover.
Recovery via redeployment from IaC + database restore.

---

## 9. Management & Monitoring

### 9.1 Monitoring Strategy

| Component      | Tool                 | Metrics                    |
| -------------- | -------------------- | -------------------------- |
| Application    | Application Insights | Requests, failures, perf   |
| Infrastructure | Azure Monitor        | Resource health, DTU usage |
| Logs           | Log Analytics        | All diagnostic logs        |

### 9.2 Alerting

| Alert             | Condition       | Severity | Action        |
| ----------------- | --------------- | -------- | ------------- |
| SQL DTU > 80%     | DTU utilization | Warning  | Email team    |
| App failures > 5% | HTTP 5xx rate   | Critical | Email + Slack |

### 9.3 Diagnostics

All resources configured to send diagnostic logs to Log Analytics workspace.

---

## 10. Appendix

### 10.1 Full Resource Inventory

See [07-resource-inventory.md](./07-resource-inventory.md)

### 10.2 Cost Breakdown

See [03-des-cost-estimate.md](./03-des-cost-estimate.md)

| Service         | Monthly Cost |
| --------------- | ------------ |
| Static Web App  | $0.00        |
| SQL Database S0 | $14.52       |
| Monitoring      | $0.20        |
| **Total**       | **~$15/mo**  |

### 10.3 References

- [Azure Static Web Apps Documentation](https://learn.microsoft.com/azure/static-web-apps/)
- [Azure SQL Database Documentation](https://learn.microsoft.com/azure/azure-sql/)
- [Azure Well-Architected Framework](https://learn.microsoft.com/azure/well-architected/)