1548 04 Governance Constraints 30a1d2a6

# 🔒 Step 4: Governance Constraints - Static Web Application

![Step](https://img.shields.io/badge/Step--4-blue?style=for-the-badge)
![Status](https://img.shields.io/badge/Status-Complete-green?style=for-the-badge)
![Agent](https://img.shields.io/badge/Agent-Bicep--Planner-teal?style=for-the-badge)

<details open>
<summary><strong>📑 Governance Constraints</strong></summary>

- [🔍 Discovery Source](#-discovery-source)
- [📋 Azure Policy Compliance](#-azure-policy-compliance)
- [🔄 Plan Adaptations Based on Policies](#-plan-adaptations-based-on-policies)
- [🚫 Deployment Blockers](#-deployment-blockers)
- [🏷️ Required Tags](#️-required-tags)
- [🔐 Security Policies](#-security-policies)
- [💰 Cost Policies](#-cost-policies)
- [🌐 Network Policies](#-network-policies)

</details>

> Generated by @bicep-plan agent | 2024-12-17

| ⬅️ Previous                                        | 📑 Index            | Next ➡️                                                |
| -------------------------------------------------- | ------------------- | ------------------------------------------------------ |
| [03-des-cost-estimate.md](03-des-cost-estimate.md) | [README](README.md) | [04-implementation-plan.md](04-implementation-plan.md) |

This document captures the governance constraints and Azure Policy requirements
that must be addressed in the Bicep implementation.

## 🔍 Discovery Source

| Query              | Results                       | Timestamp           |
| ------------------ | ----------------------------- | ------------------- |
| Policy Assignments | Legacy - not formally queried | 2024-12-17 (approx) |
| Tag Policies       | Legacy - not formally queried | 2024-12-17 (approx) |

> **Note**: This artifact predates formal Azure Resource Graph discovery requirements.
> Constraints below were documented based on best practices, not live ARG queries.

## 📋 Azure Policy Compliance

| Category       | Constraint                       | Implementation                          |
| -------------- | -------------------------------- | --------------------------------------- |
| Naming         | CAF naming convention            | Use standard prefixes                   |
| Tagging        | Required tags on all resources   | Include Environment, ManagedBy, etc.    |
| Security       | SQL Azure AD-only auth           | Must use Azure AD auth, no SQL auth     |
| Data Residency | Allowed locations: swedencentral | Set location parameter to swedencentral |

## 🔄 Plan Adaptations Based on Policies

No policy-driven plan adaptations required. The static web app architecture complies with all discovered constraints.

## 🚫 Deployment Blockers

No deployment blockers detected. All governance constraints can be satisfied by the planned implementation.

## 🏷️ Required Tags

All resources must include the following tags:

```bicep
tags: {
  Environment: environment  // dev, staging, prod
  Project: projectName      // static-webapp-test
  ManagedBy: 'Bicep'
  Owner: 'DevOps Team'
}
```

## 🔐 Security Policies

| Policy           | Requirement                        |
| ---------------- | ---------------------------------- |
| HTTPS Only       | Required - SWA enforces by default |
| TLS Version      | Minimum TLS 1.2                    |
| Public Access    | Acceptable (no blocking policy)    |
| Managed Identity | Preferred for SQL connectivity     |
| Key Vault        | Not required (no secrets in scope) |

## 💰 Cost Policies

| Policy            | Constraint            |
| ----------------- | --------------------- |
| Budget            | $50/month             |
| SKU Restrictions  | Free/Basic tiers only |
| Reserved Capacity | Not applicable        |

## 🌐 Network Policies

| Policy            | Constraint                      |
| ----------------- | ------------------------------- |
| Private Endpoints | Not required (cost prohibitive) |
| VNet Integration  | Not required                    |
| Public Endpoints  | Allowed for internal tool       |

---

_Governance constraints extracted from requirements and architecture assessment._

---

<div align="center">

_Generated by **Azure Agentic InfraOps** | [GitHub](https://github.com/jonathan-vella/azure-agentic-infraops)_

</div>