1548 04 Governance Constraints D9ed2874

# Governance Constraints - static-webapp-test

> Generated by bicep-plan agent | 2024-12-17

This document captures the governance constraints and Azure Policy requirements
that must be addressed in the Bicep implementation.

## Discovery Source

| Query              | Results                       | Timestamp           |
| ------------------ | ----------------------------- | ------------------- |
| Policy Assignments | Legacy - not formally queried | 2024-12-17 (approx) |
| Tag Policies       | Legacy - not formally queried | 2024-12-17 (approx) |

> **Note**: This artifact predates formal Azure Resource Graph discovery requirements.
> Constraints below were documented based on best practices, not live ARG queries.

## Azure Policy Compliance

| Category       | Constraint                       | Implementation                          |
| -------------- | -------------------------------- | --------------------------------------- |
| Naming         | CAF naming convention            | Use standard prefixes                   |
| Tagging        | Required tags on all resources   | Include Environment, ManagedBy, etc.    |
| Security       | SQL Azure AD-only auth           | Must use Azure AD auth, no SQL auth     |
| Data Residency | Allowed locations: swedencentral | Set location parameter to swedencentral |

## Plan Adaptations Based on Policies

No policy-driven plan adaptations required. The static web app architecture complies with all discovered constraints.

## Deployment Blockers

No deployment blockers detected. All governance constraints can be satisfied by the planned implementation.

## Required Tags

All resources must include the following tags:

```bicep
tags: {
  Environment: environment  // dev, staging, prod
  Project: projectName      // static-webapp-test
  ManagedBy: 'Bicep'
  Owner: 'DevOps Team'
}
```

## Security Policies

| Policy           | Requirement                        |
| ---------------- | ---------------------------------- |
| HTTPS Only       | Required - SWA enforces by default |
| TLS Version      | Minimum TLS 1.2                    |
| Public Access    | Acceptable (no blocking policy)    |
| Managed Identity | Preferred for SQL connectivity     |
| Key Vault        | Not required (no secrets in scope) |

## Cost Policies

| Policy            | Constraint            |
| ----------------- | --------------------- |
| Budget            | $50/month             |
| SKU Restrictions  | Free/Basic tiers only |
| Reserved Capacity | Not applicable        |

## Network Policies

| Policy            | Constraint                      |
| ----------------- | ------------------------------- |
| Private Endpoints | Not required (cost prohibitive) |
| VNet Integration  | Not required                    |
| Public Endpoints  | Allowed for internal tool       |

---

_Governance constraints extracted from requirements and architecture assessment._