2671 03 Des Adr 0001 Cost Optimized N Tier Azure Architecture Df4774b6

# ADR-0001: Cost-Optimized N-Tier Azure Architecture for Dev Environment

![Step](https://img.shields.io/badge/Step-3-blue?style=for-the-badge)
![Status](https://img.shields.io/badge/Status-Accepted-success?style=for-the-badge)
![Type](https://img.shields.io/badge/Type-ADR-purple?style=for-the-badge)

> Generated by design agent | 2026-02-26

<details open>
<summary><strong>📑 Decision Contents</strong></summary>

- [🔍 Context](#-context)
- [✅ Decision](#-decision)
- [🔄 Alternatives Considered](#-alternatives-considered)
- [⚖️ Consequences](#%EF%B8%8F-consequences)
- [🏛️ WAF Pillar Analysis](#%EF%B8%8F-waf-pillar-analysis)
- [🔒 Compliance Considerations](#-compliance-considerations)
- [📝 Implementation Notes](#-implementation-notes)

</details>

> Status: Accepted
> Date: 2026-02-26
> Deciders: Project Owner, Architect Agent

## 🔍 Context

The project requires a very small ecommerce storefront on Azure with Terraform IaC, low initial traffic (<100 users), and strong cost discipline. The target monthly envelope is well below the soft budget ceiling while preserving baseline security and operability.

## ✅ Decision

Adopt a cost-optimized n-tier architecture:

- Frontend: Azure Static Web App (Free) in `westeurope`
- API: Azure App Service Plan B1 (Linux) in `swedencentral`
- Data: Azure SQL Database Basic (5 DTU) in `swedencentral`
- Security/Ops: Key Vault, Application Insights, Log Analytics
- Identity: Microsoft Entra External ID
- IaC: Terraform (`azurerm ~> 4.0`) with remote state in Azure Blob Storage

## 🔄 Alternatives Considered

| Option | Pros | Cons | WAF Impact |
| ------ | ---- | ---- | ---------- |
| Higher baseline SKUs (S1/S0) from day one | Better headroom, autoscale readiness | Higher recurring cost at low traffic | Reliability +, Cost - |
| Container Apps + SQL serverless | Flexible scaling | More complexity for initial MVP | Performance +, Ops - |
| VM-based 3-tier stack | Full control | High ops overhead, overkill for MVP | Ops -, Cost - |

## ⚖️ Consequences

### Positive

- Keeps expected spend low while supporting core storefront capabilities
- Uses managed PaaS services to reduce platform maintenance burden
- Preserves a clear upgrade path for reliability/security hardening

### Negative

- Single-region and non-AZ posture in dev introduces higher outage risk
- Basic tiers limit burst capacity and advanced enterprise controls
- Some GDPR controls remain application-layer responsibilities

### Neutral

- Architecture is intentionally biased for MVP economics over resiliency
- Governance-policy validation is deferred to implementation planning phase

## 🏛️ WAF Pillar Analysis

| Pillar | Impact | Notes |
| ------ | ------ | ----- |
| Security | Mixed | Baseline controls in place; advanced network isolation deferred |
| Reliability | Negative | Single region and no AZ in dev |
| Performance | Positive | Suitable for low-concurrency workload |
| Cost Optimization | Strong Positive | Lowest viable SKUs selected |
| Operational Excellence | Mixed | IaC + monitoring present; CI/CD and runbooks still pending |

## 🔒 Compliance Considerations

- GDPR controls are mapped in architecture assessment with clear infra vs app-layer ownership.
- Data residency remains in EU regions (`swedencentral`, `westeurope`).
- Breach notification flow is supported via Azure Monitor alerting pipeline.

## 📝 Implementation Notes

- Keep this decision for dev and pre-production stages.
- Trigger review when concurrency exceeds thresholds or availability SLO is raised.
- Capture policy outcomes in Step 4 governance constraints artifact.