# Techtide Azure Waf Reliability Review

> Review Azure workload reliability against the Well-Architected Framework Reliability pillar: availability targets, AZ/region topology, health monitoring, data resilience, deployment safety, and chaos testing.

- Skill: `techtideohio/techtide-azure-waf-reliability-review` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add techtideohio/techtide-azure-waf-reliability-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/techtideohio/techtide-azure-waf-reliability-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: TechTideOhio (https://skillmd.com/u/techtideohio)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/techtideohio/techtide-azure-waf-reliability-review

---


# Azure WAF Reliability Review

The Azure Well-Architected Framework Reliability pillar covers designing, building, and operating workloads that are resilient to failures, meet availability targets, and recover gracefully from disruptions.

## 5 Reliability Design Principles

1. **Design for business requirements** - translate business requirements into measurable reliability targets; define RTO, RPO, availability SLOs
2. **Design for resilience** - ensure the workload survives fault conditions without complete outage; design for partial failure
3. **Design for recovery** - assume failures will happen; implement automated recovery; test recovery procedures regularly
4. **Design for operations** - build operations into the design; implement health modeling; use automated deployments
5. **Keep it simple** - avoid design complexity that introduces reliability risks; use managed services to reduce operational burden

## Azure Reliability Service Areas

### Availability Zones
- Zone-redundant services: ZRS Storage, Zone-redundant Azure SQL, AKS across zones
- Zonal deployments: pin to specific zone for latency-sensitive workloads
- Regional services: single-zone, not HA - use only for non-critical or dev/test workloads

### Fault Tolerance
- Azure Load Balancer (L4) - regional traffic distribution
- Azure Application Gateway (L7) - zone-redundant HTTP/S load balancing with WAF
- Azure Traffic Manager (DNS) - cross-region failover and weighted routing
- Azure Front Door - global anycast with automatic failover

### Scalability
- VMSS (Virtual Machine Scale Sets) - VM-based horizontal scaling
- Azure Kubernetes Service (KEDA, HPA) - pod and node autoscaling
- Azure App Service autoscale - rule-based and metric-based scaling
- Azure Functions consumption plan - event-driven serverless scaling

### Data Resilience
- Azure SQL Business Critical - 2 readable secondaries, zone-redundant by default
- Cosmos DB - multi-region writes, configurable consistency (strong/bounded-staleness)
- Azure Storage GRS/GZRS - geo-redundant and geo-zone-redundant replication
- Azure Backup - VM, SQL, and file share backup with retention policies
- Azure Site Recovery (ASR) - VM replication and orchestrated failover

### Health Modeling
- Azure Monitor - metrics, logs, and alerting platform
- Application Insights - distributed tracing, availability tests, failure analysis
- Azure Service Health alerts - planned maintenance, outage notifications, advisories
- Resource Health API - per-resource health signal for automated remediation

### Chaos Engineering
- Azure Chaos Studio - inject faults: VM availability zone failure, AKS pod failure, network latency, dependency unavailability

### Deployment Safety
- App Service deployment slots - blue/green with slot swap and auto-swap
- Azure Deployment Environments - consistent, governed environment templates
- Traffic Manager weighted routing - canary deployment with percentage-based traffic split

## Azure SLA Key Facts

- Availability Zones: **99.99%** SLA for VMs when using ≥2 VMs across ≥2 AZs
- Azure SQL Business Critical + zones: **99.995%**
- Cosmos DB multi-region writes: **99.999%**
- Single VM with Premium SSD: **99.9%** - NOT suitable for production HA
- Traffic Manager: **99.99%**

## Assessment Questions

- What are the availability and reliability targets for the workload?
- How do you ensure the workload can operate during a zone or region outage?
- How do you implement health monitoring and proactive alerting?
- How do you manage dependencies and limit blast radius of failures?
- How do you test resilience and validate recovery procedures?
- How do you design for graceful degradation under load or partial failure?
- How do you implement safe deployment practices to minimize rollback risk?

## Validation Checklist

- [ ] SLOs defined with measurable SLIs monitored via Azure Monitor
- [ ] All stateful services (VMs, databases) deployed across ≥2 Availability Zones
- [ ] Azure Service Health alerts configured for all services in use
- [ ] Autoscaling enabled for stateless compute (VMSS, App Service, AKS node pools)
- [ ] Azure SQL or Cosmos DB multi-region replication configured for mission-critical data
- [ ] Azure Backup or ASR configured for VMs, SQL databases, and critical storage
- [ ] Deployment slots or Traffic Manager canary routing used for production deployments
- [ ] Azure Chaos Studio experiments conducted to validate AZ failure recovery
- [ ] Circuit breaker and retry patterns implemented for external service calls
- [ ] RTO/RPO targets documented and validated via DR drill in the last 12 months

## Response Shape

Availability targets review → AZ/region topology → health monitoring → failure tolerance → data resilience → deployment safety → chaos testing status → recommendations → open risks

## Official Documentation

- https://learn.microsoft.com/azure/well-architected/reliability/
- https://learn.microsoft.com/azure/reliability/availability-zones-overview

## Security Notes

Read-only advisory. Do not modify autoscaling policies, backup schedules, or Azure Site Recovery configurations without explicit approval.