Azure Design Document: static-webapp-test
Version: 1.0
Date: December 17, 2025
Author: Generated by Workload Documentation Generator
Status: Draft
1. Introduction
1.1 Document Purpose
This document provides a comprehensive design overview of the static-webapp-test infrastructure deployed on Azure.
It serves as the technical reference for operations, maintenance, and future enhancements.
1.2 Project Overview
| Attribute |
Value |
| Project Name |
static-webapp-test |
| Project Type |
Static Web Application with Database Backend |
| Business Context |
Internal tool for workflow validation testing |
| Environment |
Development |
| Timeline |
Demo/Test deployment |
1.3 Design Objectives
- Minimize cost while maintaining acceptable reliability
- Simple architecture suitable for internal tools
- Azure AD authentication for secure access
- Infrastructure as Code for repeatability
1.4 Constraints & Assumptions
| Constraint/Assumption |
Description |
| Budget |
Maximum $50/month |
| User base |
5-10 internal users |
| Data volume |
<5 GB total |
| Availability |
Non-critical (99.9% SLA acceptable) |
| Compliance |
No regulatory requirements (internal tool) |
1.5 Stakeholders
| Role |
Team |
Responsibility |
| Solution Architect |
DevOps Team |
Design approval |
| Operations |
DevOps Team |
Day-2 operations |
| Development |
Dev Team |
Application code |
2. Azure Architecture Overview
2.1 Architecture Diagram
2.2 Subscription & Resource Organization
| Level |
Name |
Purpose |
| Subscription |
Development |
Non-production workloads |
| Resource Group |
rg-static-webapp-test-dev |
All project resources |
2.3 Region Selection
| Region |
Role |
Rationale |
| swedencentral |
Primary |
Sustainable operations, GDPR-compliant, EU |
2.4 Naming Conventions
| Resource Type |
Pattern |
Example |
| Resource Group |
rg-{project}-{env} |
rg-static-webapp-test-dev |
| Static Web App |
stapp-{project}-{env} |
stapp-static-webapp-test-dev |
| SQL Server |
sql-{shortname}-{env}-{suffix} |
sql-staticweba-dev-abc123 |
| SQL Database |
sqldb-{project}-{env} |
sqldb-static-webapp-test-dev |
| Log Analytics |
log-{project}-{env} |
log-static-webapp-test-dev |
| App Insights |
appi-{project}-{env} |
appi-static-webapp-test-dev |
2.5 Tagging Strategy
| Tag |
Purpose |
Values |
| Environment |
Deployment stage |
dev |
| Project |
Workload identifier |
static-webapp-test |
| Owner |
Responsible team |
DevOps Team |
| ManagedBy |
IaC tool |
Bicep |
3. Networking
3.1 Network Topology
This is a PaaS-only architecture with no custom virtual network.
All services use public endpoints with firewall rules.
3.2 Network Security
| Service |
Access Control |
| Static Web App |
Public (Azure AD authentication required) |
| SQL Database |
Firewall: Allow Azure services only |
3.3 DNS Configuration
| Service |
FQDN |
| Static Web App |
https://{random}.azurestaticapps.net |
| SQL Server |
sql-staticweba-dev-{suffix}.database.windows.net |
4. Storage
4.1 Data Storage
| Data Type |
Storage Service |
Configuration |
| Application Data |
Azure SQL |
S0 tier, 250 GB max |
| Static Assets |
SWA (built-in) |
Global CDN |
4.2 Encryption
| Layer |
Method |
| At Rest |
Azure-managed keys (default) |
| In Transit |
TLS 1.2 enforced |
5. Compute
5.1 Compute Resources
| Resource |
Type |
SKU |
Purpose |
| Static Web App |
Static Web Apps |
Free |
HTML/CSS/JS hosting |
| API Functions |
Azure Functions |
Free |
Backend API (integrated) |
5.2 Scaling Configuration
| Resource |
Scaling Mode |
Limits |
| Static Web App |
Automatic |
Global CDN distribution |
| SQL Database |
Manual |
10 DTU (upgrade if needed) |
5.3 Availability
| Resource |
SLA |
Zone Redundancy |
| Static Web App |
99.95% |
Yes (built-in) |
| SQL Database |
99.99% |
No (Basic tier) |
6. Identity & Access
6.1 Authentication
| Method |
Configuration |
| Identity Provider |
Azure Active Directory |
| Authentication Flow |
OAuth 2.0 / OIDC |
| MFA |
Not required (internal tool) |
6.2 Authorization (RBAC)
| Principal |
Role |
Scope |
| DevOps Team |
Contributor |
Resource Group |
| SQL Admin (AAD) |
SQL DB Contributor |
SQL Server |
| Application |
Managed Identity |
SQL Database |
6.3 Managed Identities
| Resource |
Identity Type |
Purpose |
| Static Web App |
System-assigned |
SQL Database connection |
7. Security & Compliance
7.1 Security Baseline
| Control |
Status |
Notes |
| HTTPS enforced |
✅ |
SWA default |
| TLS 1.2 minimum |
✅ |
All services |
| Azure AD authentication |
✅ |
Required for access |
| SQL firewall |
✅ |
Azure services only |
| No public SQL access |
✅ |
Firewall configured |
7.2 Compliance Requirements
No regulatory compliance required (internal tool).
7.3 Azure Policy
Standard development subscription policies apply.
8. Backup & Disaster Recovery
8.1 Backup Strategy
| Resource |
Method |
Retention |
RPO |
| SQL Database |
Automated (Azure) |
7 days |
1 hour |
| Static App |
GitHub repo (source) |
Unlimited |
Minutes |
8.2 Recovery Targets
| Metric |
Target |
Notes |
| RTO |
4 hours |
Acceptable for non-critical tool |
| RPO |
1 hour |
SQL automated backup frequency |
8.3 Failover Strategy
Single region deployment - no automated failover.
Recovery via redeployment from IaC + database restore.
9. Management & Monitoring
9.1 Monitoring Strategy
| Component |
Tool |
Metrics |
| Application |
Application Insights |
Requests, failures, perf |
| Infrastructure |
Azure Monitor |
Resource health, DTU usage |
| Logs |
Log Analytics |
All diagnostic logs |
9.2 Alerting
| Alert |
Condition |
Severity |
Action |
| SQL DTU > 80% |
DTU utilization |
Warning |
Email team |
| App failures > 5% |
HTTP 5xx rate |
Critical |
Email + Slack |
9.3 Diagnostics
All resources configured to send diagnostic logs to Log Analytics workspace.
10. Appendix
10.1 Full Resource Inventory
See 07-resource-inventory.md
10.2 Cost Breakdown
See 03-des-cost-estimate.md
| Service |
Monthly Cost |
| Static Web App |
$0.00 |
| SQL Database S0 |
$14.52 |
| Monitoring |
$0.20 |
| Total |
~$15/mo |
10.3 References
tools-only