# 1524 07 Design Document Ada431cf > Azure Design Document: static-webapp-test - Skill: `tools-only/1524-07-design-document-ada431cf` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add tools-only/1524-07-design-document-ada431cf` - Raw SKILL.md: https://api.skillmd.com/api/skills/tools-only/1524-07-design-document-ada431cf/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tools-only (https://skillmd.com/u/tools-only) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/tools-only/1524-07-design-document-ada431cf --- # Azure Design Document: static-webapp-test **Version**: 1.0 **Date**: December 17, 2025 **Author**: Generated by Workload Documentation Generator **Status**: Draft --- ## 1. Introduction ### 1.1 Document Purpose This document provides a comprehensive design overview of the static-webapp-test infrastructure deployed on Azure. It serves as the technical reference for operations, maintenance, and future enhancements. ### 1.2 Project Overview | Attribute | Value | | -------------------- | --------------------------------------------- | | **Project Name** | static-webapp-test | | **Project Type** | Static Web Application with Database Backend | | **Business Context** | Internal tool for workflow validation testing | | **Environment** | Development | | **Timeline** | Demo/Test deployment | ### 1.3 Design Objectives - Minimize cost while maintaining acceptable reliability - Simple architecture suitable for internal tools - Azure AD authentication for secure access - Infrastructure as Code for repeatability ### 1.4 Constraints & Assumptions | Constraint/Assumption | Description | | --------------------- | ------------------------------------------ | | Budget | Maximum $50/month | | User base | 5-10 internal users | | Data volume | <5 GB total | | Availability | Non-critical (99.9% SLA acceptable) | | Compliance | No regulatory requirements (internal tool) | ### 1.5 Stakeholders | Role | Team | Responsibility | | ------------------ | ----------- | ---------------- | | Solution Architect | DevOps Team | Design approval | | Operations | DevOps Team | Day-2 operations | | Development | Dev Team | Application code | --- ## 2. Azure Architecture Overview ### 2.1 Architecture Diagram ![Architecture Diagram](./07-ab-diagram.png) ### 2.2 Subscription & Resource Organization | Level | Name | Purpose | | -------------- | ------------------------- | ------------------------ | | Subscription | Development | Non-production workloads | | Resource Group | rg-static-webapp-test-dev | All project resources | ### 2.3 Region Selection | Region | Role | Rationale | | ------------- | ------- | ------------------------------------------ | | swedencentral | Primary | Sustainable operations, GDPR-compliant, EU | ### 2.4 Naming Conventions | Resource Type | Pattern | Example | | -------------- | ------------------------------ | ---------------------------- | | Resource Group | rg-{project}-{env} | rg-static-webapp-test-dev | | Static Web App | stapp-{project}-{env} | stapp-static-webapp-test-dev | | SQL Server | sql-{shortname}-{env}-{suffix} | sql-staticweba-dev-abc123 | | SQL Database | sqldb-{project}-{env} | sqldb-static-webapp-test-dev | | Log Analytics | log-{project}-{env} | log-static-webapp-test-dev | | App Insights | appi-{project}-{env} | appi-static-webapp-test-dev | ### 2.5 Tagging Strategy | Tag | Purpose | Values | | ----------- | ------------------- | ------------------ | | Environment | Deployment stage | dev | | Project | Workload identifier | static-webapp-test | | Owner | Responsible team | DevOps Team | | ManagedBy | IaC tool | Bicep | --- ## 3. Networking ### 3.1 Network Topology This is a **PaaS-only architecture** with no custom virtual network. All services use public endpoints with firewall rules. ### 3.2 Network Security | Service | Access Control | | -------------- | ----------------------------------------- | | Static Web App | Public (Azure AD authentication required) | | SQL Database | Firewall: Allow Azure services only | ### 3.3 DNS Configuration | Service | FQDN | | -------------- | ------------------------------------------------ | | Static Web App | https://{random}.azurestaticapps.net | | SQL Server | sql-staticweba-dev-{suffix}.database.windows.net | --- ## 4. Storage ### 4.1 Data Storage | Data Type | Storage Service | Configuration | | ---------------- | --------------- | ------------------- | | Application Data | Azure SQL | S0 tier, 250 GB max | | Static Assets | SWA (built-in) | Global CDN | ### 4.2 Encryption | Layer | Method | | ---------- | ---------------------------- | | At Rest | Azure-managed keys (default) | | In Transit | TLS 1.2 enforced | --- ## 5. Compute ### 5.1 Compute Resources | Resource | Type | SKU | Purpose | | -------------- | --------------- | ---- | ------------------------ | | Static Web App | Static Web Apps | Free | HTML/CSS/JS hosting | | API Functions | Azure Functions | Free | Backend API (integrated) | ### 5.2 Scaling Configuration | Resource | Scaling Mode | Limits | | -------------- | ------------ | -------------------------- | | Static Web App | Automatic | Global CDN distribution | | SQL Database | Manual | 10 DTU (upgrade if needed) | ### 5.3 Availability | Resource | SLA | Zone Redundancy | | -------------- | ------ | --------------- | | Static Web App | 99.95% | Yes (built-in) | | SQL Database | 99.99% | No (Basic tier) | --- ## 6. Identity & Access ### 6.1 Authentication | Method | Configuration | | ------------------- | ---------------------------- | | Identity Provider | Azure Active Directory | | Authentication Flow | OAuth 2.0 / OIDC | | MFA | Not required (internal tool) | ### 6.2 Authorization (RBAC) | Principal | Role | Scope | | --------------- | ------------------ | -------------- | | DevOps Team | Contributor | Resource Group | | SQL Admin (AAD) | SQL DB Contributor | SQL Server | | Application | Managed Identity | SQL Database | ### 6.3 Managed Identities | Resource | Identity Type | Purpose | | -------------- | --------------- | ----------------------- | | Static Web App | System-assigned | SQL Database connection | --- ## 7. Security & Compliance ### 7.1 Security Baseline | Control | Status | Notes | | ----------------------- | ------ | ------------------- | | HTTPS enforced | ✅ | SWA default | | TLS 1.2 minimum | ✅ | All services | | Azure AD authentication | ✅ | Required for access | | SQL firewall | ✅ | Azure services only | | No public SQL access | ✅ | Firewall configured | ### 7.2 Compliance Requirements No regulatory compliance required (internal tool). ### 7.3 Azure Policy Standard development subscription policies apply. --- ## 8. Backup & Disaster Recovery ### 8.1 Backup Strategy | Resource | Method | Retention | RPO | | ------------ | -------------------- | --------- | ------- | | SQL Database | Automated (Azure) | 7 days | 1 hour | | Static App | GitHub repo (source) | Unlimited | Minutes | ### 8.2 Recovery Targets | Metric | Target | Notes | | ------ | ------- | -------------------------------- | | RTO | 4 hours | Acceptable for non-critical tool | | RPO | 1 hour | SQL automated backup frequency | ### 8.3 Failover Strategy Single region deployment - no automated failover. Recovery via redeployment from IaC + database restore. --- ## 9. Management & Monitoring ### 9.1 Monitoring Strategy | Component | Tool | Metrics | | -------------- | -------------------- | -------------------------- | | Application | Application Insights | Requests, failures, perf | | Infrastructure | Azure Monitor | Resource health, DTU usage | | Logs | Log Analytics | All diagnostic logs | ### 9.2 Alerting | Alert | Condition | Severity | Action | | ----------------- | --------------- | -------- | ------------- | | SQL DTU > 80% | DTU utilization | Warning | Email team | | App failures > 5% | HTTP 5xx rate | Critical | Email + Slack | ### 9.3 Diagnostics All resources configured to send diagnostic logs to Log Analytics workspace. --- ## 10. Appendix ### 10.1 Full Resource Inventory See [07-resource-inventory.md](./07-resource-inventory.md) ### 10.2 Cost Breakdown See [03-des-cost-estimate.md](./03-des-cost-estimate.md) | Service | Monthly Cost | | --------------- | ------------ | | Static Web App | $0.00 | | SQL Database S0 | $14.52 | | Monitoring | $0.20 | | **Total** | **~$15/mo** | ### 10.3 References - [Azure Static Web Apps Documentation](https://learn.microsoft.com/azure/static-web-apps/) - [Azure SQL Database Documentation](https://learn.microsoft.com/azure/azure-sql/) - [Azure Well-Architected Framework](https://learn.microsoft.com/azure/well-architected/)