tools-only 🏛️ Step 7: Design Document - Static Web Application
- 📝 1. Introduction
- 🏛️ 2. Azure Architecture Overview
- 🌐 3. Networking
- 💾 4. Storage
- 💻 5. Compute
- 👤 6. Identity & Access
- 🔐 7. Security & Compliance
- 🔄 8. Backup & Disaster Recovery
- 📊 9. Management & Monitoring
- 📎 10. Appendix
Generated by @as-built agent | 2025-12-17
| ⬅️ Previous | 📑 Index | Next ➡️ |
|---|---|---|
| 07-compliance-matrix.md | README | 07-documentation-index.md |
Version: 1.0 | Status: Draft | Author: Azure Agentic InfraOps
📝 1. Introduction
1.1 Document Purpose
This document provides a comprehensive design overview of the static-webapp-test infrastructure deployed on Azure. It serves as the technical reference for operations, maintenance, and future enhancements.
1.2 Project Overview
| Attribute | Value |
|---|---|
| Project Name | static-webapp-test |
| Project Type | Static Web Application with Database Backend |
| Business Context | Internal tool for workflow validation testing |
| Environment | Development |
| Timeline | Demo/Test deployment |
1.3 Design Objectives
- Minimize cost while maintaining acceptable reliability
- Simple architecture suitable for internal tools
- Azure AD authentication for secure access
- Infrastructure as Code for repeatability
1.4 Constraints & Assumptions
| Constraint/Assumption | Description |
|---|---|
| Budget | Maximum $50/month |
| User base | 5-10 internal users |
| Data volume | <5 GB total |
| Availability | Non-critical (99.9% SLA acceptable) |
| Compliance | No regulatory requirements (internal tool) |
1.5 Stakeholders
| Role | Team | Responsibility |
|---|---|---|
| Solution Architect | DevOps Team | Design approval |
| Operations | DevOps Team | Day-2 operations |
| Development | Dev Team | Application code |
🏛️ 2. Azure Architecture Overview
2.1 Architecture Diagram
2.2 Subscription & Resource Organization
| Level | Name | Purpose |
|---|---|---|
| Subscription | Development | Non-production workloads |
| Resource Group | rg-static-webapp-test-dev | All project resources |
2.3 Region Selection
| Region | Role | Rationale |
|---|---|---|
| swedencentral | Primary | Sustainable operations, GDPR-compliant, EU |
2.4 Naming Conventions
| Resource Type | Pattern | Example |
|---|---|---|
| Resource Group | rg-{project}-{env} | rg-static-webapp-test-dev |
| Static Web App | stapp-{project}-{env} | stapp-static-webapp-test-dev |
| SQL Server | sql-{shortname}-{env}-{suffix} | sql-staticweba-dev-abc123 |
| SQL Database | sqldb-{project}-{env} | sqldb-static-webapp-test-dev |
| Log Analytics | log-{project}-{env} | log-static-webapp-test-dev |
| App Insights | appi-{project}-{env} | appi-static-webapp-test-dev |
2.5 Tagging Strategy
| Tag | Purpose | Values |
|---|---|---|
| Environment | Deployment stage | dev |
| Project | Workload identifier | static-webapp-test |
| Owner | Responsible team | DevOps Team |
| ManagedBy | IaC tool | Bicep |
🌐 3. Networking
3.1 Network Topology
This is a PaaS-only architecture with no custom virtual network. All services use public endpoints with firewall rules.
3.2 Network Security
| Service | Access Control |
|---|---|
| Static Web App | Public (Azure AD authentication required) |
| SQL Database | Firewall: Allow Azure services only |
3.3 DNS Configuration
| Service | FQDN |
|---|---|
| Static Web App | https://{random}.azurestaticapps.net |
| SQL Server | sql-staticweba-dev-{suffix}.database.windows.net |
💾 4. Storage
4.1 Data Storage
| Data Type | Storage Service | Configuration |
|---|---|---|
| Application Data | Azure SQL | S0 tier, 250 GB max |
| Static Assets | SWA (built-in) | Global CDN |
4.2 Encryption
| Layer | Method |
|---|---|
| At Rest | Azure-managed keys (default) |
| In Transit | TLS 1.2 enforced |
💻 5. Compute
5.1 Compute Resources
| Resource | Type | SKU | Purpose |
|---|---|---|---|
| Static Web App | Static Web Apps | Free | HTML/CSS/JS hosting |
| API Functions | Azure Functions | Free | Backend API (integrated) |
5.2 Scaling Configuration
| Resource | Scaling Mode | Limits |
|---|---|---|
| Static Web App | Automatic | Global CDN distribution |
| SQL Database | Manual | 10 DTU (upgrade if needed) |
5.3 Availability
| Resource | SLA | Zone Redundancy |
|---|---|---|
| Static Web App | 99.95% | Yes (built-in) |
| SQL Database | 99.99% | No (Basic tier) |
👤 6. Identity & Access
6.1 Authentication
| Method | Configuration |
|---|---|
| Identity Provider | Azure Active Directory |
| Authentication Flow | OAuth 2.0 / OIDC |
| MFA | Not required (internal tool) |
6.2 Authorization (RBAC)
| Principal | Role | Scope |
|---|---|---|
| DevOps Team | Contributor | Resource Group |
| SQL Admin (AAD) | SQL DB Contributor | SQL Server |
| Application | Managed Identity | SQL Database |
6.3 Managed Identities
| Resource | Identity Type | Purpose |
|---|---|---|
| Static Web App | System-assigned | SQL Database connection |
🔐 7. Security & Compliance
7.1 Security Baseline
| Control | Status | Notes |
|---|---|---|
| HTTPS enforced | ✅ | SWA default |
| TLS 1.2 minimum | ✅ | All services |
| Azure AD authentication | ✅ | Required for access |
| SQL firewall | ✅ | Azure services only |
| No public SQL access | ✅ | Firewall configured |
7.2 Compliance Requirements
No regulatory compliance required (internal tool).
7.3 Azure Policy
Standard development subscription policies apply.
🔄 8. Backup & Disaster Recovery
8.1 Backup Strategy
| Resource | Method | Retention | RPO |
|---|---|---|---|
| SQL Database | Automated (Azure) | 7 days | 1 hour |
| Static App | GitHub repo (source) | Unlimited | Minutes |
8.2 Recovery Targets
| Metric | Target | Notes |
|---|---|---|
| RTO | 4 hours | Acceptable for non-critical tool |
| RPO | 1 hour | SQL automated backup frequency |
8.3 Failover Strategy
Single region deployment - no automated failover. Recovery via redeployment from IaC + database restore.
📊 9. Management & Monitoring
9.1 Monitoring Strategy
| Component | Tool | Metrics |
|---|---|---|
| Application | Application Insights | Requests, failures, perf |
| Infrastructure | Azure Monitor | Resource health, DTU usage |
| Logs | Log Analytics | All diagnostic logs |
9.2 Alerting
| Alert | Condition | Severity | Action |
|---|---|---|---|
| SQL DTU > 80% | DTU utilization | Warning | Email team |
| App failures > 5% | HTTP 5xx rate | Critical | Email + Slack |
9.3 Diagnostics
All resources configured to send diagnostic logs to Log Analytics workspace.
📎 10. Appendix
10.1 Full Resource Inventory
10.2 Cost Breakdown
| Service | Monthly Cost |
|---|---|
| Static Web App | $0.00 |
| SQL Database S0 | $14.52 |
| Monitoring | $0.20 |
| Total | ~$15/mo |
10.3 References
- Azure Static Web Apps Documentation
- Azure SQL Database Documentation
- Azure Well-Architected Framework
Generated by Azure Agentic InfraOps | GitHub