# Step 7: Design Document - Static Web Application
> This document provides a comprehensive design overview of the static-webapp-test infrastructure deployed on Azure. It serves as the technical reference for operations, maintenance, and future enhancements.
- Skill: `tools-only/step-7-design-document-static-web-application` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add tools-only/step-7-design-document-static-web-application`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tools-only/step-7-design-document-static-web-application/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tools-only (https://skillmd.com/u/tools-only)
- Updated: 2026-09-29
- Page: https://skillmd.com/skills/tools-only/step-7-design-document-static-web-application
---
# 🏛️ Step 7: Design Document - Static Web Application
📑 As-Built Documentation
- [📝 1. Introduction](#-1-introduction)
- [🏛️ 2. Azure Architecture Overview](#️-2-azure-architecture-overview)
- [🌐 3. Networking](#-3-networking)
- [💾 4. Storage](#-4-storage)
- [💻 5. Compute](#-5-compute)
- [👤 6. Identity & Access](#-6-identity--access)
- [🔐 7. Security & Compliance](#-7-security--compliance)
- [🔄 8. Backup & Disaster Recovery](#-8-backup--disaster-recovery)
- [📊 9. Management & Monitoring](#-9-management--monitoring)
- [📎 10. Appendix](#-10-appendix)
> Generated by @as-built agent | 2025-12-17
| ⬅️ Previous | 📑 Index | Next ➡️ |
| -------------------------------------------------- | ------------------- | ------------------------------------------------------ |
| [07-compliance-matrix.md](07-compliance-matrix.md) | [README](README.md) | [07-documentation-index.md](07-documentation-index.md) |
**Version**: 1.0 | **Status**: Draft | **Author**: Azure Agentic InfraOps
---
## 📝 1. Introduction
### 1.1 Document Purpose
This document provides a comprehensive design overview of the static-webapp-test infrastructure deployed on Azure.
It serves as the technical reference for operations, maintenance, and future enhancements.
### 1.2 Project Overview
| Attribute | Value |
| -------------------- | --------------------------------------------- |
| **Project Name** | static-webapp-test |
| **Project Type** | Static Web Application with Database Backend |
| **Business Context** | Internal tool for workflow validation testing |
| **Environment** | Development |
| **Timeline** | Demo/Test deployment |
### 1.3 Design Objectives
- Minimize cost while maintaining acceptable reliability
- Simple architecture suitable for internal tools
- Azure AD authentication for secure access
- Infrastructure as Code for repeatability
### 1.4 Constraints & Assumptions
| Constraint/Assumption | Description |
| --------------------- | ------------------------------------------ |
| Budget | Maximum $50/month |
| User base | 5-10 internal users |
| Data volume | <5 GB total |
| Availability | Non-critical (99.9% SLA acceptable) |
| Compliance | No regulatory requirements (internal tool) |
### 1.5 Stakeholders
| Role | Team | Responsibility |
| ------------------ | ----------- | ---------------- |
| Solution Architect | DevOps Team | Design approval |
| Operations | DevOps Team | Day-2 operations |
| Development | Dev Team | Application code |
---
## 🏛️ 2. Azure Architecture Overview
### 2.1 Architecture Diagram
### 2.2 Subscription & Resource Organization
| Level | Name | Purpose |
| -------------- | ------------------------- | ------------------------ |
| Subscription | Development | Non-production workloads |
| Resource Group | rg-static-webapp-test-dev | All project resources |
### 2.3 Region Selection
| Region | Role | Rationale |
| ------------- | ------- | ------------------------------------------ |
| swedencentral | Primary | Sustainable operations, GDPR-compliant, EU |
### 2.4 Naming Conventions
| Resource Type | Pattern | Example |
| -------------- | ------------------------------ | ---------------------------- |
| Resource Group | rg-{project}-{env} | rg-static-webapp-test-dev |
| Static Web App | stapp-{project}-{env} | stapp-static-webapp-test-dev |
| SQL Server | sql-{shortname}-{env}-{suffix} | sql-staticweba-dev-abc123 |
| SQL Database | sqldb-{project}-{env} | sqldb-static-webapp-test-dev |
| Log Analytics | log-{project}-{env} | log-static-webapp-test-dev |
| App Insights | appi-{project}-{env} | appi-static-webapp-test-dev |
### 2.5 Tagging Strategy
| Tag | Purpose | Values |
| ----------- | ------------------- | ------------------ |
| Environment | Deployment stage | dev |
| Project | Workload identifier | static-webapp-test |
| Owner | Responsible team | DevOps Team |
| ManagedBy | IaC tool | Bicep |
---
## 🌐 3. Networking
### 3.1 Network Topology
This is a **PaaS-only architecture** with no custom virtual network.
All services use public endpoints with firewall rules.
### 3.2 Network Security
| Service | Access Control |
| -------------- | ----------------------------------------- |
| Static Web App | Public (Azure AD authentication required) |
| SQL Database | Firewall: Allow Azure services only |
### 3.3 DNS Configuration
| Service | FQDN |
| -------------- | ------------------------------------------------ |
| Static Web App | https://{random}.azurestaticapps.net |
| SQL Server | sql-staticweba-dev-{suffix}.database.windows.net |
---
## 💾 4. Storage
### 4.1 Data Storage
| Data Type | Storage Service | Configuration |
| ---------------- | --------------- | ------------------- |
| Application Data | Azure SQL | S0 tier, 250 GB max |
| Static Assets | SWA (built-in) | Global CDN |
### 4.2 Encryption
| Layer | Method |
| ---------- | ---------------------------- |
| At Rest | Azure-managed keys (default) |
| In Transit | TLS 1.2 enforced |
---
## 💻 5. Compute
### 5.1 Compute Resources
| Resource | Type | SKU | Purpose |
| -------------- | --------------- | ---- | ------------------------ |
| Static Web App | Static Web Apps | Free | HTML/CSS/JS hosting |
| API Functions | Azure Functions | Free | Backend API (integrated) |
### 5.2 Scaling Configuration
| Resource | Scaling Mode | Limits |
| -------------- | ------------ | -------------------------- |
| Static Web App | Automatic | Global CDN distribution |
| SQL Database | Manual | 10 DTU (upgrade if needed) |
### 5.3 Availability
| Resource | SLA | Zone Redundancy |
| -------------- | ------ | --------------- |
| Static Web App | 99.95% | Yes (built-in) |
| SQL Database | 99.99% | No (Basic tier) |
---
## 👤 6. Identity & Access
### 6.1 Authentication
| Method | Configuration |
| ------------------- | ---------------------------- |
| Identity Provider | Azure Active Directory |
| Authentication Flow | OAuth 2.0 / OIDC |
| MFA | Not required (internal tool) |
### 6.2 Authorization (RBAC)
| Principal | Role | Scope |
| --------------- | ------------------ | -------------- |
| DevOps Team | Contributor | Resource Group |
| SQL Admin (AAD) | SQL DB Contributor | SQL Server |
| Application | Managed Identity | SQL Database |
### 6.3 Managed Identities
| Resource | Identity Type | Purpose |
| -------------- | --------------- | ----------------------- |
| Static Web App | System-assigned | SQL Database connection |
---
## 🔐 7. Security & Compliance
### 7.1 Security Baseline
| Control | Status | Notes |
| ----------------------- | ------ | ------------------- |
| HTTPS enforced | ✅ | SWA default |
| TLS 1.2 minimum | ✅ | All services |
| Azure AD authentication | ✅ | Required for access |
| SQL firewall | ✅ | Azure services only |
| No public SQL access | ✅ | Firewall configured |
### 7.2 Compliance Requirements
No regulatory compliance required (internal tool).
### 7.3 Azure Policy
Standard development subscription policies apply.
---
## 🔄 8. Backup & Disaster Recovery
### 8.1 Backup Strategy
| Resource | Method | Retention | RPO |
| ------------ | -------------------- | --------- | ------- |
| SQL Database | Automated (Azure) | 7 days | 1 hour |
| Static App | GitHub repo (source) | Unlimited | Minutes |
### 8.2 Recovery Targets
| Metric | Target | Notes |
| ------ | ------- | -------------------------------- |
| RTO | 4 hours | Acceptable for non-critical tool |
| RPO | 1 hour | SQL automated backup frequency |
### 8.3 Failover Strategy
Single region deployment - no automated failover.
Recovery via redeployment from IaC + database restore.
---
## 📊 9. Management & Monitoring
### 9.1 Monitoring Strategy
| Component | Tool | Metrics |
| -------------- | -------------------- | -------------------------- |
| Application | Application Insights | Requests, failures, perf |
| Infrastructure | Azure Monitor | Resource health, DTU usage |
| Logs | Log Analytics | All diagnostic logs |
### 9.2 Alerting
| Alert | Condition | Severity | Action |
| ----------------- | --------------- | -------- | ------------- |
| SQL DTU > 80% | DTU utilization | Warning | Email team |
| App failures > 5% | HTTP 5xx rate | Critical | Email + Slack |
### 9.3 Diagnostics
All resources configured to send diagnostic logs to Log Analytics workspace.
---
## 📎 10. Appendix
### 10.1 Full Resource Inventory
See [07-resource-inventory.md](./07-resource-inventory.md)
### 10.2 Cost Breakdown
See [03-des-cost-estimate.md](./03-des-cost-estimate.md)
| Service | Monthly Cost |
| --------------- | ------------ |
| Static Web App | $0.00 |
| SQL Database S0 | $14.52 |
| Monitoring | $0.20 |
| **Total** | **~$15/mo** |
### 10.3 References
- [Azure Static Web Apps Documentation](https://learn.microsoft.com/azure/static-web-apps/)
- [Azure SQL Database Documentation](https://learn.microsoft.com/azure/azure-sql/)
- [Azure Well-Architected Framework](https://learn.microsoft.com/azure/well-architected/)
---
_Generated by **Azure Agentic InfraOps** | [GitHub](https://github.com/jonathan-vella/azure-agentic-infraops)_