# 📐 Azure Design Document: malta-catering

![Step](https://img.shields.io/badge/Step-7b-blue?style=for-the-badge)
![Status](https://img.shields.io/badge/Status-Complete-brightgreen?style=for-the-badge)
![Agent](https://img.shields.io/badge/Agent-Docs-purple?style=for-the-badge)

<details open>
<summary><strong>📑 Design Contents</strong></summary>

- [📝 1. Introduction](#-1-introduction)
- [🏛️ 2. Azure Architecture Overview](#-2-azure-architecture-overview)
- [🌐 3. Networking](#-3-networking)
- [💾 4. Storage](#-4-storage)
- [💻 5. Compute](#-5-compute)
- [👤 6. Identity & Access](#-6-identity--access)
- [🔐 7. Security & Compliance](#-7-security--compliance)
- [🔄 8. Backup & Disaster Recovery](#-8-backup--disaster-recovery)
- [📊 9. Management & Monitoring](#-9-management--monitoring)
- [📎 10. Appendix](#-10-appendix)
- [References](#references)

</details>

> Generated by 08-As-Built agent | 2026-04-15

| ⬅️ Previous                                            | 📑 Index            | Next ➡️                                              |
| ------------------------------------------------------ | ------------------- | ---------------------------------------------------- |
| [07-documentation-index.md](07-documentation-index.md) | [README](README.md) | [07-operations-runbook.md](07-operations-runbook.md) |

**Version**: 1.0
**Date**: 2026-04-15
**Author**: Generated by Workload Documentation Generator
**Status**: Complete

---

## 📝 1. Introduction

### 1.1 Document Purpose

This document records the deployed Malta Catering Azure workload as it exists after the successful `azd provision` run on 2026-04-15. It is intended to support operations, audit review, troubleshooting, and future iteration of the workload.

**Intended Audience:**

- Solution Architects
- Operations/SRE Teams
- Security & Compliance Teams
- Development Teams

### 1.2 Project Overview

Malta Catering is a containerized online ordering demo for a Malta-based catering outlet. The deployed workload runs a Linux container on Azure App Service and uses private connectivity to Key Vault, Table Storage, and Azure Container Registry. Monitoring is provided through Application Insights and Log Analytics, and cost governance is enforced with a monthly budget resource.

**Business Objectives:**

- Publish a live online ordering surface for customers and staff.
- Keep customer and order data inside EU-hosted Azure resources.
- Demonstrate an App Service-based alternative to the blocked Container Apps deployment path.

### 1.3 Design Objectives

| Objective    | Target                                      | Implementation                                                         |
| ------------ | ------------------------------------------- | ---------------------------------------------------------------------- |
| Availability | 99.0% service target                        | Single-region App Service plan with staging slot                       |
| Performance  | Low-latency always-on container hosting     | `P0v3` Linux App Service Plan with one dedicated worker                |
| Security     | Private backend access and managed identity | VNet integration, 3 private endpoints, Key Vault RBAC, ACR pull via MI |
| Scalability  | Dev/demo scale with room for growth         | Premium v3 plan supports vertical scaling and additional workers       |

### 1.4 Constraints & Assumptions

**Constraints:**

- The original `S1` plan selection was not deployable in this subscription and region; the deployed plan is `P0v3`.
- The workload remains single-region in `swedencentral`; no warm DR region is deployed.

**Assumptions:**

- Table Storage backup/export remains a future production enhancement rather than part of the current deployment.
- Budgetary and monitoring baselines assume a dev/demo usage profile with low ingestion and low transaction volume.

### 1.5 Stakeholders

| Role               | Team                   | Responsibility                                  |
| ------------------ | ---------------------- | ----------------------------------------------- |
| Platform Owner     | Demo Platform          | Azure subscription, policy, and deployment flow |
| Application Owner  | Malta Catering         | Container image, app behavior, and demo content |
| Operations Contact | `platform@example.com` | Runtime verification and operational follow-up  |

---

## 🏛️ 2. Azure Architecture Overview

### 2.1 Architecture Diagram

The as-built architecture is delivered as editable Draw.io source.

Source: [07-ab-diagram.drawio](./07-ab-diagram.drawio)

### 2.2 Resource Summary

| Category   | Count |
| ---------- | ----- |
| Compute    | 3     |
| Networking | 10    |
| Data       | 1     |
| Security   | 2     |

Additional deployed components include 2 monitoring resources, 1 Event Grid system topic, and 1 management budget object.

---

## 🌐 3. Networking

The production endpoint is public on the default Azure hostname, while all backend platform services are restricted through private endpoints inside the workload VNet.

### 3.1 Virtual Network Summary

| VNet Name                 | Address Space | Region          | Purpose                                                            |
| ------------------------- | ------------- | --------------- | ------------------------------------------------------------------ |
| `vnet-malta-catering-dev` | `10.0.0.0/24` | `swedencentral` | Workload network for App Service integration and private endpoints |

### 3.2 Subnet Allocation

| Subnet                   | Address Range  | Delegated To                | NSG    |
| ------------------------ | -------------- | --------------------------- | ------ |
| `snet-app-service`       | `10.0.0.0/27`  | `Microsoft.Web/serverFarms` | `None` |
| `snet-private-endpoints` | `10.0.0.32/27` | `None`                      | `None` |

### 3.3 DNS & Private Endpoints

| Service                  | Private Endpoint                   | Private DNS Zone                     |
| ------------------------ | ---------------------------------- | ------------------------------------ |
| Azure Key Vault          | `pep-kv-malta-dev-b6lg3l-vault-0`  | `privatelink.vaultcore.azure.net`    |
| Table Storage            | `pep-stmaltadevb6lg3l-table-0`     | `privatelink.table.core.windows.net` |
| Azure Container Registry | `pep-acrmaltadevb6lg3l-registry-0` | `privatelink.azurecr.io`             |

> 📎 Full resource details: [07-resource-inventory.md](07-resource-inventory.md)

---

## 💾 4. Storage

### 4.1 Storage Account Summary

| Account            | Kind        | Replication    | Access Tier | Public Access |
| ------------------ | ----------- | -------------- | ----------- | ------------- |
| `stmaltadevb6lg3l` | `StorageV2` | `Standard_LRS` | `Hot`       | `Disabled`    |

### 4.2 Data Retention

| Data Category | Retention Period | Lifecycle Policy                        |
| ------------- | ---------------- | --------------------------------------- |
| Customer PII  | 90 days target   | Application-managed deletion on request |
| Order records | 1 year target    | Application-managed retention           |
| Menu data     | Indefinite       | Manual application update               |

> 📎 Full resource details: [07-resource-inventory.md](07-resource-inventory.md)

---

## 💻 5. Compute

### 5.1 Compute Resource Summary

| Resource                         | Type                   | SKU      | Instances | Scaling                |
| -------------------------------- | ---------------------- | -------- | --------- | ---------------------- |
| `asp-malta-catering-dev`         | App Service Plan       | `P0v3`   | 1         | Manual scale only      |
| `app-malta-catering-dev`         | Web App for Containers | Included | 1         | Bound to plan capacity |
| `app-malta-catering-dev/staging` | Deployment Slot        | Included | 1         | Bound to plan capacity |

### 5.2 Scaling Configuration

| Resource                 | Min | Max | Scale Trigger                   |
| ------------------------ | --- | --- | ------------------------------- |
| `asp-malta-catering-dev` | 1   | 30  | Manual App Service plan scaling |
| `app-malta-catering-dev` | 1   | 1   | No autoscale configured         |

> 📎 Full resource details: [07-resource-inventory.md](07-resource-inventory.md)

---

## 👤 6. Identity & Access

### 6.1 Managed Identities

| Identity                               | Type            | Assigned To                      | Key Permissions                                                       |
| -------------------------------------- | --------------- | -------------------------------- | --------------------------------------------------------------------- |
| `156a5dbf-66f8-48b0-bf7c-bcd156eb6528` | System-assigned | `app-malta-catering-dev`         | `AcrPull`, `Key Vault Secrets User`, `Storage Table Data Contributor` |
| `d8c9ade8-c8c6-4f01-b300-4cd749a68fff` | System-assigned | `app-malta-catering-dev/staging` | No direct role assignments detected                                   |

### 6.2 RBAC Role Assignments

| Principal                   | Role                             | Scope                 |
| --------------------------- | -------------------------------- | --------------------- |
| Production web app identity | `AcrPull`                        | `acrmaltadevb6lg3l`   |
| Production web app identity | `Key Vault Secrets User`         | `kv-malta-dev-b6lg3l` |
| Production web app identity | `Storage Table Data Contributor` | `stmaltadevb6lg3l`    |
| Staging slot identity       | None assigned                    | Not configured        |

> 📎 Full compliance mapping: [07-compliance-matrix.md](07-compliance-matrix.md)

---

## 🔐 7. Security & Compliance

<details>
<summary><strong>🔒 Security Controls</strong></summary>

| Control           | Implementation                                                                | Evidence                                                               |
| ----------------- | ----------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| TLS 1.2+          | App Service and slot both enforce `minTlsVersion = 1.2`                       | `.asbuilt/webapp.json`, `.asbuilt/webapp-staging.json`                 |
| HTTPS-only        | Production and staging sites both set `httpsOnly = true`                      | `.asbuilt/webapp.json`, `.asbuilt/webapp-staging.json`                 |
| Managed Identity  | System-assigned identity enabled on production and slot                       | `.asbuilt/webapp.json`, `.asbuilt/webapp-staging.json`                 |
| Network isolation | Key Vault, Storage, and ACR use private endpoints with public access disabled | `.asbuilt/keyvault.json`, `.asbuilt/storage.json`, `.asbuilt/acr.json` |

</details>

<details>
<summary><strong>📋 Compliance Mapping</strong></summary>

| Framework | Control ID                            | Status |
| --------- | ------------------------------------- | ------ |
| GDPR      | Data residency in EU region           | ✅     |
| GDPR      | Secrets isolation and least privilege | ⚠️     |
| GDPR      | Customer authentication path          | ⚠️     |

</details>

The deployed workload materially improves the original architecture posture through private backend connectivity, managed identity, disabled shared keys, and Key Vault RBAC. Two important operational gaps remain in the as-built state: App Service Authentication is not enabled, and the staging slot identity currently has no RBAC assignments. ❌ Runtime verification on 2026-04-15 still returned HTTP `503` from both published endpoints.

> 📎 Full compliance mapping: [07-compliance-matrix.md](07-compliance-matrix.md)

---

## 🔄 8. Backup & Disaster Recovery

### 8.1 Recovery Objectives

| Tier         | RTO Target | RPO Target                | Services                                           |
| ------------ | ---------- | ------------------------- | -------------------------------------------------- |
| 🔴 Critical  | 24 hours   | Best-effort               | App Service, Storage, Container image availability |
| 🟠 Important | 24 hours   | 7 days / last known state | Key Vault, monitoring workspace, private DNS       |
| 🟢 Standard  | 48 hours   | Best-effort               | Budgeting, auxiliary diagnostics, documentation    |

### 8.2 Backup Summary

| Service                | Backup Type                     | Retention                      | Geo-Redundant |
| ---------------------- | ------------------------------- | ------------------------------ | ------------- |
| App Service config     | Infrastructure as code redeploy | Source-controlled              | No            |
| Key Vault              | Soft delete + purge protection  | 7 days                         | No            |
| Storage Table data     | None deployed                   | N/A                            | No            |
| ACR container metadata | Retention policy                | 15 days for untagged manifests | No            |

> 📎 Full procedures: [07-backup-dr-plan.md](07-backup-dr-plan.md)

---

## 📊 9. Management & Monitoring

### 9.1 Monitoring Configuration

| Service          | Monitoring Tool                      | Key Metrics                                        |
| ---------------- | ------------------------------------ | -------------------------------------------------- |
| Web App / Slot   | Application Insights + Log Analytics | Requests, failures, container startup, HTTP status |
| App Service Plan | Azure platform metrics               | CPU, memory, worker status                         |
| Budget           | Azure Consumption Budget             | Forecast 80%, forecast 120%, actual 100%           |

### 9.2 Alert Rules

| Alert                           | Severity     | Threshold             | Action                       |
| ------------------------------- | ------------ | --------------------- | ---------------------------- |
| `forecast80`                    | Sev3         | Forecast spend ≥ 80%  | Email `platform@example.com` |
| `forecast120`                   | Sev2         | Forecast spend ≥ 120% | Email `platform@example.com` |
| `actual100`                     | Sev2         | Actual spend ≥ 100%   | Email `platform@example.com` |
| Application availability alerts | Not deployed | N/A                   | Gap recorded in Step 7       |

> 📎 Full operational procedures: [07-operations-runbook.md](07-operations-runbook.md)

---

## 📎 10. Appendix

<details>
<summary>📋 Detailed Resource Configuration</summary>

- Production endpoint: `https://app-malta-catering-dev.azurewebsites.net`
- Staging endpoint: `https://app-malta-catering-dev-staging.azurewebsites.net`
- Container image: `acrmaltadevb6lg3l.azurecr.io/malta-catering-app:latest`
- Application Insights connection string is injected through a Key Vault reference.
- Runtime verification on 2026-04-15 returned `HTTP 503` on both production and staging endpoints.

</details>

<details>
<summary>📚 Reference Architecture Links</summary>

| Architecture           | Link                                                                     |
| ---------------------- | ------------------------------------------------------------------------ |
| App Service networking | https://learn.microsoft.com/azure/app-service/overview-vnet-integration  |
| Private Link for PaaS  | https://learn.microsoft.com/azure/private-link/private-endpoint-overview |

</details>

---

## References

> [!NOTE]
> 📚 The following Microsoft Learn resources provide additional guidance.

| Topic                      | Link                                                                                               |
| -------------------------- | -------------------------------------------------------------------------------------------------- |
| Well-Architected Framework | [Overview](https://learn.microsoft.com/azure/well-architected/)                                    |
| Azure Architecture Center  | [Architectures](https://learn.microsoft.com/azure/architecture/)                                   |
| Security Best Practices    | [Security Baseline](https://learn.microsoft.com/security/benchmark/azure/overview)                 |
| Networking Best Practices  | [Network Security](https://learn.microsoft.com/azure/security/fundamentals/network-best-practices) |
| Backup Best Practices      | [Azure Backup](https://learn.microsoft.com/azure/backup/backup-best-practices)                     |
| Monitoring Overview        | [Azure Monitor](https://learn.microsoft.com/azure/azure-monitor/overview)                          |

---

_Design document generated from infrastructure artifacts._

---

<div align="center">

| ⬅️ [07-documentation-index.md](07-documentation-index.md) | 🏠 [Project Index](README.md) | ➡️ [07-operations-runbook.md](07-operations-runbook.md) |
| --------------------------------------------------------- | ----------------------------- | ------------------------------------------------------- |

</div>
