plan-forge waf.instructions.md

Azure Well-Architected Framework (WAF)

Based on the Microsoft Azure Well-Architected Framework. The WAF is the workload quality layer — it governs individual service design decisions.

The 5 Pillars

Pillar	Core Question
Reliability	Will it stay available when things go wrong?
Security	Is the workload protected end-to-end?
Cost Optimization	Are we paying for what we actually use?
Operational Excellence	Can we deploy, operate, and recover safely?
Performance Efficiency	Does it scale and respond well under load?

---

Reliability

Key Controls

// ✅ Deploy across availability zones — never single-zone in production
resource appServicePlan 'Microsoft.Web/serverfarms@2025-03-01' = {
  sku: { name: 'P1v3', tier: 'PremiumV3', capacity: 2 }
  properties: {
    zoneRedundant: true   // ← required for zone-pinned AZ support
  }
}

// ✅ Health probes on load balancers and App Gateway
// ✅ Auto-scale rules based on CPU + memory, not just time-based
// ✅ Azure backup enabled for databases and storage
// ✅ Soft-delete + point-in-time restore for all databases

Reliability Checklist

• Resources deployed across ≥ 2 availability zones in production
• Auto-scale configured with appropriate min/max and cool-down
• Health checks / probes on every outward-facing service
• Recovery Time Objective (RTO) and Recovery Point Objective (RPO) defined
• Azure Backup enabled for databases and critical storage
• Geo-redundant storage (GRS or RA-GRS) for critical data in production
• Azure Site Recovery evaluated for VM/stateful workloads
• Circuit breaker / retry policies in application code (not just infra)

---

Security

See security.instructions.md for the detailed Azure IaC security patterns.

WAF Security Checklist

• Managed Identity for all service-to-service auth — no static credentials
• Key Vault for all secrets, certificates, and keys
• Private endpoints for all PaaS services in production
• Azure DDoS Protection Standard on public-facing VNets
• Azure Web Application Firewall (WAF) on Application Gateway or Front Door
• Defender for Cloud Standard tier enabled on all subscriptions
• Just-in-time (JIT) VM access enabled
• Azure AD Conditional Access policies configured