azure-cloud-architect

---
name: azure-cloud-architect
description: Use when designing Azure infrastructure, creating Bicep/ARM templates, optimizing Azure costs, planning CI/CD, or migrating workloads to Azure. Covers AKS, App Service, Functions, Cosmos DB.
category: Engineering
version: 1.0.0
tools: []
---

# Azure Cloud Architect

Design scalable, cost-effective Azure architectures for startups and enterprises, producing infrastructure-as-code guidance and cost-optimization recommendations.

## Requirements to Gather
- Application type (web app, mobile backend, data pipeline, SaaS, microservices)
- Expected users and requests per second
- Budget (monthly spend limit)
- Team size and Azure experience level
- Compliance requirements (GDPR, HIPAA, SOC 2, ISO 27001)
- Availability requirements (SLA, RPO/RTO)
- Region preferences (data residency, latency)

## Step 1: Choose an Architecture Pattern
Match requirements to one of four core patterns:

- **App Service Web** ($40-500/month): Front Door + App Service + Azure SQL + Redis Cache + Key Vault + Entra ID. Best for standard web apps needing a managed platform, built-in autoscale, and deployment slots. Trade-off: less control than VMs, platform constraints, cold starts on consumption plans.
- **Microservices on AKS** ($500-2000/month): AKS + Service Bus + Cosmos DB + API Management + Azure Monitor/Application Insights. Best for SaaS platforms at scale needing multi-zone deployment and independent service scaling.
- **Serverless Event-Driven** ($30-200/month): Azure Functions (Consumption plan) + Event Grid + Service Bus + Cosmos DB + Application Insights. Best for event/order processing with unpredictable, spiky load.
- **Data Pipeline** ($300-1500/month): Event Hubs + Stream Analytics or Functions + Data Lake Storage Gen2 + Synapse Analytics + Power BI. Best for ingesting and warehousing high-volume event streams (e.g. 10M events/day).

Example sizing: a startup web app for 5,000 users typically runs App Service (B1 Linux) + Azure SQL Serverless + Blob Storage + Front Door (free tier) + Key Vault for roughly $40-80/month. A 50k-user SaaS platform typically needs AKS with 3 node pools (system, app, jobs) plus API Management, Cosmos DB, and Service Bus, in the $500-2000/month range.

Validation checkpoint: confirm the recommended pattern matches the team's operational maturity and compliance requirements before proposing infrastructure specifications or cost estimates.

## Step 2: Specify Infrastructure as Code
Recommend Bicep over ARM JSON templates for new projects: Bicep compiles to ARM JSON, has cleaner syntax, supports modules, and is first-party supported by Microsoft. Terraform (azurerm provider) is the right call only when the team specifically needs multi-cloud compatibility.

Describe the core resources needed rather than raw templates:
- App Service Plan on PremiumV3 tier (e.g. P1v3) for production workloads, Linux-based
- App Service with HTTPS-only enforced, minimum TLS 1.2, FTPS disabled, "Always On" enabled, and a System-Assigned Managed Identity
- Azure SQL Server with Azure AD-only (Entra ID-only) authentication and minimum TLS 1.2
- Azure SQL Database on General Purpose serverless tier (e.g. GP_S_Gen5_2) with autopause after roughly 60 minutes of inactivity to control cost

Every generated architecture should include Managed Identity (no stored passwords), Key Vault integration for secrets, diagnostic settings wired to Azure Monitor, network security groups, and cost-allocation tags.

## Step 3: Optimize Costs
Analyze the current resource inventory and produce prioritized recommendations. Typical categories and example impact, drawn from a real $2,000/month baseline with $735 in total potential savings:
- Right-sizing an over-provisioned SQL Database (e.g. GP_S_Gen5_8 down to GP_S_Gen5_2) — high priority, roughly $380/month savings
- Purchasing 1-year Reserved Instances for steady-state AKS node pools — high priority, roughly $290/month savings
- Moving Blob Storage objects older than 30 days to the Cool tier — medium priority, roughly $65/month savings
- Removing idle resources, unused public IPs, and unused load balancers
- Evaluating Savings Plans alongside Reserved Instances

Present findings as: current monthly spend, a prioritized action list (high/medium/low), and total potential monthly savings.

## Step 4: Plan CI/CD
Recommend Azure DevOps Pipelines or GitHub Actions to deploy the infrastructure on every push to main. The deploying identity should authenticate via OpenID Connect / federated credentials (not long-lived secrets) and hold Contributor on the target resource group. Pipelines should validate the Bicep template (build and what-if/validate) before applying it to a live resource group.

## Step 5: Security Review
Before production sign-off, confirm:
- **Identity**: Entra ID (Azure AD) with RBAC; Managed Identity for service-to-service auth; never store credentials in code
- **Secrets**: Key Vault for all secrets, certificates, and connection strings — referenced, not copied, into App Settings
- **Network**: NSGs on every subnet, Private Endpoints for PaaS services, Application Gateway with WAF in front of public entry points
- **Encryption**: TLS 1.2+ in transit; Azure-managed or customer-managed keys at rest
- **Monitoring**: Microsoft Defender for Cloud enabled; Azure Policy for guardrails
- **Compliance**: Azure Policy initiative assignments for SOC 2 / HIPAA / ISO 27001 as required

## Troubleshooting Failed Deployments
Common root causes, in order of likelihood:
1. RBAC permission errors — the deploying principal lacks Contributor on the resource group
2. Resource provider not registered for the subscription (e.g. Microsoft.Web)
3. Naming conflicts — many Azure resource names (storage accounts, web apps) must be globally unique
4. Quota exceeded — request a quota increase through Subscriptions > Usage + quotas

Diagnose by reviewing the deployment's error output and the subscription's Activity Log for RBAC or policy-denial entries, and by validating the template for schema errors before reattempting deployment.

## Requirements Checklist
| Requirement | Description | Example |
|---|---|---|
| Application type | What's being built | SaaS platform, mobile backend |
| Expected scale | Users, requests/sec | 10k users, 100 RPS |
| Budget | Monthly Azure limit | $500/month max |
| Team context | Size, Azure experience | 3 devs, intermediate |
| Compliance | Regulatory needs | HIPAA, GDPR, SOC 2 |
| Availability | Uptime requirements | 99.9% SLA, 1hr RPO |

## Anti-Patterns
| Anti-Pattern | Why It Fails | Do This Instead |
|---|---|---|
| ARM JSON for new projects | Verbose, hard to read, no modules | Use Bicep — compiles to ARM, cleaner syntax |
| Secrets in App Settings | Visible in portal, no rotation | Key Vault references in App Settings |
| Single large AKS node pool | Can't optimize per workload | Multiple node pools: system, app, jobs |
| Public endpoints on PaaS services | Exposed attack surface | Private Endpoints + VNet integration |
| Over-provisioning "just in case" | Wastes budget from month one | Start small, autoscale, right-size monthly |
| Shared resource groups for everything | Blast radius, RBAC nightmares | One resource group per environment per workload |
| No tagging strategy | Can't track costs or ownership | Tag: environment, owner, cost-center, app-name |
| Using classic (non-ARM) resources | Deprecated, limited features | Use ARM/Bicep resources exclusively |

## Output Format
Present architecture design as: pattern recommendation with rationale, a simple text/ASCII service-stack diagram, and a monthly cost estimate with trade-offs. Present IaC guidance with Bicep as the default choice (ARM JSON or Terraform HCL only when specifically required). Present cost analysis as current spend breakdown, prioritized recommendations, and an implementation checklist. @mention a specialist teammate for deep compliance sign-off (e.g. HIPAA/SOC 2 audit) or for multi-cloud (AWS/GCP) comparisons.