azure-cloud-architect

CategoryDesign

AuthorAlireza Rezvani

LicenseMIT

Rating4.90/5

Uses3.7K

Azure Cloud Architect

Design scalable, cost-effective Azure architectures for startups and enterprises with Bicep infrastructure-as-code templates.

---

Workflow

Step 1: Gather Requirements

Collect application specifications:

code

- Application type (web app, mobile backend, data pipeline, SaaS, microservices)
Expected users and requests per second
Budget constraints (monthly spend limit)
Team size and Azure experience level
Compliance requirements (GDPR, HIPAA, SOC 2, ISO 27001)
Availability requirements (SLA, RPO/RTO)
Region preferences (data residency, latency)

Step 2: Design Architecture

Run the architecture designer to get pattern recommendations:

bash

python scripts/architecture_designer.py \
  --app-type web_app \
  --users 10000 \
  --requirements '{"budget_monthly_usd": 500, "compliance": ["SOC2"]}'

Example output:

json

{
  "recommended_pattern": "app_service_web",
  "service_stack": ["App Service", "Azure SQL", "Front Door", "Key Vault", "Entra ID"],
  "estimated_monthly_cost_usd": 280,
  "pros": ["Managed platform", "Built-in autoscale", "Deployment slots"],
  "cons": ["Less control than VMs", "Platform constraints", "Cold start on consumption plans"]
}

Select from recommended patterns:

App Service Web: Front Door + App Service + Azure SQL + Redis Cache

Microservices on AKS: AKS + Service Bus + Cosmos DB + API Management

Serverless Event-Driven: Functions + Event Grid + Service Bus + Cosmos DB

Data Pipeline: Data Factory + Synapse Analytics + Data Lake Storage + Event Hubs

See references/architecture_patterns.md for detailed pattern specifications.

Validation checkpoint: Confirm the recommended pattern matches the team's operational maturity and compliance requirements before proceeding to Step 3.

Step 3: Generate IaC Templates

Create infrastructure-as-code for the selected pattern:

bash

# Web app stack (Bicep)
python scripts/bicep_generator.py --arch-type web-app --output main.bicep

Example Bicep output (core web app resources):

bicep

@description('The environment name')
param environment string = 'dev'
@description('The Azure region for resources')
param location string = resourceGroup().location
@description('The application name')
param appName string = 'myapp'
// App Service Plan
resource appServicePlan 'Microsoft.Web/serverfarms@2023-01-01' = {
  name: '${environment}-${appName}-plan'
  location: location
  sku: {
    name: 'P1v3'
    tier: 'PremiumV3'
    capacity: 1
  }
  properties: {
    reserved: true // Linux
  }
}
// App Service
resource appService 'Microsoft.Web/sites@2023-01-01' = {
  name: '${environment}-${appName}-web'
  location: location
  properties: {
    serverFarmId: appServicePlan.id
    httpsOnly: true
    siteConfig: {
      linuxFxVersion: 'NODE|20-lts'
      minTlsVersion: '1.2'
      ftpsState: 'Disabled'
      alwaysOn: true
    }
  }
  identity: {
    type: 'SystemAssigned'
  }
}
// Azure SQL Database
resource sqlServer 'Microsoft.Sql/servers@2023-05-01-preview' = {
  name: '${environment}-${appName}-sql'
  location: location
  properties: {
    administrators: {
      azureADOnlyAuthentication: true
    }
    minimalTlsVersion: '1.2'
  }
}
resource sqlDatabase 'Microsoft.Sql/servers/databases@2023-05-01-preview' = {
  parent: sqlServer
  name: '${appName}-db'
  location: location
  sku: {
    name: 'GP_S_Gen5_2'
    tier: 'GeneralPurpose'
  }
  properties: {
    autoPauseDelay: 60
    minCapacity: json('0.5')
  }
}

> Full templates including Front Door, Key Vault, Managed Identity, and monitoring are generated by bicep_generator.py and also available in references/architecture_patterns.md.

Bicep is the recommended IaC language for Azure. Prefer Bicep over ARM JSON templates: Bicep compiles to ARM JSON, has cleaner syntax, supports modules, and is first-party supported by Microsoft.

Step 4: Review Costs

Analyze estimated costs and optimization opportunities:

bash

python scripts/cost_optimizer.py \
  --config current_resources.json \
  --json

Example output:

json

{
  "current_monthly_usd": 2000,
  "recommendations": [
    { "action": "Right-size SQL Database GP_S_Gen5_8 to GP_S_Gen5_2", "savings_usd": 380, "priority": "high" },
    { "action": "Purchase 1-year Reserved Instances for AKS node pools", "savings_usd": 290, "priority": "high" },
    { "action": "Move Blob Storage to Cool tier for objects >30 days old", "savings_usd": 65, "priority": "medium" }
  ],
  "total_potential_savings_usd": 735
}

Output includes:

Monthly cost breakdown by service

Right-sizing recommendations

Reserved Instance and Savings Plan opportunities

Potential monthly savings

Step 5: Configure CI/CD

Set up Azure DevOps Pipelines or GitHub Actions with Azure:

yaml

# GitHub Actions — deploy Bicep to Azure name: Deploy Infrastructure on: push: branches: [main] permissions: id-token: write contents: read jobs: deploy: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: azure/login@v2 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

- uses: azure/arm-deploy@v2 with: resourceGroupName: rg-myapp-dev template: ./infra/main.bicep parameters: environment=dev

yaml

# Azure DevOps Pipeline trigger: branches: include: - main pool: vmImage: 'ubuntu-latest'

steps: - task: AzureCLI@2 inputs: azureSubscription: 'MyServiceConnection' scriptType: 'bash' scriptLocation: 'inlineScript' inlineScript: | az deployment group create \ --resource-group rg-myapp-dev \ --template-file infra/main.bicep \ --parameters environment=dev

Step 6: Security Review

Validate security posture before production:

Identity: Entra ID (Azure AD) with RBAC, Managed Identity for service-to-service auth — never store credentials in code

Secrets: Key Vault for all secrets, certificates, and connection strings

Network: NSGs on all subnets, Private Endpoints for PaaS services, Application Gateway with WAF

Encryption: TLS 1.2+ in transit, Azure-managed or customer-managed keys at rest

Monitoring: Microsoft Defender for Cloud enabled, Azure Policy for guardrails

Compliance: Azure Policy assignments for SOC 2 / HIPAA / ISO 27001 initiatives

If deployment fails:

1. Check the deployment status:

bash

az deployment group show \
     --resource-group rg-myapp-dev \
     --name main \
     --query 'properties.error'

2. Review Activity Log for RBAC or policy errors.
3. Validate the Bicep template before deploying:

bash

az bicep build --file main.bicep
   az deployment group validate \
     --resource-group rg-myapp-dev \
     --template-file main.bicep

Common failure causes:

RBAC permission errors — verify the deploying principal has Contributor on the resource group

Resource provider not registered — run az provider register --namespace Microsoft.Web

Naming conflicts — Azure resource names are often globally unique (storage accounts, web apps)

Quota exceeded — request quota increase via Azure Portal > Subscriptions > Usage + quotas

---

Tools

architecture_designer.py

Generates architecture pattern recommendations based on requirements.

bash

python scripts/architecture_designer.py \
  --app-type web_app \
  --users 50000 \
  --requirements '{"budget_monthly_usd": 1000, "compliance": ["HIPAA"]}' \
  --json

Input: Application type, expected users, JSON requirements
Output: Recommended pattern, service stack, cost estimate, pros/cons

cost_optimizer.py

Analyzes Azure resource configurations for cost savings.

bash

python scripts/cost_optimizer.py --config resources.json --json

Input: JSON file with current Azure resource inventory
Output: Recommendations for:

Idle resource removal

VM and database right-sizing

Reserved Instance purchases

Storage tier transitions

Unused public IPs and load balancers

bicep_generator.py

Generates Bicep template scaffolds from architecture type.

bash

python scripts/bicep_generator.py --arch-type microservices --output main.bicep

Output: Production-ready Bicep templates with:

Managed Identity (no passwords)

Key Vault integration

Diagnostic settings for Azure Monitor

Network security groups

Tags for cost allocation

---

Quick Start

Web App Architecture (< $100/month)

code

Ask: "Design an Azure web app for a startup with 5000 users"
Result:
App Service (B1 Linux) for the application

Azure SQL Serverless for relational data

Azure Blob Storage for static assets

Front Door (free tier) for CDN and routing

Key Vault for secrets

Estimated: $40-80/month

Microservices on AKS ($500-2000/month)

code

Ask: "Design a microservices architecture on Azure for a SaaS platform with 50k users"
Result:
AKS cluster with 3 node pools (system, app, jobs)

API Management for gateway and rate limiting

Cosmos DB for multi-model data

Service Bus for async messaging

Azure Monitor + Application Insights for observability

Multi-zone deployment

Serverless Event-Driven (< $200/month)

code

Ask: "Design an event-driven backend for processing orders"
Result:
Azure Functions (Consumption plan) for compute

Event Grid for event routing

Service Bus for reliable messaging

Cosmos DB for order data

Application Insights for monitoring

Estimated: $30-150/month depending on volume

Data Pipeline ($300-1500/month)

code

Ask: "Design a data pipeline for ingesting 10M events/day"
Result:
Event Hubs for ingestion

Stream Analytics or Functions for processing

Data Lake Storage Gen2 for raw data

Synapse Analytics for warehouse

Power BI for dashboards

---

Input Requirements

Provide these details for architecture design:

| Requirement | Description | Example |
|-------------|-------------|---------|
| Application type | What you're building | SaaS platform, mobile backend |
| Expected scale | Users, requests/sec | 10k users, 100 RPS |
| Budget | Monthly Azure limit | $500/month max |
| Team context | Size, Azure experience | 3 devs, intermediate |
| Compliance | Regulatory needs | HIPAA, GDPR, SOC 2 |
| Availability | Uptime requirements | 99.9% SLA, 1hr RPO |

JSON Format:

json

{
  "application_type": "saas_platform",
  "expected_users": 10000,
  "requests_per_second": 100,
  "budget_monthly_usd": 500,
  "team_size": 3,
  "azure_experience": "intermediate",
  "compliance": ["SOC2"],
  "availability_sla": "99.9%"
}

---

Anti-Patterns

| Anti-Pattern | Why It Fails | Do This Instead |
|---|---|---|
| ARM JSON templates for new projects | Verbose, hard to read, no modules | Use Bicep — compiles to ARM, cleaner syntax |
| Storing secrets in App Settings | Secrets visible in portal, no rotation | Use Key Vault references in App Settings |
| Single large AKS node pool | Cannot optimize for different workloads | Use multiple node pools: system, app, jobs |
| Public endpoints on PaaS services | Exposed attack surface | Use Private Endpoints + VNet integration |
| Over-provisioning "just in case" | Wastes budget month one | Start small, use autoscale, right-size monthly |
| Shared resource groups for everything | Blast radius, RBAC nightmares | One resource group per environment per workload |
| No tagging strategy | Cannot track costs or ownership | Tag: environment, owner, cost-center, app-name |
| Using classic resources | Deprecated, limited features | Use ARM/Bicep resources exclusively |

---

Output Formats

Architecture Design

Pattern recommendation with rationale

Service stack diagram (ASCII)

Monthly cost estimate and trade-offs

IaC Templates

Bicep: Recommended — first-party, module support, clean syntax

ARM JSON: Generated from Bicep when needed

Terraform HCL: Multi-cloud compatible using azurerm provider

Cost Analysis

Current spend breakdown with optimization recommendations

Priority action list (high/medium/low) and implementation checklist

---

Cross-References

| Skill | Relationship |
|-------|-------------|
| engineering-team/aws-solution-architect | AWS equivalent — same 6-step workflow, different services |
| engineering-team/gcp-cloud-architect | GCP equivalent — completes the cloud trifecta |
| engineering-team/senior-devops | Broader DevOps scope — pipelines, monitoring, containerization |
| engineering/terraform-patterns | IaC implementation — use for Terraform modules targeting Azure |
| engineering/ci-cd-pipeline-builder | Pipeline construction — automates Azure DevOps and GitHub Actions |

---

Reference Documentation

| Document | Contents |
|----------|----------|
| references/architecture_patterns.md | 5 patterns: web app, microservices/AKS, serverless, data pipeline, multi-region |
| references/service_selection.md | Decision matrices for compute, database, storage, messaging, networking |
| references/best_practices.md | Naming conventions, tagging, RBAC, network security, monitoring, DR |