> **Important:** This skill provides guidance and recommended instructions to assist the AI system. Outputs are not guaranteed to be complete, correct, secure, or applicable to every scenario. Results should be reviewed and validated by a human before being applied. The AI model may choose not to follow all instructions exactly, and additional verification may be required. # WAF Checklist Per-pillar Well-Architected Framework alignment for AppOnboard-generated infrastructure. Use during scaffold self-review (Layer 4) and prepare validation (WAF Alignment dimension). > **Reference:** [Azure Well-Architected Framework](https://learn.microsoft.com/en-us/azure/well-architected/) — link, don't duplicate. See [WAF Service Guides](https://learn.microsoft.com/en-us/azure/well-architected/service-guides/) for per-service checklists. ## Reliability - Zone redundancy enabled for production SKUs (App Service P1v3+, SQL Premium, Redis Premium) - Health probes configured (Container Apps liveness/readiness, App Service `/health`) - GRS storage for production data (Standard_GRS or RA-GRS) - Retry policies in application code for transient failures - Min replicas ≥ 1 for production Container Apps (no cold-start) ## Security - System-assigned managed identity on all services - App-internal secrets stored on-compute (App Service app settings / CA native secrets) — ⛔ NO Key Vault; no inline/committed values - HTTPS-only + TLS 1.2+ on all endpoints - No public blob access on storage accounts - Private endpoints where budget allows (balanced/performance tiers) - No `administratorLogin`/password or access key on ANY data service (SQL, PostgreSQL, MySQL, Redis, Storage, Cosmos) — Entra / managed-identity-only auth - Compute floor B1 / SWA Standard — no F1/D1/Free (managed identity is mandatory) ## Cost Optimization - SKU matches `prepare-plan.json` budget tier — no over-provisioning - Scale-to-zero enabled for dev/test Container Apps - Free tier grants applied in cost estimate (see [pricing-guide.md](../../prepare/references/pricing-guide.md) § Free Grants Summary) - Reserved instances noted as option for production (don't auto-apply) ## Operational Excellence - `diagnostic-settings` is not scaffolded; if the generator added one it MUST be gated behind `enableDiagnostics` (default `false`) or absent — never wired unconditionally (that blocks the first deploy). - Application Insights connected for APM - Resource tagging: `app-onboard-skill`, `app-onboard-session-id`, `created-at` (see `bicep-patterns.md` § Service Tagging or `terraform-patterns.md` § Resource Tags) - All configurable values parameterized (no hardcoded regions, names, SKUs) ## Performance Efficiency - Autoscale rules for production SKUs (Container Apps max replicas, App Service auto-scale) - CDN for static assets when SPA frontend detected - Connection pooling for database access - Appropriate cache tier (Redis) when session/cache pattern detected