claude-code-arcane 1.0.0

package/skills/azure-cloud-architect/references/best_practices.md

@@ -0,0 +1,337 @@
+# Azure Best Practices
+
+Production-ready practices for naming, tagging, security, networking, monitoring, and disaster recovery on Azure.
+
+---
+
+## Table of Contents
+
+- [Naming Conventions](#naming-conventions)
+- [Tagging Strategy](#tagging-strategy)
+- [RBAC and Least Privilege](#rbac-and-least-privilege)
+- [Network Security](#network-security)
+- [Monitoring and Alerting](#monitoring-and-alerting)
+- [Disaster Recovery](#disaster-recovery)
+- [Common Pitfalls](#common-pitfalls)
+
+---
+
+## Naming Conventions
+
+Follow the Azure Cloud Adoption Framework (CAF) naming convention for consistency and automation.
+
+### Format
+
+```
+<resource-type>-<workload>-<environment>-<region>-<instance>
+```
+
+### Examples
+
+| Resource | Naming Pattern | Example |
+|----------|---------------|---------|
+| Resource Group | rg-\<workload\>-\<env\> | rg-myapp-prod |
+| App Service | app-\<workload\>-\<env\> | app-myapp-prod |
+| App Service Plan | plan-\<workload\>-\<env\> | plan-myapp-prod |
+| Azure SQL Server | sql-\<workload\>-\<env\> | sql-myapp-prod |
+| Azure SQL Database | sqldb-\<workload\>-\<env\> | sqldb-myapp-prod |
+| Storage Account | st\<workload\>\<env\> (no hyphens) | stmyappprod |
+| Key Vault | kv-\<workload\>-\<env\> | kv-myapp-prod |
+| AKS Cluster | aks-\<workload\>-\<env\> | aks-myapp-prod |
+| Container Registry | cr\<workload\>\<env\> (no hyphens) | crmyappprod |
+| Virtual Network | vnet-\<workload\>-\<env\> | vnet-myapp-prod |
+| Subnet | snet-\<purpose\> | snet-app, snet-data |
+| NSG | nsg-\<subnet-name\> | nsg-snet-app |
+| Public IP | pip-\<resource\>-\<env\> | pip-agw-prod |
+| Cosmos DB | cosmos-\<workload\>-\<env\> | cosmos-myapp-prod |
+| Service Bus | sb-\<workload\>-\<env\> | sb-myapp-prod |
+| Event Hubs | evh-\<workload\>-\<env\> | evh-myapp-prod |
+| Log Analytics | log-\<workload\>-\<env\> | log-myapp-prod |
+| Application Insights | ai-\<workload\>-\<env\> | ai-myapp-prod |
+
+### Rules
+
+- Lowercase only (some resources require it — be consistent everywhere)
+- Hyphens as separators (except where disallowed: storage accounts, container registries)
+- No longer than the resource type max length (e.g., storage accounts max 24 characters)
+- Environment abbreviations: `dev`, `stg`, `prod`
+- Region abbreviations: `eus` (East US), `weu` (West Europe), `sea` (Southeast Asia)
+
+---
+
+## Tagging Strategy
+
+Tags enable cost allocation, ownership tracking, and automation. Apply to every resource.
+
+### Required Tags
+
+| Tag Key | Purpose | Example Values |
+|---------|---------|---------------|
+| environment | Cost splitting, policy targeting | dev, staging, production |
+| app-name | Workload identification | myapp, data-pipeline |
+| owner | Team or individual responsible | platform-team, jane.doe@company.com |
+| cost-center | Finance allocation | CC-1234, engineering |
+
+### Recommended Tags
+
+| Tag Key | Purpose | Example Values |
+|---------|---------|---------------|
+| created-by | IaC or manual tracking | bicep, terraform, portal |
+| data-classification | Security posture | public, internal, confidential |
+| compliance | Regulatory requirements | hipaa, gdpr, sox |
+| auto-shutdown | Dev/test cost savings | true, false |
+
+### Enforcement
+
+Use Azure Policy to enforce tagging:
+
+```json
+{
+  "if": {
+    "allOf": [
+      { "field": "tags['environment']", "exists": "false" },
+      { "field": "type", "notEquals": "Microsoft.Resources/subscriptions/resourceGroups" }
+    ]
+  },
+  "then": { "effect": "deny" }
+}
+```
+
+---
+
+## RBAC and Least Privilege
+
+### Principles
+
+1. **Use built-in roles** before creating custom roles
+2. **Assign roles to groups**, not individual users
+3. **Scope to the narrowest level** — resource group or resource, not subscription
+4. **Use Managed Identity** for service-to-service — never store credentials
+5. **Enable Entra ID PIM** (Privileged Identity Management) for just-in-time admin access
+
+### Common Role Assignments
+
+| Persona | Scope | Role |
+|---------|-------|------|
+| Developer | Resource Group (dev) | Contributor |
+| Developer | Resource Group (prod) | Reader |
+| CI/CD pipeline | Resource Group | Contributor (via workload identity) |
+| App Service | Key Vault | Key Vault Secrets User |
+| App Service | Azure SQL | SQL DB Contributor (or Entra auth) |
+| AKS pod | Cosmos DB | Cosmos DB Built-in Data Contributor |
+| Security team | Subscription | Security Reader |
+| Platform team | Subscription | Owner (with PIM) |
+
+### Workload Identity Federation
+
+For CI/CD pipelines (GitHub Actions, Azure DevOps), use workload identity federation instead of service principal secrets:
+
+```bash
+# Create federated credential (GitHub Actions example)
+az ad app federated-credential create \
+  --id <app-object-id> \
+  --parameters '{
+    "name": "github-main",
+    "issuer": "https://token.actions.githubusercontent.com",
+    "subject": "repo:org/repo:ref:refs/heads/main",
+    "audiences": ["api://AzureADTokenExchange"]
+  }'
+```
+
+---
+
+## Network Security
+
+### Defense in Depth
+
+| Layer | Control | Implementation |
+|-------|---------|---------------|
+| Edge | DDoS + WAF | Azure DDoS Protection + Front Door WAF |
+| Perimeter | Firewall | Azure Firewall or NVA for hub VNet |
+| Network | Segmentation | VNet + subnets + NSGs |
+| Application | Access control | Private Endpoints + Managed Identity |
+| Data | Encryption | TLS 1.2+ in transit, CMK at rest |
+
+### Private Endpoints
+
+Every PaaS service in production must use Private Endpoints:
+
+| Service | Private Endpoint Support | Private DNS Zone |
+|---------|------------------------|------------------|
+| Azure SQL | Yes | privatelink.database.windows.net |
+| Cosmos DB | Yes | privatelink.documents.azure.com |
+| Key Vault | Yes | privatelink.vaultcore.azure.net |
+| Storage (Blob) | Yes | privatelink.blob.core.windows.net |
+| Container Registry | Yes | privatelink.azurecr.io |
+| Service Bus | Yes | privatelink.servicebus.windows.net |
+| App Service | VNet Integration (outbound) + Private Endpoint (inbound) | privatelink.azurewebsites.net |
+
+### NSG Rules Baseline
+
+Every subnet should have an NSG. Start with deny-all inbound, then open only what is needed:
+
+```
+Priority  Direction  Action  Source          Destination     Port
+100       Inbound    Allow   Front Door      App Subnet      443
+200       Inbound    Allow   App Subnet      Data Subnet     1433,5432
+300       Inbound    Allow   VNet            VNet            Any (internal)
+4096      Inbound    Deny    Any             Any             Any
+```
+
+### Application Gateway + WAF
+
+For single-region web apps without Front Door:
+
+- Application Gateway v2 with WAF enabled
+- OWASP 3.2 rule set + custom rules
+- Rate limiting per client IP
+- Bot protection (managed rule set)
+- SSL termination with Key Vault certificate
+
+---
+
+## Monitoring and Alerting
+
+### Monitoring Stack
+
+```
+Application Insights (APM + distributed tracing)
+        │
+        ▼
+Log Analytics Workspace (central log store)
+        │
+        ▼
+Azure Monitor Alerts (metric + log-based)
+        │
+        ▼
+Action Groups (email, Teams, PagerDuty, webhook)
+```
+
+### Essential Alerts
+
+| Alert | Condition | Severity |
+|-------|-----------|----------|
+| App Service HTTP 5xx | > 10 in 5 minutes | Critical (Sev 1) |
+| App Service response time | P95 > 2 seconds | Warning (Sev 2) |
+| Azure SQL DTU/CPU | > 80% for 10 minutes | Warning (Sev 2) |
+| Azure SQL deadlocks | > 0 | Warning (Sev 2) |
+| Cosmos DB throttled requests | 429 count > 10 in 5 min | Warning (Sev 2) |
+| AKS node CPU | > 80% for 10 minutes | Warning (Sev 2) |
+| AKS pod restart count | > 5 in 10 minutes | Critical (Sev 1) |
+| Key Vault access denied | > 0 | Critical (Sev 1) |
+| Budget threshold | 80% of monthly budget | Warning (Sev 3) |
+| Budget threshold | 100% of monthly budget | Critical (Sev 1) |
+
+### KQL Queries for Troubleshooting
+
+**App Service slow requests:**
+```kql
+requests
+| where duration > 2000
+| summarize count(), avg(duration), percentile(duration, 95) by name
+| order by count_ desc
+| take 10
+```
+
+**Failed dependencies (SQL, HTTP, etc.):**
+```kql
+dependencies
+| where success == false
+| summarize count() by type, target, resultCode
+| order by count_ desc
+```
+
+**AKS pod errors:**
+```kql
+KubePodInventory
+| where PodStatus != "Running" and PodStatus != "Succeeded"
+| summarize count() by PodStatus, Namespace, Name
+| order by count_ desc
+```
+
+### Application Insights Configuration
+
+- Enable **distributed tracing** with W3C trace context
+- Set **sampling** to 5-10% for high-volume production (100% for dev)
+- Enable **profiler** for .NET applications
+- Enable **snapshot debugger** for exception analysis
+- Configure **availability tests** (URL ping every 5 minutes from multiple regions)
+
+---
+
+## Disaster Recovery
+
+### RPO/RTO Mapping
+
+| Tier | RPO | RTO | Strategy | Cost |
+|------|-----|-----|----------|------|
+| Tier 1 (critical) | < 5 minutes | < 1 hour | Active-active multi-region | 2x |
+| Tier 2 (important) | < 1 hour | < 4 hours | Warm standby | 1.3x |
+| Tier 3 (standard) | < 24 hours | < 24 hours | Backup and restore | 1.1x |
+| Tier 4 (non-critical) | < 72 hours | < 72 hours | Rebuild from IaC | 1x |
+
+### Backup Strategy
+
+| Service | Backup Method | Retention |
+|---------|--------------|-----------|
+| Azure SQL | Automated backups | 7 days (short-term), 10 years (long-term) |
+| Cosmos DB | Continuous backup + point-in-time restore | 7-30 days |
+| Blob Storage | Soft delete + versioning + geo-redundant | 30 days soft delete |
+| AKS | Velero backup to Blob Storage | 7 days |
+| Key Vault | Soft delete + purge protection | 90 days |
+| App Service | Manual or automated (Backup and Restore feature) | Custom |
+
+### Storage Redundancy
+
+| Redundancy | Regions | Durability | Use Case |
+|-----------|---------|-----------|----------|
+| LRS | 1 (3 copies) | 11 nines | Dev/test, easily recreatable data |
+| ZRS | 1 (3 AZs) | 12 nines | Production, zone failure protection |
+| GRS | 2 (6 copies) | 16 nines | Business-critical, regional failure protection |
+| GZRS | 2 (3 AZs + secondary) | 16 nines | Most critical data, best protection |
+
+**Default to ZRS for production.** Use GRS/GZRS only when cross-region DR is required.
+
+### DR Testing Checklist
+
+- [ ] Verify automated backups are running and retention is correct
+- [ ] Test point-in-time restore for databases (monthly)
+- [ ] Test regional failover for SQL failover groups (quarterly)
+- [ ] Validate IaC can recreate full environment from scratch
+- [ ] Test Front Door failover by taking down primary region health endpoint
+- [ ] Document and test runbook for manual failover steps
+- [ ] Measure actual RTO vs target during DR drill
+
+---
+
+## Common Pitfalls
+
+### Cost Pitfalls
+
+| Pitfall | Impact | Prevention |
+|---------|--------|-----------|
+| No budget alerts | Unexpected bills | Set alerts at 50%, 80%, 100% on day one |
+| Premium tier in dev/test | 3-5x overspend | Use Basic/Free tiers, auto-shutdown VMs |
+| Orphaned resources | Silent monthly charges | Tag everything, review Cost Management weekly |
+| Ignoring Reserved Instances | 35-55% overpay on steady workloads | Review Azure Advisor quarterly |
+| Over-provisioned Cosmos DB RU/s | Paying for unused throughput | Use autoscale or serverless |
+
+### Security Pitfalls
+
+| Pitfall | Impact | Prevention |
+|---------|--------|-----------|
+| Secrets in App Settings | Leaked credentials | Use Key Vault references |
+| Public PaaS endpoints | Exposed attack surface | Private Endpoints + VNet integration |
+| Contributor role on subscription | Overprivileged access | Scope to resource group, use PIM |
+| No diagnostic settings | Blind to attacks | Enable on every resource from day one |
+| SQL password authentication | Weak identity model | Entra-only auth, Managed Identity |
+
+### Operational Pitfalls
+
+| Pitfall | Impact | Prevention |
+|---------|--------|-----------|
+| Manual portal deployments | Drift, no audit trail | Bicep for everything, block portal changes via Policy |
+| No health checks configured | Silent failures | /health endpoint, Front Door probes, App Service checks |
+| Single region deployment | Single point of failure | At minimum, use Availability Zones |
+| No tagging strategy | Cannot track costs/ownership | Enforce via Azure Policy from day one |
+| Ignoring Azure Advisor | Missed optimizations | Weekly review, enable email digest |

package/skills/azure-cloud-architect/references/service_selection.md

@@ -0,0 +1,250 @@
+# Azure Service Selection Guide
+
+Quick reference for choosing the right Azure service based on workload requirements.
+
+---
+
+## Table of Contents
+
+- [Compute Services](#compute-services)
+- [Database Services](#database-services)
+- [Storage Services](#storage-services)
+- [Messaging and Events](#messaging-and-events)
+- [Networking](#networking)
+- [Security and Identity](#security-and-identity)
+- [Monitoring and Observability](#monitoring-and-observability)
+
+---
+
+## Compute Services
+
+### Decision Matrix
+
+| Requirement | Recommended Service |
+|-------------|---------------------|
+| Event-driven, short tasks (<10 min) | Azure Functions (Consumption) |
+| Event-driven, longer tasks (<30 min) | Azure Functions (Premium) |
+| Containerized apps, simple deployment | Azure Container Apps |
+| Full Kubernetes control | AKS |
+| Traditional web apps (PaaS) | App Service |
+| GPU, HPC, custom OS | Virtual Machines |
+| Batch processing | Azure Batch |
+| Simple container from source | App Service (container) |
+
+### Azure Functions vs Container Apps vs AKS vs App Service
+
+| Feature | Functions | Container Apps | AKS | App Service |
+|---------|-----------|---------------|-----|-------------|
+| Scale to zero | Yes (Consumption) | Yes | No (min 1 node) | No |
+| Kubernetes | No | Built on K8s (abstracted) | Full K8s | No |
+| Cold start | 1-5s (Consumption) | 0-2s | N/A | N/A |
+| Max execution time | 10 min (Consumption), 30 min (Premium) | Unlimited | Unlimited | Unlimited |
+| Languages | C#, JS, Python, Java, Go, Rust, PowerShell | Any container | Any container | .NET, Node, Python, Java, PHP, Ruby |
+| Pricing model | Per-execution | Per vCPU-second | Per node | Per plan |
+| Best for | Event handlers, APIs, scheduled jobs | Microservices, APIs | Complex platforms, multi-team | Web apps, APIs, mobile backends |
+| Operational complexity | Low | Low-Medium | High | Low |
+| Dapr integration | No | Built-in | Manual | No |
+| KEDA autoscaling | No | Built-in | Manual install | No |
+
+**Opinionated recommendation:**
+- **Start with App Service** for web apps and APIs — simplest operational model.
+- **Use Container Apps** for microservices — serverless containers without Kubernetes complexity.
+- **Use AKS** only when you need full Kubernetes API access (custom operators, service mesh, multi-cluster).
+- **Use Functions** for event-driven glue (queue processing, webhooks, scheduled jobs).
+
+### VM Size Selection
+
+| Workload | Series | Example | vCPUs | RAM | Use Case |
+|----------|--------|---------|-------|-----|----------|
+| General purpose | Dv5/Dsv5 | Standard_D4s_v5 | 4 | 16 GB | Web servers, small databases |
+| Memory optimized | Ev5/Esv5 | Standard_E8s_v5 | 8 | 64 GB | Databases, caching, analytics |
+| Compute optimized | Fv2/Fsv2 | Standard_F8s_v2 | 8 | 16 GB | Batch processing, ML inference |
+| Storage optimized | Lsv3 | Standard_L8s_v3 | 8 | 64 GB | Data warehouses, large databases |
+| GPU | NCv3/NDv4 | Standard_NC6s_v3 | 6 | 112 GB | ML training, rendering |
+
+**Always use v5 generation or newer** — better price-performance than older series.
+
+---
+
+## Database Services
+
+### Decision Matrix
+
+| Requirement | Recommended Service |
+|-------------|---------------------|
+| Relational, SQL Server compatible | Azure SQL Database |
+| Relational, PostgreSQL | Azure Database for PostgreSQL Flexible Server |
+| Relational, MySQL | Azure Database for MySQL Flexible Server |
+| Document / multi-model, global distribution | Cosmos DB |
+| Key-value cache, sessions | Azure Cache for Redis |
+| Time-series, IoT data | Azure Data Explorer (Kusto) |
+| Full-text search | Azure AI Search (formerly Cognitive Search) |
+| Graph database | Cosmos DB (Gremlin API) |
+
+### Cosmos DB vs Azure SQL vs PostgreSQL
+
+| Feature | Cosmos DB | Azure SQL | PostgreSQL Flexible |
+|---------|-----------|-----------|-------------------|
+| Data model | Document, key-value, graph, table, column | Relational | Relational + JSON |
+| Global distribution | Native multi-region writes | Geo-replication (async) | Read replicas |
+| Consistency | 5 levels (strong to eventual) | Strong | Strong |
+| Scaling | RU/s (auto or manual) | DTU or vCore | vCore |
+| Serverless tier | Yes | Yes | No |
+| Best for | Global apps, variable schema, low-latency reads | OLTP, complex queries, transactions | PostgreSQL ecosystem, extensions |
+| Pricing model | Per RU/s + storage | Per DTU or per vCore | Per vCore |
+| Managed backups | Continuous + point-in-time | Automatic + long-term retention | Automatic |
+
+**Opinionated recommendation:**
+- **Default to Azure SQL Serverless** for most relational workloads — auto-pause saves money in dev/staging.
+- **Use PostgreSQL Flexible** when you need PostGIS, full-text search, or specific PostgreSQL extensions.
+- **Use Cosmos DB** only when you need global distribution, sub-10ms latency, or flexible schema.
+- **Never use Cosmos DB** for workloads that need complex joins or transactions across partitions.
+
+### Azure SQL Tier Selection
+
+| Tier | Use Case | Compute | Cost Range |
+|------|----------|---------|------------|
+| Basic / S0 | Dev/test, tiny workloads | 5 DTUs | $5/month |
+| General Purpose (Serverless) | Variable workloads, dev/staging | 0.5-40 vCores (auto-pause) | $40-800/month |
+| General Purpose (Provisioned) | Steady production workloads | 2-80 vCores | $150-3000/month |
+| Business Critical | High IOPS, low latency, readable secondary | 2-128 vCores | $400-8000/month |
+| Hyperscale | Large databases (>4 TB), instant scaling | 2-128 vCores | $200-5000/month |
+
+---
+
+## Storage Services
+
+### Decision Matrix
+
+| Requirement | Recommended Service |
+|-------------|---------------------|
+| Unstructured data (files, images, backups) | Blob Storage |
+| File shares (SMB/NFS) | Azure Files |
+| High-performance file shares | Azure NetApp Files |
+| Data Lake (analytics, big data) | Data Lake Storage Gen2 |
+| Disk storage for VMs | Managed Disks |
+| Queue-based messaging (simple) | Queue Storage |
+| Table data (simple key-value) | Table Storage (or Cosmos DB Table API) |
+
+### Blob Storage Tiers
+
+| Tier | Access Pattern | Cost (per GB/month) | Access Cost | Use Case |
+|------|---------------|---------------------|-------------|----------|
+| Hot | Frequent access | $0.018 | Low | Active data, web content |
+| Cool | Infrequent (30+ days) | $0.01 | Medium | Backups, older data |
+| Cold | Rarely accessed (90+ days) | $0.0036 | Higher | Compliance archives |
+| Archive | Almost never (180+ days) | $0.00099 | High (rehydrate required) | Long-term retention |
+
+**Always set lifecycle management policies.** Rule of thumb: Hot for 30 days, Cool for 90 days, Cold or Archive after that.
+
+---
+
+## Messaging and Events
+
+### Decision Matrix
+
+| Requirement | Recommended Service |
+|-------------|---------------------|
+| Pub/sub, event routing, reactive | Event Grid |
+| Reliable message queues, transactions | Service Bus |
+| High-throughput event streaming | Event Hubs |
+| Simple task queues | Queue Storage |
+| IoT device telemetry | IoT Hub |
+
+### Event Grid vs Service Bus vs Event Hubs
+
+| Feature | Event Grid | Service Bus | Event Hubs |
+|---------|-----------|-------------|------------|
+| Pattern | Pub/Sub events | Message queue / topic | Event streaming |
+| Delivery | At-least-once | At-least-once (peek-lock) | At-least-once (partitioned) |
+| Ordering | No guarantee | FIFO (sessions) | Per partition |
+| Max message size | 1 MB | 256 KB (Standard), 100 MB (Premium) | 1 MB (Standard), 20 MB (Premium) |
+| Retention | 24 hours | 14 days (Standard) | 1-90 days |
+| Throughput | Millions/sec | Thousands/sec | Millions/sec |
+| Best for | Reactive events, webhooks | Business workflows, commands | Telemetry, logs, analytics |
+| Dead letter | Yes | Yes | Via capture to storage |
+
+**Opinionated recommendation:**
+- **Event Grid** for reactive, fan-out scenarios (blob uploaded, resource created, custom events).
+- **Service Bus** for reliable business messaging (orders, payments, workflows). Use topics for pub/sub, queues for point-to-point.
+- **Event Hubs** for high-volume telemetry, log aggregation, and streaming analytics.
+
+---
+
+## Networking
+
+### Decision Matrix
+
+| Requirement | Recommended Service |
+|-------------|---------------------|
+| Global HTTP load balancing + CDN + WAF | Azure Front Door |
+| Regional Layer 7 load balancing + WAF | Application Gateway |
+| Regional Layer 4 load balancing | Azure Load Balancer |
+| DNS management | Azure DNS |
+| DNS-based global traffic routing | Traffic Manager |
+| Private connectivity to PaaS | Private Endpoints |
+| Site-to-site VPN | VPN Gateway |
+| Dedicated private connection | ExpressRoute |
+| Outbound internet from VNet | NAT Gateway |
+| DDoS protection | Azure DDoS Protection |
+
+### Front Door vs Application Gateway vs Load Balancer
+
+| Feature | Front Door | Application Gateway | Load Balancer |
+|---------|-----------|-------------------|--------------|
+| Layer | 7 (HTTP/HTTPS) | 7 (HTTP/HTTPS) | 4 (TCP/UDP) |
+| Scope | Global | Regional | Regional |
+| WAF | Yes (Premium) | Yes (v2) | No |
+| SSL termination | Yes | Yes | No |
+| CDN | Built-in | No | No |
+| Health probes | Yes | Yes | Yes |
+| Best for | Global web apps, multi-region | Single-region web apps | TCP/UDP workloads, internal LB |
+
+---
+
+## Security and Identity
+
+### Decision Matrix
+
+| Requirement | Recommended Service |
+|-------------|---------------------|
+| User authentication | Entra ID (Azure AD) |
+| B2C customer identity | Entra External ID (Azure AD B2C) |
+| Secrets, keys, certificates | Key Vault |
+| Service-to-service auth | Managed Identity |
+| Network access control | NSGs + Private Endpoints |
+| Web application firewall | Front Door WAF or App Gateway WAF |
+| Threat detection | Microsoft Defender for Cloud |
+| Policy enforcement | Azure Policy |
+| Privileged access management | Entra ID PIM |
+
+### Managed Identity Usage
+
+| Scenario | Configuration |
+|----------|---------------|
+| App Service accessing SQL | System-assigned MI + Azure SQL Entra auth |
+| Functions accessing Key Vault | System-assigned MI + Key Vault RBAC |
+| AKS pods accessing Cosmos DB | Workload Identity + Cosmos DB RBAC |
+| VM accessing Storage | System-assigned MI + Storage RBAC |
+| DevOps pipeline deploying | Workload Identity Federation (no secrets) |
+
+**Rule: Every Azure service that supports Managed Identity should use it.** No connection strings with passwords, no service principal secrets in config.
+
+---
+
+## Monitoring and Observability
+
+### Decision Matrix
+
+| Requirement | Recommended Service |
+|-------------|---------------------|
+| Application performance monitoring | Application Insights |
+| Log aggregation and queries | Log Analytics (KQL) |
+| Metrics and alerts | Azure Monitor |
+| Dashboards | Azure Dashboard or Grafana (managed) |
+| Distributed tracing | Application Insights (OpenTelemetry) |
+| Cost monitoring | Cost Management + Budgets |
+| Security monitoring | Microsoft Defender for Cloud |
+| Compliance monitoring | Azure Policy + Regulatory Compliance |
+
+**Every resource should have diagnostic settings** sending logs and metrics to a Log Analytics workspace. Non-negotiable for production.