Azure-Well-Architected-Review

# Azure Well-Architected Review

This workflow performs a structured Azure Well-Architected Framework (WAF) review against your workload's IaC files and deployed infrastructure. It identifies risks across all 5 WAF pillars and creates GitHub issues to track remediation.

Prerequisites

- Azure CLI (`az`) configured and authenticated

- IaC files present in the repository (Bicep, Terraform, or ARM templates)

- GitHub MCP server configured and authenticated

Workflow Steps

Step 1: Load Well-Architected Framework Reference

Fetch current Azure WAF best practices:

- `https://learn.microsoft.com/en-us/azure/well-architected/`

- Service guides for the Azure services in use (`https://learn.microsoft.com/en-us/azure/well-architected/service-guides/`)

- Workload-specific guidance relevant to the workload type (SaaS, mission-critical, AI, etc.)

If the `microsoft.docs.mcp` MCP server is available, use it to query the latest pillar checklists and service-specific recommendations.

Step 2: Discover IaC & Architecture

Establish the review scope, then inventory both the code and the live environment:

1. **Confirm the Azure scope**: Ask the user which subscription(s)/resource group(s) are in scope, or infer them from IaC parameters and confirm.

2. **Scan the repository for IaC files**:

- Bicep: `**/*.bicep`, `bicepconfig.json`

- Terraform: `**/*.tf` (azurerm/azapi providers)

- ARM templates: `**/azuredeploy*.json`, `**/*.template.json`, files with `$schema` containing `deploymentTemplate`

3. **Inventory live resources** (always, even when IaC exists): `az resource list --resource-group <rg> --output json` (or subscription-wide), plus targeted `az <service> show` calls for configuration details the pillar checks need.

4. **Compare IaC with live inventory**: Flag drift — resources present in Azure but absent from IaC (portal-created), resources defined in IaC but not deployed, and configuration mismatches. Record drift findings for Step 3 (they typically map to the Operational Excellence pillar).

Identify key Azure services in use (compute, data, networking, security, observability) and generate a Mermaid architecture diagram.

Step 3: Pillar-by-Pillar Review

#### Pillar 1: Reliability

- [ ] Availability zones enabled for zonal services (VMs, VMSS, AKS node pools, App Service, SQL, Storage ZRS)

- [ ] Production SKUs support the required SLA (no Basic/Free tiers on critical paths)

- [ ] Azure SQL / Cosmos DB backup and point-in-time restore configured with appropriate retention

- [ ] Geo-redundancy configured where RPO requires it (GRS/RA-GRS storage, SQL failover groups, Cosmos DB multi-region)

- [ ] Autoscale rules configured for App Service plans, VMSS, AKS (no fixed single instance for production)

- [ ] Health probes configured on Load Balancer / Application Gateway / Front Door backends

- [ ] Dead-lettering enabled for Service Bus queues/subscriptions and Event Grid subscriptions

- [ ] Retry policies with exponential backoff implemented for transient fault handling

- [ ] Disaster recovery plan defined (documented RTO/RPO, tested failover)

#### Pillar 2: Security

- [ ] Managed identities used instead of service principals with secrets or connection strings

- [ ] No hardcoded credentials, keys, or connection strings in IaC or code

- [ ] Secrets stored in Azure Key Vault with RBAC authorization (not access policies)

- [ ] Storage accounts deny public blob access and disallow shared key access where possible

- [ ] Private endpoints (or at minimum service endpoints + firewall rules) for PaaS data services

- [ ] NSGs restrict inbound traffic to minimum required ports/CIDRs (no `*` → `*` allow rules)

- [ ] TLS 1.2+ enforced on all endpoints (`minimumTlsVersion`, `httpsOnly`)

- [ ] Azure RBAC follows least privilege (no Owner/Contributor at subscription scope for workload identities)

- [ ] Microsoft Defender for Cloud enabled on relevant resource types (`az security pricing list`)

- [ ] Azure WAF (Application Gateway o