Setting the file. One moment.
Subchapter 25.11
references/design-refs/index.mdMarkdown19 KBView on GitHub
Routing for pass 2. Every row is keyed by a canonical Microsoft.* ARM type, never
a Terraform type — arm-type-canonicalization.md has already translated by the time
Design runs.
Column note — read this before using the right-hand column. For a fast-path
row (marked direct, skip, or gate) the column states the actual target: the
answer legitimately lives in the table.
For a rubric row it is an unordered candidate set and nothing more. It deliberately does NOT say which candidate wins, does not mark a default, and is not ordered by preference — the selection logic lives in the Reference file, and this column is here so you can tell which rubric to open, not so you can skip opening it.
This matters because the column sits next to a HALT instruction. An earlier draft
printed defaults here (Elastic Beanstalk (default), Fargate, or EKS), which meant a
complete and plausible compute design could be written without ever opening
compute.md — and every shape assertion in design.md would have passed it. A
capability run reported being strongly tempted to do exactly that. If you find yourself
able to answer from this column alone, the row is wrong; fix the row.
Confidence is never deterministic for a row routed through this file. It is
inferred, or measured when observed utilization backed the choice. See
fast-path.md § Confidence vocabulary.
A type in this file has already failed the fast-path lookup. Check
fast-path-services.json FIRST — skip_mappings, then specialist_gates, then
direct_mappings. A type that matched there never reaches this file. Types that
appear in both are listed here anyway, with their fast-path disposition named in the
Reference column, so this file can be read as the complete type inventory.
HALT if a Reference file named below is not on disk. Emit GATE_FAIL naming the
type and the missing file. Do not map the resource from your own knowledge of
Azure and AWS. This is the same guard, for the same reason, as discover-iac.md
Step 2: “no rubric needed” and “the rubric has not been written yet” are otherwise
indistinguishable, and improvising past the second produces a mapping that satisfies
every shape assertion, carries a confidence label it did not earn, and differs
between two runs of the same estate.
| Canonical ARM type | Reference | Target (fast-path) / candidate set (rubric) |
|---|---|---|
Microsoft.Web/serverfarms (plan hosts web apps) | compute.md | {Elastic Beanstalk, Fargate, EKS} — this is the compute unit |
Microsoft.Web/serverfarms (every hosted site has kind containing functionapp) | compute.md | {Lambda, Fargate} — still the plan, not the functions |
Microsoft.Web/sites | no entry, ever | folded into its plan; see below |
Microsoft.Web/sites/slots | fast-path: skip | a blue-green note on the parent plan’s mapping |
Microsoft.Web/staticSites | compute.md | {S3 + CloudFront, and Lambda + API Gateway for its managed functions} |
Microsoft.Compute/virtualMachines | compute.md | {EC2} — MGN-based cutover. SQL Server images additionally hit a specialist gate |
Microsoft.Compute/virtualMachineScaleSets | compute.md | {EC2 Auto Scaling group} |
Microsoft.Compute/availabilitySets | fast-path: skip | multi-AZ spread on the members’ ASG |
Microsoft.ContainerService/managedClusters | fast-path: direct | EKS |
Microsoft.ContainerService/managedClusters/agentPools | fast-path: skip | EKS node-group sizing on the parent |
Microsoft.ContainerRegistry/registries | fast-path: direct | ECR |
Microsoft.App/containerApps | compute.md | {Fargate} |
Microsoft.ContainerInstance/containerGroups | compute.md | {Fargate task} — a one-shot container group is a task, not a service |
Microsoft.App/managedEnvironments | compute.md | {ECS cluster + VPC}; usually a config source for its container apps instead |
Microsoft.Web/sites never gets an entry of its own — not in services[], not in
deferred[], not in pending_rubric[]. The compute unit is always the
Microsoft.Web/serverfarms plan, and a site’s kind, runtime, and app settings are
INPUTS to the plan’s target choice. That is why the two plan rows above differ only by
the kind of the sites hosted on them.
An earlier draft of this file gave Microsoft.Web/sites (kind=functionapp) its own row
with its own target, which contradicted both design.md‘s postcondition (“no
Microsoft.Web/sites resource carries its own compute sizing”) and the fan-in rule in
design-infra.md. A capability run followed this file, emitted a standalone entry for
the function app, and failed the oracle. A Y1 consumption plan hosting one function app
is exactly where the two readings collide — and the plan is still the answer, because
one compute unit per plan is what stops five apps becoming five line items.
GPU and HPC VM series (ND / NC / NV / HB / HX) branch inside compute.md to
gpu-hpc.md. Windows and .NET workloads take the x86_64 path — see SKILL.md
§ Philosophy; Graviton is an offered optimization here, not the default.
| Canonical ARM type | Reference | Target / candidate set |
|---|---|---|
Microsoft.DBforPostgreSQL/flexibleServers | database.md | {RDS PostgreSQL, Aurora PostgreSQL} — an availability override gate selects the family, not the rubric |
Microsoft.DBforPostgreSQL/servers (Single Server) | database.md | {RDS PostgreSQL} — note the source is retired on Azure |
Microsoft.DBforMySQL/flexibleServers | database.md | {RDS MySQL, Aurora MySQL} — an availability override gate selects the family |
Microsoft.DBforMySQL/servers (Single Server) | database.md | {RDS MySQL} |
Microsoft.Sql/servers | database.md | {RDS instance hosting its databases}; often a config source instead |
Microsoft.Sql/servers/databases | database.md | {RDS SQL Server} — owner decision 11.3 puts the common case on the rubric path, not on a gate |
Microsoft.Sql/servers/elasticPools | fast-path: gate | Deferred — specialist engagement |
Microsoft.Sql/managedInstances | fast-path: gate | Deferred — specialist engagement |
Microsoft.DocumentDB/databaseAccounts (Mongo/Cassandra/Gremlin/Table) | fast-path: direct | DocumentDB / Keyspaces / Neptune / DynamoDB by API |
Microsoft.DocumentDB/databaseAccounts (Core / SQL API) | database.md | {DynamoDB} — RU/s → WCU/RCU conversion, full depth; the only Cosmos surface on the rubric path |
Microsoft.Cache/Redis | fast-path: direct | ElastiCache Redis |
Microsoft.Cache/redisEnterprise | database.md | {ElastiCache Redis, MemoryDB}; RediSearch/RedisJSON modules have no equivalent either way |
The availability selector (single-az / multi-az / multi-az-ha / multi-region) is a
post-rubric override gate in database.md, not a criterion — it forces RDS versus
Aurora regardless of rubric output, because availability is never inferable from IaC.
| Canonical ARM type | Reference | Target / candidate set |
|---|---|---|
Microsoft.Storage/storageAccounts | fast-path: direct | S3 (blob surface) |
Microsoft.Storage/storageAccounts/blobServices/containers | fast-path: direct | S3 |
Microsoft.Storage/storageAccounts/fileServices/shares | fast-path: direct | FSx for Windows File Server (SMB) / EFS (NFS) |
Microsoft.Storage/storageAccounts/queueServices/queues | fast-path: direct | SQS |
Microsoft.Storage/storageAccounts/tableServices/tables | fast-path: direct | DynamoDB |
Microsoft.Compute/disks | fast-path: direct | EBS |
storage.md carries the rubric for anything that reaches it — today only the share
row’s protocol reasoning and the lifecycle/tiering notes. It exists because the
protocol discriminator has to be documented somewhere a reviewer can find it.
| Canonical ARM type | Reference | Target / candidate set |
|---|---|---|
Microsoft.Network/virtualNetworks | fast-path: direct | VPC |
Microsoft.Network/virtualNetworks/subnets | fast-path: direct | VPC subnet |
Microsoft.Network/networkSecurityGroups | fast-path: direct | Security Group (DENY rules need a NACL note) |
Microsoft.Network/dnsZones | fast-path: direct | Route 53 hosted zone |
Microsoft.Network/loadBalancers | networking.md | {NLB, ALB} |
Microsoft.Network/applicationGateways | networking.md | {ALB, ALB + AWS WAF} |
Microsoft.Network/natGateways | networking.md | {NAT Gateway} |
Microsoft.Cdn/profiles | networking.md | {CloudFront} |
Microsoft.Network/frontDoors (deprecated) | networking.md | {CloudFront, CloudFront + AWS WAF} |
Microsoft.ApiManagement/service | networking.md | {API Gateway} |
Microsoft.Network/networkInterfaces | fast-path: skip | ENI, created by its owner |
Microsoft.Network/publicIPAddresses | fast-path: skip | Elastic IP, managed by ALB/NAT |
Microsoft.Network/privateEndpoints | fast-path: skip | none — read for its edge |
Microsoft.Network/privateDnsZones | fast-path: skip | implicit in the VPC design |
networking.md also carries the “free on AWS” findings — cross-AZ patterns, VPC
peering versus Azure’s paid VNet peering — which are report content, not mappings.
| Canonical ARM type | Reference | Target / candidate set |
|---|---|---|
Microsoft.ServiceBus/namespaces | messaging.md | {SQS + SNS, Amazon MQ} |
Microsoft.ServiceBus/namespaces/queues | messaging.md | {SQS} |
Microsoft.ServiceBus/namespaces/topics | messaging.md | {SNS, EventBridge} |
Microsoft.EventHub/namespaces | fast-path: direct | MSK when kafka_enabled, else Kinesis Data Streams |
Microsoft.EventHub/namespaces/eventhubs | messaging.md | {a topic or stream inside the parent’s target} |
Microsoft.SignalRService/SignalR | messaging.md | {API Gateway WebSocket APIs, AppSync subscriptions} |
Event Hubs is protocol-only by owner decision 11.4 and carries no throughput threshold, which is why it is a fast-path row rather than a rubric row.
| Canonical ARM type | Reference | Target / candidate set |
|---|---|---|
Microsoft.KeyVault/vaults | fast-path: direct | Secrets Manager (+ KMS for keys, ACM for certificates) |
Microsoft.KeyVault/vaults/secrets | fast-path: skip | names feed the parent vault |
Microsoft.ManagedIdentity/userAssignedIdentities | fast-path: direct | IAM Role |
Microsoft.Authorization/roleAssignments | fast-path: skip | IAM policy, authored not translated |
Microsoft.Authorization/roleDefinitions | fast-path: skip | IAM policy |
Human identity — Entra ID tenants, users, groups, app registrations — is not a
resource mapping. It is identity.md, reached from Clarify category J, and it defaults
to a fresh IAM Identity Center re-invite rather than an Entra ID federation.
| Canonical ARM type | Reference | Target / candidate set |
|---|---|---|
Microsoft.CognitiveServices/accounts (kind: OpenAI) | vendored/ai/ai-openai-to-bedrock.md | {Bedrock} |
Microsoft.CognitiveServices/accounts (other kinds) | ai.md | {Textract, Rekognition, Comprehend, Transcribe} by capability |
Microsoft.CognitiveServices/accounts/deployments | vendored/ai/ai-openai-to-bedrock.md | a config source — the deployed model name is the mapping input |
Azure OpenAI has no ARM provider of its own; kind is the only signal. The model
catalogue and the Bedrock mapping do not change based on which endpoint served the
calls, which is why this routes to the same shared guide as an OpenAI-direct workload.
| Canonical ARM type | Reference | Target / candidate set |
|---|---|---|
Microsoft.Search/searchServices | analytics.md | {Amazon OpenSearch Service} |
Microsoft.Databricks/workspaces | analytics.md | {Databricks on AWS, EMR} |
Microsoft.Synapse/workspaces | fast-path: gate | Deferred — specialist engagement |
Microsoft.DataFactory/factories | fast-path: gate | Deferred — specialist engagement |
Every Microsoft.Insights/* type and Microsoft.OperationalInsights/workspaces is a
Skip Mapping with a CloudWatch fallback note (owner decision 11.6). They are still
inventoried and translated — a resource absent from the inventory cannot be reported as
skipped, and Application Insights carries an application_type and a workspace link the
report should mention. There is no target and no import path for retained telemetry.
| Canonical ARM type | Disposition |
|---|---|
Microsoft.Resources/resourceGroups | fast-path: skip — AWS account structure and tags |
Microsoft.Resources/deployments | fast-path: skip — deployment history, not infrastructure |
Microsoft.Web/certificates | fast-path: skip — ACM issues for the target’s hostnames |
A canonical type that appears in neither this file nor fast-path-services.json does
not go straight to a STOP. Two derived rules run first, both defined as data in
fast-path-services.json and both described in phases/design/design-infra.md § 2:
child_type_rule — a child type (two or more segments after the provider) whose
parent has a disposition becomes a config_source of that parent.namespace_routing — 54 provider-namespace rules route to a category rubric, a
skip, or a gate.Only if both miss does the unknown-type policy apply, and that policy is deliberately split: benign unknowns warn and continue, cost-bearing unknowns STOP.
Do not add a speculative row here to avoid a STOP. Two reasons, and the second is the
one that bites: a speculative row asserts a category nobody chose, and it also shadows
the namespace rule, which would have routed the type correctly and recorded
routing_provenance: "namespace_rule" so a reviewer could see the decision was derived.
An authored row always wins over a derived rule, so a bad row is worse than no row.
A type that reaches the STOP now has a namespace this skill does not recognise, which is a much stronger signal than “no row exists” ever was.