Waf Checklist

Reliability

• Zone redundancy enabled for production SKUs (App Service P1v3+, SQL Premium, Redis Premium)
• Health probes configured (Container Apps liveness/readiness, App Service /health)
• GRS storage for production data (Standard_GRS or RA-GRS)
• Retry policies in application code for transient failures
• Min replicas ≥ 1 for production Container Apps (no cold-start)

Security

• System-assigned managed identity on all services
• Key Vault for all secrets (no inline connection strings)
• HTTPS-only + TLS 1.2+ on all endpoints
• No public blob access on storage accounts
• Private endpoints where budget allows (balanced/performance tiers)
• No administratorLogin for SQL (Entra-only auth)

Cost Optimization

• SKU matches prepare-plan.json budget tier — no over-provisioning
• Scale-to-zero enabled for dev/test Container Apps
• Free tier grants applied in cost estimate (see pricing-guide.md § Free Grants Summary)
• Reserved instances noted as option for production (don’t auto-apply)

Operational Excellence

• diagnostic-settings is not scaffolded; if the generator added one it MUST be gated behind enableDiagnostics (default false) or absent — never wired unconditionally (that blocks the first deploy).
• Application Insights connected for APM
• Resource tagging: app-onboard-skill, app-onboard-session-id, created-at (see bicep-patterns.md § Service Tagging or terraform-patterns.md § Resource Tags)
• All configurable values parameterized (no hardcoded regions, names, SKUs)

Performance Efficiency

• Autoscale rules for production SKUs (Container Apps max replicas, App Service auto-scale)
• CDN for static assets when SPA frontend detected
• Connection pooling for database access
• Appropriate cache tier (Redis) when session/cache pattern detected