Governance Policies Azure Web Static Web Apps - Azure/az-prototype GitHub Wiki

Static Web Apps

Governance policies for Static Web Apps

Domain: azure-web

Patterns

Name Description
Static Web App with linked backend and custom auth Standard SWA with managed identity, linked backend API, and Entra ID authentication

Anti-Patterns

Description Instead
Do not use Free tier for production workloads Use Standard SKU which provides SLA, private endpoints, and enterprise features
Do not rely on default GitHub auth for enterprise applications Configure custom authentication with Microsoft Entra ID in staticwebapp.config.json

References

Checks (4)

Check Severity Description
AZ-SWA-001 Required Deploy Azure Static Web Apps with Standard SKU, managed identity, and enterprise-grade auth
AZ-SWA-002 Required Configure custom authentication with identity providers in staticwebapp.config.json
AZ-SWA-003 Recommended Enable enterprise-grade CDN for global content distribution
AZ-SWA-004 Recommended Configure custom domain with managed SSL certificate

AZ-SWA-001

Deploy Azure Static Web Apps with Standard SKU, managed identity, and enterprise-grade auth

Severity: Required
Rationale: Standard SKU enables custom auth, private endpoints, and enterprise features; managed identity secures backend API connections
Agents: terraform-agent, bicep-agent, cloud-architect

Targets

  • Microsoft.Web/staticSites

Companion Resources

Resource Name Purpose
Microsoft.Web/staticSites/config appsettings Application settings for backend API configuration — never embed secrets directly
Microsoft.Network/privateEndpoints pe-swa Private endpoint for Static Web App (Standard SKU only)
Microsoft.Network/privateDnsZones privatelink.azurestaticapps.net Private DNS zone for Static Web App private endpoint resolution
Microsoft.Web/staticSites/linkedBackends linked-backend Linked backend API (e.g., Container Apps, Functions) for managed API routing

AZ-SWA-002

Configure custom authentication with identity providers in staticwebapp.config.json

Severity: Required
Rationale: Default GitHub auth is insufficient for enterprise; custom auth enables Entra ID and other IdPs
Agents: terraform-agent, bicep-agent, cloud-architect, app-developer, csharp-developer, python-developer

Targets

  • Microsoft.Web/staticSites

AZ-SWA-003

Enable enterprise-grade CDN for global content distribution

Severity: Recommended
Rationale: Enterprise CDN provides edge caching, WAF integration, and custom domains with managed certificates
Agents: terraform-agent, bicep-agent, cloud-architect

Targets

  • Microsoft.Web/staticSites

AZ-SWA-004

Configure custom domain with managed SSL certificate

Severity: Recommended
Rationale: Managed certificates auto-renew and eliminate manual certificate management
Agents: terraform-agent, bicep-agent, cloud-architect

Targets

  • Microsoft.Web/staticSites
⚠️ **GitHub.com Fallback** ⚠️