Clinical notes pipeline

Well-Architected review Clinical notes pipeline · 2026-10-02 · mode full

Coverage audit

• Azure Well-Architected Framework — 5 pillars, 59 recommendations, from the live documentation index, snapshot 2026-10-02 (0 days old).
• Assessed 59 recommendations: 8 with diagram evidence, 51 cannot be determined.
• Evidence sources: architecture diagram (services, boundaries, relationships); cost estimate from the Azure Retail Prices API.
• Corpus read from a committed snapshot of the live documentation index (not re-fetched during this review). Re-read it with `archify-azure wa corpus --refresh`. Statuses reflect what the diagram and spec show. Process, configuration and runtime evidence are not observable here, so those recommendations are 'Cannot Determine' rather than guessed.

Executive summary

This Azure Well-Architected Framework review of Clinical notes pipeline (standard criticality) assessed the architecture diagram only. 8 of 59 framework recommendations have diagram evidence; the rest are Cannot Determine because process, configuration and runtime evidence is not in the diagram. It found 0 critical, 0 high, 2 medium and 0 low risks. Estimated run cost is $1,390/month (indicative).

8 of 59 recommendations have diagram evidence (14%); among those, 0 implemented, 2 partial, 6 not implemented. Provisional: scores cover evidenced practices only.

Strengths. Data stores are not placed in public subnets.

Architecture overview

The reviewed architecture is the Diagram tab (8 components, dataflow diagram). Hover a finding to highlight the components involved.

Pillar scorecard

Score = 1 + 4 × (implemented + ½ partial) ÷ evidenced recommendations; shown only when ≥ 3 recommendations are evidenced. It reflects evidenced practices, not the whole pillar.

Recommendation ledger 59 recommendations — nothing truncated

Findings

Medium risk (2)

To confirm not drawn, so not counted as gaps

• No private endpoints shown for PaaS data services SE:06, SE:04 — Disable public network access on PaaS data services (Storage, SQL, Cosmos DB, Key Vault) and connect through Azure Private Link private endpoints with private DNS zones.
• No Azure Key Vault shown for data at rest SE:07 — Manage encryption keys in Azure Key Vault (customer-managed keys where you need rotation, access policy or audit control) and enforce encryption at rest and TLS in transit on every data store.
• No identity / authentication service shown SE:05 — Authenticate and authorize every request through Microsoft Entra ID with conditional access, MFA and least-privilege RBAC; use managed identities for workload-to-workload access.
• No threat detection or posture management shown SE:10, SE:01 — Enable Microsoft Defender for Cloud and Microsoft Sentinel, assign Azure Policy initiatives for the baseline, and send activity and diagnostic logs to a central, access-restricted Log Analytics workspace.
• No Key Vault or managed identity shown for database credentials SE:09 — Use managed identities with Entra authentication for databases, and keep any remaining secrets in Azure Key Vault with rotation.
• No backup or recovery capability shown RE:09 — Protect data with Azure Backup (vault with soft delete and cross-region restore where required) or database point-in-time restore, and test restores against your RPO/RTO.
• No infrastructure-as-code or CI/CD shown OE:05, OE:11 — Define infrastructure as code (Bicep or Terraform) and deploy through a pipeline with small, reversible changes, environment promotion and automated rollback.
• No cost visibility shown CO:03, CO:04, CO:01 — Set Microsoft Cost Management budgets with alert thresholds and enforce cost-allocation tags (Azure Policy) so spend maps to this workload.

Eisenhower prioritization

Prioritized remediation plan

Next steps

1. Add the missing process, configuration and runtime evidence to turn Cannot Determine practices into assessed ones.
2. Re-run the review after changes, and when the architecture or documentation changes.

Impact × Likelihood matrix from the AWS well-architected-review skill, applied to the Azure Well-Architected Framework (Severe+High = Critical; Severe+Medium/Low or Moderate+High = High; Moderate+Medium/Low or Minor+High = Medium; otherwise Low).