terraform — architecture from terraform

Cost estimate eastus · price list as of 2026-10-02 · indicative — some usage is assumed

$785per month

$9,417per year

8/8components priced

0not priced (see below)

Public pay-as-you-go list prices from the Azure Retail Prices API (USD). Excludes taxes, support plans, Reservations, Savings Plans, Spot and enterprise or EA discounts, and data transfer unless a node sets egressGbPerMonth. Free grants are included where the meter has a free tier. Monthly = 730 hours. Not a quote: confirm with the Azure Pricing Calculator.

Show monthly cost on the diagram

By category

Integration$699 · 89%

Data and storage$73.88 · 9%

Security and operations$11.80 · 2%

Compute$0.00 · 0%

By component click a row to highlight it on the diagram

Component	Service	Status	$ / month	Line items
Apim	API Management Services	estimated	$687	1 line Standard unit-hours: 730 1 Hour × $0.9407 = $686.711
Db	Azure Cosmos DB	estimated	$70.90	2 lines Provisioned 100 RU/s units (hours): 7,300 1/Hour × $0.008 = $58.40 Transactional storage (GB-month): 50 1 GB/Month × $0.25 = $12.50 Single-region writes, standard provisioned or autoscale throughput. Serverless, multi-region writes, backup and analytical storage are not modelled.
Ai	Application Insights	estimated	$11.50	1 line Data ingestion (GB): 10 1 GB × $0.00 (tiered) = $11.50 Pay-as-you-go ingestion with the monthly free allowance in the tier; commitment tiers are not modelled.
Bus	Azure Service Bus	estimated	$10.00	2 lines Standard base charge (month): 1 1/Month × $10.00 = $10.00 Standard messaging operations: 5 1M × $0.00 = $0.00
Uploads	Storage Accounts	estimated	$2.98	3 lines Data stored, Hot LRS (GB-month): 100 1 GB/Month × $0.00 = $2.08 Write operations: 10 10K × $0.05 = $0.50 Read operations: 100 10K × $0.004 = $0.40 Excludes data retrieval and early-deletion charges, egress and transactions on other APIs.
Uploads	Event Grid Topics	estimated	$2.40	1 line Event operations: 5 1M × $0.00 (tiered) = $2.40 The first million operations per month are free (in the tiered meter).
Kv	Key Vaults	estimated	$0.30	1 line Secret and key operations: 10 10K × $0.03 = $0.30 Standard tier software-protected keys; HSM keys and certificates are not modelled.

Not priced

Api — estimated: Consumption plan; the monthly free grant is included in the tiered meters.

Assumptions 23 defaulted — replace them with your own numbers in each node's `usage`

Component	Assumption	Value	Source
Ai	ingestGbPerMonth	10	assumed
Ai	retentionDays	31	assumed
Ai	retainedGb	10	assumed
Apim	tier	standard	assumed
Apim	units	1	assumed
Uploads	operationsPerMonth	5000000	assumed
Api	plan	consumption	assumed
Api	requestsPerMonth	1000000	assumed
Api	avgDurationMs	200	assumed
Api	memoryMb	512	assumed
Bus	tier	standard	assumed
Bus	operationsPerMonth	5000000	assumed
Kv	operationsPerMonth	100000	assumed
Db	mode	provisioned	assumed
Db	ruPerSecond	1000	assumed
Db	storageGb	50	assumed
Db	hoursPerMonth	730	assumed
Db	regions	1	assumed
Uploads	accessTier	hot	assumed
Uploads	redundancy	LRS	assumed
Uploads	storageGb	100	assumed
Uploads	writeOperationsPerMonth	100000	assumed
Uploads	readOperationsPerMonth	1000000	assumed

Sensitivity & what-if

$785at 1× traffic

$870at 3× traffic

$1,202at 10× traffic

No what-if options apply to these services.

Price list provenance

Retrieved 2026-10-02T10:01:47.868Z from the public Azure Retail Prices API. Latest price effective dates per service:

Log Analytics 2018-02-01 · API Management 2024-12-01 · Event Grid 2023-09-01 · Functions 2024-12-01 · Service Bus 2024-10-01 · Key Vault 2022-03-01 · Azure Cosmos DB 2026-10-01 · Storage 2026-09-01

Only public pay-as-you-go list prices are used. This is not a quote — confirm in the Azure Pricing Calculator.

Well-Architected review terraform — architecture from terraform · 2026-10-02 · mode full

Coverage audit

Azure Well-Architected Framework — 5 pillars, 59 recommendations, from the live documentation index, snapshot 2026-10-02 (0 days old).
Assessed 59 recommendations: 10 with diagram evidence, 48 cannot be determined.
Evidence sources: architecture diagram (services, boundaries, relationships); cost estimate from the Azure Retail Prices API.
Corpus read from a committed snapshot of the live documentation index (not re-fetched during this review). Re-read it with `archify-azure wa corpus --refresh`. Statuses reflect what the diagram and spec show. Process, configuration and runtime evidence are not observable here, so those recommendations are 'Cannot Determine' rather than guessed.

Executive summary

This Azure Well-Architected Framework review of terraform — architecture from terraform (standard criticality) assessed the architecture diagram only. 10 of 59 framework recommendations have diagram evidence; the rest are Cannot Determine because process, configuration and runtime evidence is not in the diagram. It found 0 critical, 0 high, 1 medium and 0 low risk. Estimated run cost is $785/month (indicative).

0Critical

0High

1Medium

0Low

3.0provisional maturity (1–5)

10 of 59 recommendations have diagram evidence (17%); among those, 5 implemented, 3 partial, 2 not implemented. Provisional: scores cover evidenced practices only.

Strengths. Data stores are not placed in public subnets; Key management shown; Secrets / passwordless access shown; Observability shown; Distributed tracing; Design-time cost model.

Architecture overview

The reviewed architecture is the Diagram tab (8 components, architecture diagram). Hover a finding to highlight the components involved.

Pillar scorecard

Pillar	Score (1–5)	Evidenced recommendations	I · P · N · NA · CD	Strongest area	Main gap
Reliability	—	1/10 (10%)	1 0 0 1 8	—	No gaps evidenced in the diagram
Security	3.0	6/12 (50%)	2 2 2 0 6	Data stores are not placed in public subnets	Internet-facing entry has no WAF / DDoS protection shown
Cost Optimization	—	1/14 (7.1%)	1 0 0 0 13	Design-time cost model	No gaps evidenced in the diagram
Operational Excellence	—	1/11 (9.1%)	1 0 0 0 10	Observability shown	No gaps evidenced in the diagram
Performance Efficiency	—	1/12 (8.3%)	0 1 0 0 11	—	No gaps evidenced in the diagram

Score = 1 + 4 × (implemented + ½ partial) ÷ evidenced recommendations; shown only when ≥ 3 recommendations are evidenced. It reflects evidenced practices, not the whole pillar.

Recommendation ledger 59 recommendations — nothing truncated

ID	Pillar	Best practice	Status	Evidence
RE:01	Reliability	Focus your workload design on simplicity and efficiency.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
RE:02	Reliability	Identify and rate user and system flows.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
RE:03	Reliability	Use failure mode analysis (FMA) to identify potential failures in your workload.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
RE:04	Reliability	Define reliability and recovery targets	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
RE:05	Reliability	Add redundancy at different levels, especially for critical flows	Not Applicable	No on-premises or private-link connectivity is drawn.
RE:06	Reliability	Implement a timely and reliable scaling strategy at the application, data, and infrastructure levels	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
RE:07	Reliability	Strengthen the resiliency of your workload by implementing self-preservation and self-healing measures	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
RE:08	Reliability	Test for resiliency and availability scenarios by applying the principles of chaos engineering.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
RE:09	Reliability	Implement structured, tested, and documented disaster recovery (DR) plans	Cannot Determine	Diagram: No backup or recovery capability shown. Define RPO/RTO and protect data with Azure Backup, point-in-time restore, geo-replication or Site Recovery, and test restores.
RE:10	Reliability	Continuously measure and track system health using uptime and reliability indicators	Implemented	Diagram: Observability shown. Nodes: ai. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes.
SE:01	Security	Establish a security baseline	Cannot Determine	Diagram: No threat detection or posture management shown. Enable Microsoft Defender for Cloud and Microsoft Sentinel (and Azure Policy) for posture management, threat detection and response; send activity logs to a central workspace.
SE:02	Security	Align secure development lifecycle (SDL) throughout the software development lifecycle	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
SE:03	Security	Classify and consistently apply sensitivity and information type labels	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
SE:04	Security	Create intentional segmentation and perimeters	Partially Implemented	Diagram: Data stores are not placed in public subnets. Least-privilege network placement for stateful services. Diagram: No private endpoints shown for PaaS data services. Disable public network access on PaaS data services and reach them through Azure Private Link private endpoints inside your virtual network.
SE:05	Security	Implement strict, conditional, and auditable identity and access management (IAM)	Cannot Determine	Diagram: No identity / authentication service shown. Authenticate and authorize every request with Microsoft Entra ID (conditional access, RBAC) and use managed identities instead of stored credentials.
SE:06	Security	Isolate, filter, and control network traffic	Not Implemented	Diagram: Internet-facing entry has no WAF / DDoS protection shown. Nodes: apim. Protect public entry points (Front Door, Application Gateway, API Management) with Azure Web Application Firewall and DDoS Protection, and restrict origins to the front end. Diagram: No private endpoints shown for PaaS data services. Disable public network access on PaaS data services and reach them through Azure Private Link private endpoints inside your virtual network.
SE:07	Security	Encrypt data by using modern, industry-standard methods	Implemented	Diagram: Key management shown. Nodes: kv. Encrypt data at rest and in transit; use Azure Key Vault customer-managed keys where you need key rotation, access policy or audit control.
SE:08	Security	Harden all workload components	Not Implemented	Diagram: Internet-facing entry has no WAF / DDoS protection shown. Nodes: apim. Protect public entry points (Front Door, Application Gateway, API Management) with Azure Web Application Firewall and DDoS Protection, and restrict origins to the front end.
SE:09	Security	Protect application secrets	Implemented	Diagram: Secrets / passwordless access shown. Nodes: kv. Store secrets in Azure Key Vault or, better, connect with managed identities and Entra authentication so no credentials are embedded.
SE:10	Security	Implement a holistic monitoring strategy	Partially Implemented	Diagram: No threat detection or posture management shown. Enable Microsoft Defender for Cloud and Microsoft Sentinel (and Azure Policy) for posture management, threat detection and response; send activity logs to a central workspace. Diagram: Observability shown. Nodes: ai. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes.
SE:11	Security	Establish a comprehensive testing regimen	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
SE:12	Security	Define and test effective incident response procedures	Cannot Determine	Not observable from the architecture diagram; needs process or organizational evidence.
CO:01	Cost Optimization	Create a culture of financial responsibility.	Cannot Determine	Diagram: No cost visibility shown. Tag resources, set Microsoft Cost Management budgets and alerts so spend maps to workloads and owners.
CO:02	Cost Optimization	Create and maintain a cost model.	Implemented	A design-time cost model was generated from the Azure Retail Prices API: 8 of 8 billable components priced, $784.79/month pay-as-you-go (indicative; volumes partly assumed).
CO:03	Cost Optimization	Collect and review cost data.	Cannot Determine	Diagram: No cost visibility shown. Tag resources, set Microsoft Cost Management budgets and alerts so spend maps to workloads and owners.
CO:04	Cost Optimization	Set spending guardrails.	Cannot Determine	Diagram: No cost visibility shown. Tag resources, set Microsoft Cost Management budgets and alerts so spend maps to workloads and owners.
CO:05	Cost Optimization	Get the best rates from providers.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
CO:06	Cost Optimization	Align usage to billing increments.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
CO:07	Cost Optimization	Optimize component costs.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
CO:08	Cost Optimization	Optimize environment costs.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
CO:09	Cost Optimization	Optimize flow costs.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
CO:10	Cost Optimization	Optimize data costs.	Cannot Determine	Data transfer (bandwidth) is excluded from the estimate because no node sets egressGbPerMonth; model it before launch.
CO:11	Cost Optimization	Optimize code costs.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
CO:12	Cost Optimization	Optimize scaling costs.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
CO:13	Cost Optimization	Optimize personnel time.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
CO:14	Cost Optimization	Consolidate resources and responsibility.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
OE:01	Operational Excellence	Define your standard practices to develop and operate your workload.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
OE:02	Operational Excellence	Use standardization as a way to make routine, ad-hoc, and emergency operations consistent and predictable.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
OE:03	Operational Excellence	Formalize processes across the full software development lifecycle, from ideation to delivery, and make them transparent to the team and stakeholders.	Cannot Determine	Not observable from the architecture diagram; needs process or organizational evidence.
OE:04	Operational Excellence	Enhance software development and quality assurance	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
OE:05	Operational Excellence	Use a standardized infrastructure as code (IaC) approach to prepare resources and configurations.	Cannot Determine	Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code (Bicep or Terraform) and deploy through a pipeline (GitHub Actions or Azure Pipelines) with small, reversible changes and safe deployment practices.
OE:06	Operational Excellence	Build a workload supply chain that drives changes	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
OE:07	Operational Excellence	Design a monitoring stack	Implemented	Diagram: Observability shown. Nodes: ai. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. Application tracing/telemetry is drawn (ai).
OE:08	Operational Excellence	Establish a clear, structured incident management process	Cannot Determine	Not observable from the architecture diagram; needs process or organizational evidence.
OE:09	Operational Excellence	Enhance the quality of your workload	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
OE:10	Operational Excellence	Design automation to be reliable, secure, and maintainable	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
OE:11	Operational Excellence	Clearly define your workload's safe deployment practices.	Cannot Determine	Diagram: No infrastructure-as-code or CI/CD shown. Define infrastructure as code (Bicep or Terraform) and deploy through a pipeline (GitHub Actions or Azure Pipelines) with small, reversible changes and safe deployment practices.
PE:01	Performance Efficiency	Define performance targets.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
PE:02	Performance Efficiency	Conduct capacity planning.	Cannot Determine	Not observable from the architecture diagram; needs process or organizational evidence.
PE:03	Performance Efficiency	Select the right services.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
PE:04	Performance Efficiency	Establish consistent performance measurement	Partially Implemented	Diagram: Observability shown. Nodes: ai. Collect metrics, logs and traces with Azure Monitor, Application Insights and Log Analytics, and define alerts tied to business outcomes. Application tracing/telemetry is drawn (ai).
PE:05	Performance Efficiency	Optimize scaling and partitioning.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
PE:06	Performance Efficiency	Optimize your workload's performance by regularly testing in a production-like environment	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
PE:07	Performance Efficiency	Optimize code and infrastructure.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
PE:08	Performance Efficiency	Optimize data usage.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
PE:09	Performance Efficiency	Prioritize the performance of critical flows.	Cannot Determine	Not observable from the architecture diagram; needs process or organizational evidence.
PE:10	Performance Efficiency	Optimize operational tasks.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
PE:11	Performance Efficiency	Respond to live performance issues.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.
PE:12	Performance Efficiency	Continuously optimize performance.	Cannot Determine	Not observable from the architecture diagram; needs runtime or operational evidence.

Findings

Medium risk (1)

F-001 Medium Internet-facing entry has no WAF / DDoS protection shown · Security · SE:06, SE:08

Evidence. Diagram: Internet-facing entry has no WAF / DDoS protection shown. Nodes: apim. Protect public entry points (Front Door, Application Gateway, API Management) with Azure Web Application Firewall and DDoS Protection, and restrict origins to the front end.

Impact × likelihood. Moderate × Medium → Medium. Status: Not Implemented.

Recommendation. Put Azure Web Application Firewall (on Front Door or Application Gateway) and DDoS Protection in front of every internet-facing entry point; start in detection mode, then enforce.

Priority. Delegate · effort Low · owner Security engineering

To confirm not drawn, so not counted as gaps

No private endpoints shown for PaaS data services SE:06, SE:04 — Disable public network access on PaaS data services (Storage, SQL, Cosmos DB, Key Vault) and connect through Azure Private Link private endpoints with private DNS zones.
No identity / authentication service shown SE:05 — Authenticate and authorize every request through Microsoft Entra ID with conditional access, MFA and least-privilege RBAC; use managed identities for workload-to-workload access.
No threat detection or posture management shown SE:10, SE:01 — Enable Microsoft Defender for Cloud and Microsoft Sentinel, assign Azure Policy initiatives for the baseline, and send activity and diagnostic logs to a central, access-restricted Log Analytics workspace.
No backup or recovery capability shown RE:09 — Protect data with Azure Backup (vault with soft delete and cross-region restore where required) or database point-in-time restore, and test restores against your RPO/RTO.
No infrastructure-as-code or CI/CD shown OE:05, OE:11 — Define infrastructure as code (Bicep or Terraform) and deploy through a pipeline with small, reversible changes, environment promotion and automated rollback.
No cost visibility shown CO:03, CO:04, CO:01 — Set Microsoft Cost Management budgets with alert thresholds and enforce cost-allocation tags (Azure Policy) so spend maps to this workload.

Cross-pillar trade-offs

Observability volume Operational Excellence ↔ Cost Optimization
Log Analytics is $11.50/month in this estimate, mostly log ingestion; richer telemetry improves detection but ingestion is billed per GB. Resolution: Sample verbose traces, set retention per table (Basic logs for high-volume, low-value data) and keep full-fidelity logs for security and audit sources only.

Eisenhower prioritization

Do First

None

Plan

None

Delegate

F-001 Internet-facing entry has no WAF / DDoS protection shown

Defer

None

Prioritized remediation plan

ID	Risk	Quadrant	SMART goal	Owner
F-001	Medium	Delegate	By 2026-10-16 (2 weeks): Put Azure Web Application Firewall (on Front Door or Application Gateway) and DDoS Protection in front of every internet-facing entry point; start in detection mode, then enforce. Success measure: 100% of public endpoints behind a WAF policy with diagnostic logging enabled	Security engineering

Next steps

Add the missing process, configuration and runtime evidence to turn Cannot Determine practices into assessed ones.
Re-run the review after changes, and when the architecture or documentation changes.

Impact × Likelihood matrix from the AWS well-architected-review skill, applied to the Azure Well-Architected Framework (Severe+High = Critical; Severe+Medium/Low or Moderate+High = High; Moderate+Medium/Low or Minor+High = Medium; otherwise Low).

Cost estimate eastus · price list as of 2026-10-02 · indicative — some usage is assumed

By category

By component click a row to highlight it on the diagram

Not priced

Assumptions 23 defaulted — replace them with your own numbers in each node's usage

Sensitivity & what-if

Price list provenance

Well-Architected review terraform — architecture from terraform · 2026-10-02 · mode full

Coverage audit

Executive summary

Architecture overview

Pillar scorecard

Recommendation ledger 59 recommendations — nothing truncated

Findings

Medium risk (1)

To confirm not drawn, so not counted as gaps

Cross-pillar trade-offs

Eisenhower prioritization

Do First

Plan

Delegate

Defer

Prioritized remediation plan

Next steps

Assumptions 23 defaulted — replace them with your own numbers in each node's `usage`