This implementation combines several design patterns, such as global routing, offloading, and health endpoint monitoring, to provide a secure ingress for HTTP/HTTPS applications. Traffic enters through Azure Front Door, passes the web application firewall, and reaches backend services over Private Link without a public IP. The request and operational flows are laid out below, along with the cost and operations trade-offs of the Premium tier.
Key Requirements
- Global routing: Able to redirect requests to different regions.
- Low-latency failover: Quickly identify failed workloads and adjust routing within minutes.
- Mitigating attacks at the edge: Ensure PaaS services cannot be reached directly from the internet; all traffic must pass through a secured gateway.
Applied Design Patterns
- Gateway Routing: Routes requests to multiple services or service instances across regions.
- Gateway Offloading: Pushes functions such as attack prevention onto a gateway proxy (WAF).
- Health Endpoint Monitoring: Exposes endpoints for checking the operational state of the system.
Main Architecture Components
- Azure Front Door (Premium): Acts as the global gateway, supporting layer-7 load balancing and secure connectivity through Private Link.
- Azure Web Application Firewall (WAF): Inspects and blocks malicious HTTP/HTTPS traffic before it reaches the backend.
- Azure Private Link: Provides private connectivity from Front Door to backend services (such as Storage and ILB) without exposing public IPs.
- Azure Storage (Blob): Stores static content and serves as the origin for web requests.
- Internal Load Balancer (ILB): Distributes internal traffic for private workloads.
Web Request Flow
- The user sends an HTTP/HTTPS request to the Azure Front Door endpoint.
- The WAF evaluates the security rules. If a rule is violated, the request is blocked.
- Front Door matches the route and selects the appropriate Origin Group.
- A specific Origin is chosen based on the results of the health probes.
- The request is forwarded to the backend through Private Link over the Microsoft backbone network.
Operational Flow
To manage the system securely without opening internet-facing ports:
- Use Azure Bastion to connect over SSH/RDP to a jump box VM inside the virtual network (VNET).
- The jump box VM accesses resources (such as the storage account) through a Private Endpoint and a Private DNS Zone.
Considerations
- Reliability: Use health probes to automatically remove failed regions.
- Security: Private Link completely removes public internet exposure for backend services.
- Cost: Azure Front Door Premium and WAF Premium cost more than the Standard tier but provide advanced security.
- Operations: You must manage self-hosted agents inside the VNET if you want to deploy CI/CD (DevOps) into network-secured resources.
Source: Azure Architecture Center - Network secure ingress
See also: Gateway Routing Pattern · Gateway Offloading Pattern · Health Endpoint Monitoring Pattern