We don’t just advise on Azure architecture. We build on it. cloudmechanix.com is a working example of the decisions we ask clients to make: where to spend on security, where cost discipline is free, and where “good enough” is the honest answer. We rebuilt it from a tired WordPress blog into a static Azure site because the old stack couldn’t demonstrate any of that. This post walks the architecture, the Zero Trust and NIS2 choices behind it, and what it costs to run — including the trade-offs, and the one thing that surprised us.
The architecture
The stack is deliberately small. Here is the whole thing on one page.
The architecture at a glance: traffic enters through Front Door, is filtered by the WAF, and reaches Static Web Apps serving platform-managed static content. Every component is monitored; the subscription is governed by Policy and Cost Management.
Azure Front Door (Standard) is the only public entry point — it terminates TLS, absorbs volumetric DDoS, caches at the edge and fronts our custom domain. Behind it, the Front Door WAF runs in Prevention mode. Traffic that clears the WAF reaches Azure Static Web Apps, which serves the pre-built site from platform-managed storage. We didn’t stand up a separate storage account or CDN, and that absence is a feature, not a gap.
We chose Static Web Apps over App Service on purpose. A static build has no server runtime to patch, no application pool to size and no idle compute to pay for — the attack surface and the bill both shrink. Front Door stayed on Standard, not Premium: the managed rule sets and bot protection are real, but for a brochure-and-blog site with one form they didn’t justify the monthly step-up, so we wrote the WAF rules we actually needed.
Everything is defined in Bicep and deployed from GitHub Actions using Entra workload-identity federation (OIDC) — there are no long-lived cloud credentials in the repository. Application Insights and Log Analytics collect telemetry from every layer, and Azure Policy plus Cost Management sit across the subscription. Nothing here is exotic. That’s the point.
Security and Zero Trust
Zero Trust gets framed as an internal-systems problem. It applies just as cleanly to a public website — you just move the trust boundaries.
The one that matters most here is the origin. Static Web Apps is locked so it only accepts traffic carrying our specific Front Door instance header (X-Azure-FDID) from Front Door’s backend range; the raw *.azurestaticapps.net URL returns 403. The site doesn’t trust that a request “came from inside Azure” — it verifies the exact edge it is meant to sit behind. That’s Zero Trust, not network trust.
Human access follows the same rule: Entra ID with RBAC and MFA, no standing broad roles, and deploys that run as a federated identity rather than a shared secret. The contact form’s backend authenticates to Microsoft Graph with a managed identity holding one permission — Mail.Send — scoped by an Exchange policy to a single mailbox. There is no secret anywhere to leak.
WAF rules alone don’t create security — they buy you time to respond. So we were honest about scope: no private endpoints or VNet, because there is nothing private to reach; and no Key Vault, because the strongest credential is the one that doesn’t exist. We deployed less, and that made it safer.
NIS2 compliance
NIS2 compliance shaped the monitoring and logging layer from day one, ahead of transposition timelines that vary across the EU. Every component — Front Door, WAF, Static Web Apps, the API — ships telemetry to Log Analytics, and the WAF’s event logs are retained where we can query them with KQL. That isn’t box-ticking: it’s how we validated the rate-limit threshold before switching the WAF from Detection to Prevention.
The governance state is demonstrable, too. Policy assignments and Cost Management give an auditor a defined control-and-spend picture, and because the whole estate is infrastructure as code, every change has a pull request behind it — change control for free. Incident-response readiness is the same discipline: a locked origin, queryable logs and a known-good deployment you can rebuild in minutes.
Is a marketing site in NIS2 scope the way a client’s production estate is? No. We built it to NIS2 standards because a reference implementation should hold to the standard we’re advising on — from Ireland, across the EU. The readiness cost here is mostly log ingestion and retention — a deliberate spend, not an accident.
Cost optimisation
The whole thing runs in the low tens of euros a month, and the largest single line is Front Door Standard’s base fee — not compute, because there effectively isn’t any. Static Web Apps is a low flat fee; the contact API runs on Consumption and costs almost nothing between enquiries.
There are no Reserved Instances and no autoscaling here, and that’s the honest headline: you can’t reserve compute you don’t run, and there is nothing to scale. The real performance-and-cost lever is caching — Front Door edge caching plus immutable, fingerprinted assets — which we tuned rather than throwing bigger tiers at.
What we didn’t negotiate on was observability and the security perimeter. Log ingestion and the WAF are the two lines we could trim to save a few euros, and the two we chose to keep. Cutting them saves money you would give straight back the first time you had to investigate something.
Key learnings
A few things worth taking to your own estate.
Governance matters even at one subscription. The boundary, the policy state and the tag standard are what make a small deployment auditable — landing-zone thinking isn’t only for large environments.
Observability has to be built in, not bolted on. We only trusted Prevention mode because Detection-mode logs proved the threshold first. You can’t tune what you don’t measure.
Compliance and cost aren’t enemies when you design them together. The cheapest architecture here — static, serverless, no always-on compute — is also the smallest attack surface and the easiest to evidence. They pulled in the same direction.
And secretless beats secret management. Managed identity and OIDC removed a whole class of things that can leak. The credential you never stored is the one you never rotate, and never lose.
Talk to us
Running Azure? You’re making the same calls — where to spend, where to simplify, where “good enough” is right. We can help you get them right.
Book a consultation to talk it through, or get your architecture reviewed — a fixed-scope Azure Environment Review against the Well-Architected Framework, with a prioritised remediation plan you keep.