URL Shortener & Link Management Service  ·  View 08 of 23  ·  Structure

Container View — Two Planes

The C4 level-2 view, drawn so the plane boundary is the most visible thing on the page.

Editable source SVG draw.io All views
Azure Front Door Premium — global edge Request handling TLS and anycast shared + branded WAF and bot manager Redirect cache 30 s TTL Telemetry out Access log to Event Hubs one row per click Redirect plane — read-only, 12 regions Resolution Resolver service Container Apps Deny-set matcher in-process, 5 s refresh Routing rule engine device, geo, locale Regional read cache Hot set Redis · 97% hit Negative cache unknown codes Management plane — 2 regions, one write region Link lifecycle Link API create, edit, kill Code allocator random base62-7 Bulk importer 10k per request Tenancy and trust Domain and TLS service Screening worker Functions Review and appeal Propagation Projection publisher change feed Revocation publisher Event Grid State Authoritative Link table Cosmos DB · TTL Reservation index strong, single writer Derived and evidential Click store Data Explorer Audit log immutable Reputation feeds 3 providers Microsoft Entra ID miss write verdicts clicks Container View — Two Planes, One Link Table Interface / broker Security / platform Data store Queue / topic Application we own External / third party synchronous event / async failure / alternate Omitted for clarity: the console, the click export API, the alias claim (view 15) and the cold read from the link table (view 09). Dashed amber is propagation, dashed red is a block; the redirect plane never writes to State. v 1.0 · owner Platform Architecture · date 2026-09

The decision, drawn

  • Redirect plane: 12 regions, stateless, read-only, no write credential, rebuildable in 30 minutes.
  • Management plane: 2 regions, one write region, the only writer of the link table and the reservation index.
  • Propagation: two publishers with two different promises, inside the management plane and crossing into the redirect plane.

Sizing

  • Resolver: Container Apps, KEDA-scaled on requests per second, three zones per region.
  • Hot set: Azure Cache for Redis per region, sized for the assumed 4% 30-day working set rather than the full 12 billion links.
  • Cosmos DB: read replicas in every read region, a single write region, native TTL for expiry.

Risks

  • The single write region caps creation availability at that region's availability plus failover time; the requirement accepts this and refuses creation rather than risking a duplicate claim (ADR-05).
  • Twelve regional Redis instances are twelve things to warm. If the projection worker is not idempotent and resumable per region, a regional restart becomes a cold-cache latency incident.
◀  Layered Architecture All views Inside a Resolution  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-09 · 23 views · 16 architecture decision records08-container-view