URL Shortener & Link Management Service  ·  View 18 of 23  ·  Operations

Deployment Architecture

Twelve read regions that hold no state of their own, two write regions that hold all of it.

Editable source SVG draw.io All views
Azure Front Door Premium — 190+ PoPs, one anycast address set Every PoP Anycast TLS shared + 12k branded WAF and bot rules Response cache 30 s Read regions — 12, identical, stateless West Europe (example read region) Resolver · Container Apps 3 zones, KEDA on RPS Azure Cache for Redis zone-redundant Cosmos DB read replica in-region 11 further read regions Same three components no regional state of its own Write regions — North Europe (primary) and East US 2 (standby) Primary Management plane Container Apps Cosmos DB write region single writer Screening and publishers Functions Standby Management plane warm, scaled to 1 Cosmos failover target RTO ≤ 5 min for writes Shared platform services Identity and secrets Entra ID workload identity Key Vault per-region replica Telemetry and analytics Event Hubs geo-paired Azure Data Explorer 2 clusters Azure Monitor SRE and deployment GitHub Actions origin group, latency based replication ≤ 5 s access log warm and deny-set failover pair Deployment — Global Read Path, Two Write Regions Interface / broker Security / platform Data store Application we own Queue / topic Person or role synchronous event / async two-way Losing the primary write region stops link creation and editing; it does not stop a single redirect. That asymmetry is the deployment expressing the plane split. v 1.0 · owner Platform Architecture · date 2026-09

The asymmetry is the point

  • Losing the primary write region stops link creation and editing. It does not stop a single redirect anywhere in the world.
  • A read region is disposable: three components, no unique state, and its cache rebuilt from the link table.
  • Front Door's origin selection is latency-based, so removing a read region is a capacity decision rather than a failover event.

Sizing and recovery

  • Resolver: three zones per region, scaled on requests per second, provisioned for 4× the steady rate to absorb the assumed peak.
  • Cosmos DB: single write region, replicas in all read regions, replication ≤ 5 s, write RTO ≤ 5 min on failover.
  • Derived state (hot set, deny-set, negative cache) fully rebuildable within 30 minutes with no operator input.

Assumptions

  • 12 read regions is a placement assumption chosen to hold the 40 ms p99 for the assumed traffic distribution; it is the first number to revisit against real geography.
  • Two write regions rather than multi-region writes, because multi-region writes would require conflict resolution on the one operation that cannot tolerate it (ADR-05).
◀  Click Analytics Pipeline All views Release Pipeline  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-09 · 23 views · 16 architecture decision records18-deployment-architecture