Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Sound Architecture in the Cloud: the Well-Architected Framework, Backup and DR, Lock-in and IaC as the Next Step
Sound architecture in the cloud means asking a workload the five Well-Architected pillars regularly, turning RPO and RTO into written targets and testing backups by restoring them. We review Bookstore against the five pillars and cover what zone redundancy and failover groups do and don't save, a real restore drill, a conscious approach to lock-in, landing zones, the move to IaC and the end-of-series checklist.
Cost Management in the Cloud: Pricing Models, Budget Alerts, Cost Allocation with Tags and Common Money-Losing Mistakes
The way to keep a cloud bill under control is to know what you pay for item by item, set up a budget on day one and tag every resource. We calculate Bookstore's monthly cost from real list prices in the Retail Prices API and cover reservations and savings plans, why a budget doesn't stop spending, FOCUS exports, the FinOps cycle and why a stopped App Service keeps billing.
Cloud Networking Basics: VNets, Subnets, NSGs, Private Endpoints and Taking Your App Off the Public Internet
To take a PaaS app off the internet, you route outbound traffic into the VNet with VNet integration, give the database and storage private IPs with private endpoints, link the private DNS zone to the VNet and close public access last. We check Bookstore's address plan with a tool and cover NSG rules, NAT gateway, why DNS is the real trap, the cost and the AWS VPC equivalents.
Managed Databases: Choosing Between Azure SQL Database, PostgreSQL Flexible Server and Cosmos DB, Backups and Connection Resilience
Azure SQL Database is the right choice for BookstoreDb because it needs no instance features: the free offer in dev, zone-redundant General Purpose in production. With real measurements we compare Managed Instance, PostgreSQL Flexible Server and Cosmos DB, move the database with a bacpac, cover point-in-time restore and failover groups, an Entra-only server, the transaction that EnableRetryOnFailure breaks, and the stacked retry layers of SqlClient and EF Core.
Cloud Storage: Containers, Access Tiers, SAS and Managed Identity in Blob Storage for Book Covers
Book covers belong in a private Blob Storage container and should reach the browser through a short-lived SAS signed with a user delegation key obtained by a managed identity, not with the account key. We cover choosing redundancy, access tiers and lifecycle policies, a cover upload endpoint that checks magic bytes, real SAS tests against Azurite in OAuth mode, the Storage Blob Delegator role and the S3 equivalents.
Background Work with Serverless: Azure Functions Isolated Worker, Flex Consumption and Blob-Triggered Cover Image Processing
Serverless is the right choice for short, irregular work: Bookstore's cover thumbnails are produced by an Event Grid triggered .NET 10 isolated worker function on Flex Consumption. We cover the end of the in-process model, Azure.Functions.Sdk, the hosting plans, idempotency with ETags, an Event Grid event sent by hand locally with Azurite and Core Tools, the poison queue, an identity-based connection and the Lambda equivalents.
Moving Bookstore to the Cloud: ASP.NET Core on App Service, Containers on Container Apps and Static Hosting for Angular
Putting Bookstore.Api on App Service as code and on Container Apps as a container takes a few CLI commands; the real work is fitting the platform with health checks, forwarded headers and an SPA fallback. We cover plans versus apps, app setting and connection string prefixes, the /health and /health/live endpoints, X-Forwarded-Proto producing a wrong Location and its test, revisions and traffic splitting, and the Static Web Apps fallback for Angular, with real output.
Compute Options in the Cloud: Choosing Between VMs, App Service, Container Apps, Kubernetes and Functions
Choosing compute is a balance between the control an application needs and the operational load a team can carry: from VMs to AKS, from App Service to Container Apps and Functions, the platform takes on more work. We cover the AWS equivalents (App Runner closing, ECS Express Mode), a decision tree for Bookstore, scaling models, a measured cold start of Bookstore.Api and the pricing units.
Identity and Access in the Cloud: Entra ID, RBAC, Managed Identity and Apps Without Access Keys
An app without access keys gets short-lived tokens from Entra ID through a managed identity and holds a data role only at the scope it needs. We cover the control plane versus data plane, Azure RBAC's principal-role-scope model, the managed identity's local token endpoint with an imitation service, the real output of the DefaultAzureCredential chain, Bookstore.Api's key-free Blob client and the role granted on the covers container.
Cloud Accounts and the Resource Hierarchy: Tenants, Subscriptions, Resource Groups, Tags and Naming
In Azure every resource is a leaf of a tree made of a tenant, management groups, subscriptions and resource groups; the subscription is the billing boundary and the resource group the lifecycle boundary. For Bookstore we cover the prod/nonprod subscription split, a naming tool that catches global name limits, enforcing tags with Azure Policy, a first resource group with az CLI, free account credits and a budget alert on day one, with AWS equivalents.
What Is the Cloud? IaaS, PaaS, SaaS, Serverless, Shared Responsibility, Regions and Availability Zones
The cloud means renting capacity in minutes through an API and paying for what you use; IaaS, PaaS, SaaS and serverless decide which layer of the stack is left to you. We cover the shared responsibility matrix, regions, availability zones and region pairs, the questions to ask about KVKK, a composite SLA calculation for Bookstore (99.94%, about 26 minutes a month) and when the cloud gets expensive, with AWS and GCP equivalents.