{
  "$schema": "../../.dumbdiagrams/requirements.schema.json",
  "version": 1,
  "grammar": "azure",
  "components": [
    { "id": "subscription", "kind": "group", "type": "azure.subscription", "basis": { "kind": "explicit", "text": "within one subscription" } },
    { "id": "region", "kind": "group", "type": "azure.region", "basis": { "kind": "explicit", "text": "within one region" } },
    { "id": "resource_group", "kind": "group", "type": "azure.resource-group", "basis": { "kind": "explicit", "text": "within one resource group" } },
    { "id": "app_vnet", "kind": "group", "type": "azure.vnet", "basis": { "kind": "explicit", "text": "VNet integration in an application subnet" } },
    { "id": "application_subnet", "kind": "group", "type": "azure.subnet", "basis": { "kind": "explicit", "text": "application subnet" } },
    { "id": "data_subnet", "kind": "group", "type": "azure.subnet", "basis": { "kind": "explicit", "text": "data subnet for Private Endpoints" } },
    { "id": "service_bus_scope", "kind": "group", "type": "cloud-agnostic.boundary", "basis": { "kind": "inferred", "text": "Logical container to show the work queue and DLQ under one Service Bus service." } },
    { "id": "support_scope", "kind": "group", "type": "cloud-agnostic.boundary", "basis": { "kind": "inferred", "text": "Logical grouping for the requested Key Vault and Monitor support services." } },
    { "id": "data_services_scope", "kind": "group", "type": "cloud-agnostic.boundary", "basis": { "kind": "inferred", "text": "Logical grouping for the SQL and Storage targets outside the VNet." } },
    { "id": "public_client", "kind": "resource", "type": "cloud-agnostic.client", "basis": { "kind": "explicit", "text": "A public client enters through Front Door." } },
    { "id": "operations_client", "kind": "resource", "type": "cloud-agnostic.client", "basis": { "kind": "explicit", "text": "An operations client inspects the DLQ and triggers redrive." } },
    { "id": "front_door", "kind": "resource", "type": "azure.front-door-and-cdn-profiles", "basis": { "kind": "explicit", "text": "Front Door" } },
    { "id": "api_management", "kind": "resource", "type": "azure.api-management-services", "basis": { "kind": "explicit", "text": "API Management" } },
    { "id": "api", "kind": "resource", "type": "azure.app-services", "basis": { "kind": "explicit", "text": "an App Service API" } },
    { "id": "worker", "kind": "resource", "type": "azure.function-apps", "basis": { "kind": "explicit", "text": "A Function worker" } },
    { "id": "sql_private_endpoint", "kind": "resource", "type": "azure.private-endpoints", "basis": { "kind": "explicit", "text": "a SQL private endpoint" } },
    { "id": "sql_database", "kind": "resource", "type": "azure.sql-database", "basis": { "kind": "explicit", "text": "Azure SQL" } },
    { "id": "storage_private_endpoint", "kind": "resource", "type": "azure.private-endpoints", "basis": { "kind": "explicit", "text": "a Storage private endpoint" } },
    { "id": "storage_account", "kind": "resource", "type": "azure.storage-accounts", "basis": { "kind": "explicit", "text": "writes files through a Storage private endpoint" } },
    { "id": "work_queue", "kind": "resource", "type": "azure.azure-service-bus", "basis": { "kind": "explicit", "text": "enqueues work in Service Bus" } },
    { "id": "dead_letter_queue", "kind": "resource", "type": "azure.azure-service-bus", "basis": { "kind": "explicit", "text": "moves to a dead-letter queue" } },
    { "id": "key_vault", "kind": "resource", "type": "azure.key-vaults", "basis": { "kind": "explicit", "text": "The API and Function read Key Vault." } },
    { "id": "monitor", "kind": "resource", "type": "azure.monitor", "basis": { "kind": "explicit", "text": "The API and Function emit telemetry to Azure Monitor." } }
  ],
  "relationships": [
    { "id": "client_to_front_door", "source": "public_client", "target": "front_door", "kind": "flow", "basis": { "kind": "explicit", "text": "A public client enters through Front Door." } },
    { "id": "front_door_to_apim", "source": "front_door", "target": "api_management", "kind": "flow", "basis": { "kind": "explicit", "text": "Front Door and API Management form the entry path." } },
    { "id": "apim_to_api", "source": "api_management", "target": "api", "kind": "flow", "basis": { "kind": "explicit", "text": "API Management routes to an App Service API." } },
    { "id": "api_to_sql_endpoint", "source": "api", "target": "sql_private_endpoint", "kind": "flow", "basis": { "kind": "explicit", "text": "The API reads and writes Azure SQL through a SQL Private Endpoint." } },
    { "id": "sql_endpoint_to_database", "source": "sql_private_endpoint", "target": "sql_database", "kind": "flow", "basis": { "kind": "explicit", "text": "SQL Private Endpoint to Azure SQL; show relation direction explicitly." } },
    { "id": "api_to_work_queue", "source": "api", "target": "work_queue", "kind": "flow", "basis": { "kind": "explicit", "text": "The API enqueues work in Service Bus." } },
    { "id": "work_queue_to_worker", "source": "work_queue", "target": "worker", "kind": "flow", "basis": { "kind": "explicit", "text": "The Function worker consumes Service Bus work." } },
    { "id": "work_queue_to_dlq", "source": "work_queue", "target": "dead_letter_queue", "kind": "fail", "basis": { "kind": "explicit", "text": "Service Bus work reaching its retry limit moves to a dead-letter queue." } },
    { "id": "worker_to_storage_endpoint", "source": "worker", "target": "storage_private_endpoint", "kind": "flow", "basis": { "kind": "explicit", "text": "The Function writes files through a Storage Private Endpoint." } },
    { "id": "storage_endpoint_to_account", "source": "storage_private_endpoint", "target": "storage_account", "kind": "flow", "basis": { "kind": "explicit", "text": "Storage Private Endpoint to Storage Account; show relation direction explicitly." } },
    { "id": "worker_to_sql_endpoint", "source": "worker", "target": "sql_private_endpoint", "kind": "flow", "basis": { "kind": "explicit", "text": "The Function writes order status through the shared SQL Private Endpoint." } },
    { "id": "api_to_key_vault", "source": "api", "target": "key_vault", "kind": "flow", "basis": { "kind": "explicit", "text": "The API reads Key Vault." } },
    { "id": "worker_to_key_vault", "source": "worker", "target": "key_vault", "kind": "flow", "basis": { "kind": "explicit", "text": "The Function reads Key Vault." } },
    { "id": "api_to_monitor", "source": "api", "target": "monitor", "kind": "flow", "basis": { "kind": "explicit", "text": "The API emits telemetry to Azure Monitor." } },
    { "id": "worker_to_monitor", "source": "worker", "target": "monitor", "kind": "flow", "basis": { "kind": "explicit", "text": "The Function emits telemetry to Azure Monitor." } },
    { "id": "ops_to_dlq", "source": "operations_client", "target": "dead_letter_queue", "kind": "flow", "basis": { "kind": "explicit", "text": "The operations client inspects the DLQ." } },
    { "id": "ops_to_work_queue", "source": "operations_client", "target": "work_queue", "kind": "flow", "basis": { "kind": "explicit", "text": "The operations client triggers redrive to the work queue." } }
  ],
  "counts": [
    { "id": "one_subscription", "kind": "group", "type": "azure.subscription", "min": 1, "max": 1, "basis": { "kind": "explicit", "text": "one subscription" } },
    { "id": "one_region", "kind": "group", "type": "azure.region", "min": 1, "max": 1, "within": "subscription", "basis": { "kind": "explicit", "text": "one region" } },
    { "id": "one_resource_group", "kind": "group", "type": "azure.resource-group", "min": 1, "max": 1, "within": "region", "basis": { "kind": "explicit", "text": "one resource group" } },
    { "id": "one_vnet", "kind": "group", "type": "azure.vnet", "min": 1, "max": 1, "within": "resource_group", "basis": { "kind": "explicit", "text": "one application VNet" } },
    { "id": "two_subnets", "kind": "group", "type": "azure.subnet", "min": 2, "max": 2, "within": "app_vnet", "basis": { "kind": "explicit", "text": "application subnet and data subnet" } },
    { "id": "two_clients", "kind": "resource", "type": "cloud-agnostic.client", "min": 2, "max": 2, "basis": { "kind": "explicit", "text": "public client and operations client" } },
    { "id": "one_front_door", "kind": "resource", "type": "azure.front-door-and-cdn-profiles", "min": 1, "max": 1, "within": "resource_group", "basis": { "kind": "explicit", "text": "Front Door" } },
    { "id": "one_apim", "kind": "resource", "type": "azure.api-management-services", "min": 1, "max": 1, "within": "resource_group", "basis": { "kind": "explicit", "text": "API Management" } },
    { "id": "one_api", "kind": "resource", "type": "azure.app-services", "min": 1, "max": 1, "within": "resource_group", "basis": { "kind": "explicit", "text": "an App Service API" } },
    { "id": "one_worker", "kind": "resource", "type": "azure.function-apps", "min": 1, "max": 1, "within": "resource_group", "basis": { "kind": "explicit", "text": "a Function worker" } },
    { "id": "two_private_endpoints", "kind": "resource", "type": "azure.private-endpoints", "min": 2, "max": 2, "within": "data_subnet", "basis": { "kind": "explicit", "text": "SQL and Storage Private Endpoints" } },
    { "id": "one_sql_database", "kind": "resource", "type": "azure.sql-database", "min": 1, "max": 1, "within": "resource_group", "basis": { "kind": "explicit", "text": "Azure SQL" } },
    { "id": "one_storage_account", "kind": "resource", "type": "azure.storage-accounts", "min": 1, "max": 1, "within": "resource_group", "basis": { "kind": "explicit", "text": "Storage" } },
    { "id": "two_service_bus_queues", "kind": "resource", "type": "azure.azure-service-bus", "min": 2, "max": 2, "within": "service_bus_scope", "basis": { "kind": "explicit", "text": "work queue and dead-letter queue under Service Bus" } },
    { "id": "one_key_vault", "kind": "resource", "type": "azure.key-vaults", "min": 1, "max": 1, "within": "resource_group", "basis": { "kind": "explicit", "text": "Key Vault" } },
    { "id": "one_monitor", "kind": "resource", "type": "azure.monitor", "min": 1, "max": 1, "within": "resource_group", "basis": { "kind": "explicit", "text": "Azure Monitor" } }
  ],
  "placement": [
    { "id": "region_parent", "component": "region", "relation": "parent", "group": "subscription", "basis": { "kind": "explicit", "text": "within one subscription and region" } },
    { "id": "resource_group_parent", "component": "resource_group", "relation": "parent", "group": "region", "basis": { "kind": "explicit", "text": "within one region and resource group" } },
    { "id": "vnet_in_resource_group", "component": "app_vnet", "relation": "parent", "group": "resource_group", "basis": { "kind": "explicit", "text": "application VNet is in the resource group" } },
    { "id": "application_subnet_in_vnet", "component": "application_subnet", "relation": "parent", "group": "app_vnet", "basis": { "kind": "explicit", "text": "application subnet" } },
    { "id": "data_subnet_in_vnet", "component": "data_subnet", "relation": "parent", "group": "app_vnet", "basis": { "kind": "explicit", "text": "data subnet" } },
    { "id": "service_bus_scope_in_resource_group", "component": "service_bus_scope", "relation": "parent", "group": "resource_group", "basis": { "kind": "inferred", "text": "Logical grouping for the Service Bus queue artifacts." } },
    { "id": "support_scope_in_resource_group", "component": "support_scope", "relation": "parent", "group": "resource_group", "basis": { "kind": "inferred", "text": "Logical grouping for requested support services." } },
    { "id": "data_services_scope_in_resource_group", "component": "data_services_scope", "relation": "parent", "group": "resource_group", "basis": { "kind": "inferred", "text": "Logical grouping for the two private endpoint targets." } },
    { "id": "public_client_root", "component": "public_client", "relation": "root", "basis": { "kind": "explicit", "text": "public client" } },
    { "id": "operations_client_root", "component": "operations_client", "relation": "root", "basis": { "kind": "explicit", "text": "operations client" } },
    { "id": "front_door_in_resource_group", "component": "front_door", "relation": "inside", "group": "resource_group", "basis": { "kind": "explicit", "text": "Front Door within the same resource group" } },
    { "id": "front_door_outside_vnet", "component": "front_door", "relation": "outside", "group": "app_vnet", "basis": { "kind": "explicit", "text": "Front Door is a managed service outside the VNet." } },
    { "id": "apim_in_resource_group", "component": "api_management", "relation": "inside", "group": "resource_group", "basis": { "kind": "explicit", "text": "API Management within the same resource group" } },
    { "id": "apim_outside_vnet", "component": "api_management", "relation": "outside", "group": "app_vnet", "basis": { "kind": "inferred", "text": "No API Management VNet integration was requested." } },
    { "id": "api_in_app_subnet", "component": "api", "relation": "inside", "group": "application_subnet", "basis": { "kind": "explicit", "text": "Show API VNet integration in an application subnet." } },
    { "id": "worker_in_app_subnet", "component": "worker", "relation": "inside", "group": "application_subnet", "basis": { "kind": "explicit", "text": "Show Function VNet integration in an application subnet." } },
    { "id": "sql_endpoint_in_data_subnet", "component": "sql_private_endpoint", "relation": "inside", "group": "data_subnet", "basis": { "kind": "explicit", "text": "Private Endpoints are in a data subnet." } },
    { "id": "storage_endpoint_in_data_subnet", "component": "storage_private_endpoint", "relation": "inside", "group": "data_subnet", "basis": { "kind": "explicit", "text": "Private Endpoints are in a data subnet." } },
    { "id": "sql_in_data_services", "component": "sql_database", "relation": "inside", "group": "data_services_scope", "basis": { "kind": "inferred", "text": "Group SQL beside the Storage private endpoint target." } },
    { "id": "sql_in_resource_group", "component": "sql_database", "relation": "inside", "group": "resource_group", "basis": { "kind": "explicit", "text": "SQL is within one subscription, region, and resource group." } },
    { "id": "sql_outside_vnet", "component": "sql_database", "relation": "outside", "group": "app_vnet", "basis": { "kind": "explicit", "text": "SQL is a managed service outside the VNet." } },
    { "id": "storage_in_data_services", "component": "storage_account", "relation": "inside", "group": "data_services_scope", "basis": { "kind": "inferred", "text": "Group Storage beside the SQL private endpoint target." } },
    { "id": "storage_in_resource_group", "component": "storage_account", "relation": "inside", "group": "resource_group", "basis": { "kind": "explicit", "text": "Storage is within one subscription, region, and resource group." } },
    { "id": "storage_outside_vnet", "component": "storage_account", "relation": "outside", "group": "app_vnet", "basis": { "kind": "explicit", "text": "Storage is a managed service outside the VNet." } },
    { "id": "work_queue_in_bus_scope", "component": "work_queue", "relation": "inside", "group": "service_bus_scope", "basis": { "kind": "explicit", "text": "Service Bus work queue." } },
    { "id": "dlq_in_bus_scope", "component": "dead_letter_queue", "relation": "inside", "group": "service_bus_scope", "basis": { "kind": "explicit", "text": "Service Bus dead-letter queue." } },
    { "id": "work_queue_outside_vnet", "component": "work_queue", "relation": "outside", "group": "app_vnet", "basis": { "kind": "explicit", "text": "Service Bus is a managed service outside the VNet." } },
    { "id": "dlq_outside_vnet", "component": "dead_letter_queue", "relation": "outside", "group": "app_vnet", "basis": { "kind": "explicit", "text": "Service Bus is a managed service outside the VNet." } },
    { "id": "key_vault_in_support", "component": "key_vault", "relation": "inside", "group": "support_scope", "basis": { "kind": "explicit", "text": "Key Vault support service in the resource group." } },
    { "id": "monitor_in_support", "component": "monitor", "relation": "inside", "group": "support_scope", "basis": { "kind": "explicit", "text": "Monitor support service in the resource group." } },
    { "id": "key_vault_outside_vnet", "component": "key_vault", "relation": "outside", "group": "app_vnet", "basis": { "kind": "explicit", "text": "Key Vault is a managed service outside the VNet." } },
    { "id": "monitor_outside_vnet", "component": "monitor", "relation": "outside", "group": "app_vnet", "basis": { "kind": "explicit", "text": "Monitor is a managed service outside the VNet." } }
  ],
  "allowAdditionalResources": false
}