Governance Policies Performance Caching

Caching

Governance policies for Caching

Domain: performance

Patterns

Name	Description
Layered caching strategy	L1 in-memory cache (per-instance, <1ms) → L2 Redis cache (distributed, 1-5ms) → L3 CDN/Front Door (edge, <10ms) → Origin database
Cache key design	Use hierarchical cache keys: {service}:{entity}:{id}:{version} — enables selective invalidation by prefix

Anti-Patterns

Description	Instead
Do not cache everything — only cache data that is read frequently and changes infrequently	Apply cache-aside pattern selectively; monitor cache hit ratio to validate effectiveness
Do not use a single global TTL for all cache entries	Set TTL based on data freshness requirements: 30 days for static assets, 5-15 minutes for API data, 30 minutes for sessions
Do not cache without monitoring cache hit ratio	Track cache hit/miss ratio via Redis INFO command or Application Insights custom metrics; target >80% hit ratio
Do not serve stale data without a revalidation strategy	Use stale-while-revalidate pattern: serve stale data while fetching fresh data in background

References

• Azure Cache for Redis best practices
• Front Door caching
• APIM caching policies
• Cosmos DB integrated cache
• Cache-aside pattern

---

Checks (5)

Check	Severity	Description
WAF-PERF-CACHE-001	Required	Configure Azure Cache for Redis with managed identity authentication, connection multiplexing, and appropriate eviction policy
WAF-PERF-CACHE-002	Required	Configure Front Door or CDN caching with appropriate TTL, cache key customization, and compression
WAF-PERF-CACHE-003	Recommended	Implement application-level cache-aside pattern with distributed cache and local memory fallback
WAF-PERF-CACHE-004	Recommended	Configure API Management caching policies for frequently accessed API responses
WAF-PERF-CACHE-005	Recommended	Enable Cosmos DB integrated cache for read-heavy workloads to reduce RU consumption

---

WAF-PERF-CACHE-001

Configure Azure Cache for Redis with managed identity authentication, connection multiplexing, and appropriate eviction policy

Severity: Required
Rationale: Redis is the backbone of distributed caching; misconfigured connections cause connection exhaustion and managed identity eliminates key rotation burden
Agents: terraform-agent, bicep-agent, cloud-architect, app-developer, csharp-developer, python-developer

Targets

• Microsoft.Cache/redis
• Microsoft.Network/frontDoors
• Microsoft.Cdn/profiles
• Microsoft.ApiManagement/service
• Microsoft.DocumentDB/databaseAccounts
• Microsoft.Web/sites
• Microsoft.App/containerApps

---

WAF-PERF-CACHE-002

Configure Front Door or CDN caching with appropriate TTL, cache key customization, and compression

Severity: Required
Rationale: Edge caching reduces origin load by 70-90% for static content and improves latency from seconds to milliseconds
Agents: terraform-agent, bicep-agent, cloud-architect, app-developer, csharp-developer, python-developer

Targets

• Microsoft.Cache/redis
• Microsoft.Network/frontDoors
• Microsoft.Cdn/profiles
• Microsoft.ApiManagement/service
• Microsoft.DocumentDB/databaseAccounts
• Microsoft.Web/sites
• Microsoft.App/containerApps

---

WAF-PERF-CACHE-003

Implement application-level cache-aside pattern with distributed cache and local memory fallback

Severity: Recommended
Rationale: Cache-aside reduces database load by 80-95% for read-heavy workloads; layered caching (L1 memory + L2 Redis) minimizes network round-trips
Agents: app-developer, csharp-developer, python-developer, cloud-architect

Targets

• Microsoft.Cache/redis
• Microsoft.Network/frontDoors
• Microsoft.Cdn/profiles
• Microsoft.ApiManagement/service
• Microsoft.DocumentDB/databaseAccounts
• Microsoft.Web/sites
• Microsoft.App/containerApps

---

WAF-PERF-CACHE-004

Configure API Management caching policies for frequently accessed API responses

Severity: Recommended
Rationale: APIM built-in cache reduces backend load and latency without application code changes; external Redis cache provides persistence
Agents: terraform-agent, bicep-agent, cloud-architect, app-developer, csharp-developer, python-developer

Targets

• Microsoft.Cache/redis
• Microsoft.Network/frontDoors
• Microsoft.Cdn/profiles
• Microsoft.ApiManagement/service
• Microsoft.DocumentDB/databaseAccounts
• Microsoft.Web/sites
• Microsoft.App/containerApps

---

WAF-PERF-CACHE-005

Enable Cosmos DB integrated cache for read-heavy workloads to reduce RU consumption

Severity: Recommended
Rationale: Cosmos DB integrated cache provides item and query cache at the gateway level, reducing RU consumption by 50-90% for repeated reads
Agents: terraform-agent, bicep-agent, cloud-architect, app-developer, csharp-developer, python-developer

Targets

• Microsoft.Cache/redis
• Microsoft.Network/frontDoors
• Microsoft.Cdn/profiles
• Microsoft.ApiManagement/service
• Microsoft.DocumentDB/databaseAccounts
• Microsoft.Web/sites
• Microsoft.App/containerApps

---