Private edge layers set a $1,730 monthly floor under a $20-to-$140 .NET API on Container Apps

At 100M requests a month, the layers in front of the code cost about 12 times the compute behind them. At 1M requests the multiple is about 87 ^[1][2]. The floor alone comes to roughly $20,760 a year ^[3]. Those are West Europe prices for one specific set of tiers ^[1]. They transfer to a team that needs the same tiers in the same region, and to nobody else.

The requirements pick the tiers. Front Door has to be Premium because the managed WAF rule sets and Private Link origins are both Premium-only ^[8]. API Management Standard v2 is the cheapest tier that accepts an inbound private endpoint and also integrates outbound into a VNet, and this topology needs both ^[10]. Service Bus runs as a Premium namespace, and it and Cosmos DB sit behind private endpoints that take managed identities and no keys ^[7]. The article does not break the $1,730 down by layer ^[1].

Trust changes form at the gateway. The request leaves Front Door with an X-Azure-FDID header and nothing that proves who sent it ^[9]. API Management accepts it because of the network path and a check-header policy on that ID, with no credential involved ^[11]. After that, the hops use identity. The gateway validates the caller's token and applies per-caller limits, then fetches a token for orders-api with its system-assigned identity ^[12]. The last guard is "assignment required" on the service principal, set so that identities without the app role are refused a token ^[13]. The series marks that as something to verify on first deploy, because Entra documents the setting for applications and never for managed identities ^[13].

Every C# and HCL block in the article is lifted from the companion repo, trimmed but not edited ^[14]. The health endpoint fix, the Bicep fragment for the telemetry settings, the dead-letter fix, the alert command and the KQL are not in the repo, and each is labelled where it appears ^[15]. That labelling is honest. It also means a clone of the repo reproduces the seams without the fixes ^[15].

Names drift between parts too. For a series about hand-offs, that is at least on topic. This article calls the state store statestore, Part 3's sample calls it orderstore, and Part 4's Aspire sample names the services order-service and inventory-service ^[16]. "The strings differ; the wiring is the same," the author wrote ^[17]. The handler addresses the store through a constant, StateStore.Name, and that is the string I'd check first when mixing samples from different parts ^[18].

The handler itself is good work. Service invocation returns failure as a value, and the code comment gives the reason: the two interesting branches, inventory saying no and inventory being impossible to reach, both show up in the same switch ^[19]. An out-of-stock answer becomes a Conflict result carrying the shortfalls, and a failed call becomes a problem response ^[20].