assets/diagrams/04-azure-management-data-plane.html
Original HTML source
<!doctype html>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Azure Management Plane vs Data Plane</title>
<style>
  :root {
    color-scheme: light dark;
    --bg: #f8fafc;
    --fg: #172033;
    --muted: #5b6475;
    --line: #64748b;
    --neutral: #e2e8f0;
    --input: #bfdbfe;
    --process: #c7d2fe;
    --storage: #99f6e4;
    --external: #fde68a;
    --risk: #fecaca;
  }
  @media (prefers-color-scheme: dark) {
    :root {
      --bg: #0f172a;
      --fg: #e5e7eb;
      --muted: #a3adbd;
      --line: #94a3b8;
      --neutral: #334155;
      --input: #1d4ed8;
      --process: #4338ca;
      --storage: #0f766e;
      --external: #92400e;
      --risk: #991b1b;
    }
  }
  body {
    margin: 0;
    background: var(--bg);
    color: var(--fg);
    font: 14px/1.4 ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
  }
  main {
    max-width: 980px;
    margin: 32px auto;
    padding: 0 20px;
  }
  svg {
    width: 100%;
    height: auto;
    display: block;
  }
  .title {
    font-size: 22px;
    font-weight: 700;
    fill: var(--fg);
  }
  .zone-label {
    font-size: 16px;
    font-weight: 700;
    fill: var(--fg);
  }
  .label {
    font-size: 14px;
    font-weight: 650;
    fill: var(--fg);
  }
  .small {
    font-size: 12px;
    fill: var(--muted);
  }
  .node {
    stroke: var(--line);
    stroke-width: 1;
  }
  .input {
    fill: var(--input);
  }
  .process {
    fill: var(--process);
  }
  .storage {
    fill: var(--storage);
  }
  .external {
    fill: var(--external);
  }
  .risk {
    fill: var(--risk);
  }
  .edge {
    stroke: var(--line);
    stroke-width: 1.6;
    fill: none;
  }
  .zone {
    fill: none;
    stroke: var(--line);
    stroke-width: 1.2;
    stroke-dasharray: 7 6;
    opacity: 0.9;
  }
</style>
<main>
  <svg viewBox="0 0 980 560" role="img" aria-labelledby="title desc">
    <title id="title">Azure Management Plane vs Data Plane</title>
    <desc id="desc">A principal can manage Azure resources through ARM while data access for Storage and Key Vault is evaluated separately through data roles or service-specific authorization.</desc>
    <defs>
      <marker id="arrow" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
        <path d="M 0 0 L 10 5 L 0 10 z" fill="var(--line)"></path>
      </marker>
    </defs>

    <text class="title" x="32" y="42">Azure Management Plane vs Data Plane</text>
    <text class="small" x="32" y="66">Teaching point: being able to manage a resource does not automatically mean being able to read its data.</text>

    <path class="edge" fill="none" marker-end="url(#arrow)" d="M 206 178 C 270 178 286 178 350 178"></path>
    <path class="edge" fill="none" marker-end="url(#arrow)" d="M 494 178 C 560 178 576 178 642 178"></path>
    <path class="edge" fill="none" marker-end="url(#arrow)" d="M 206 380 C 280 380 296 342 362 302"></path>
    <path class="edge" fill="none" marker-end="url(#arrow)" d="M 506 302 C 574 342 596 380 664 380"></path>
    <path class="edge" fill="none" marker-end="url(#arrow)" d="M 506 426 C 574 426 596 426 664 426"></path>

    <rect class="node input" x="58" y="140" width="148" height="76" rx="10"></rect>
    <text class="label" x="92" y="170">Principal</text>
    <text class="small" x="92" y="192">user, group, SP</text>

    <rect class="zone" x="326" y="106" width="204" height="146" rx="14"></rect>
    <text class="zone-label" x="356" y="136">Management plane</text>
    <rect class="node process" x="350" y="156" width="144" height="62" rx="9"></rect>
    <text class="label" x="390" y="184">Azure ARM</text>
    <text class="small" x="390" y="204">role assignment</text>

    <rect class="node storage" x="642" y="140" width="172" height="76" rx="10"></rect>
    <text class="label" x="682" y="170">Resource</text>
    <text class="small" x="682" y="192">configure / deploy</text>

    <rect class="node external" x="58" y="342" width="148" height="76" rx="10"></rect>
    <text class="label" x="90" y="372">Data Role</text>
    <text class="small" x="90" y="394">service-specific</text>

    <rect class="zone" x="326" y="268" width="548" height="206" rx="14"></rect>
    <text class="zone-label" x="356" y="300">Data plane examples</text>

    <rect class="node storage" x="362" y="326" width="144" height="76" rx="9"></rect>
    <text class="label" x="394" y="356">Storage</text>
    <text class="small" x="394" y="378">Blob data access</text>

    <rect class="node storage" x="362" y="416" width="144" height="76" rx="9"></rect>
    <text class="label" x="392" y="446">Key Vault</text>
    <text class="small" x="392" y="468">secret access</text>

    <rect class="node risk" x="664" y="326" width="168" height="76" rx="9"></rect>
    <text class="label" x="698" y="356">Can read data?</text>
    <text class="small" x="698" y="378">check data auth</text>

    <rect class="node risk" x="664" y="416" width="168" height="76" rx="9"></rect>
    <text class="label" x="698" y="446">Can read secret?</text>
    <text class="small" x="698" y="468">check vault model</text>

    <text class="small" x="58" y="510">Decision rule: always name the plane, the scope, and the resource-specific authorization path.</text>
  </svg>
</main>