# Azure Feature Gap Review (LotusCloud)

Date: 2026-03-06

This document summarizes Azure-style capabilities that are still missing or partially implemented in LotusCloud, plus immediate next actions.

## Verified Migration Status (Workbook Sync 2026-03-07)

Source: `GHN Migration_Requirements.xlsx`.

- `Done`: 5
- `Done/Partial`: 6
- `Partial`: 4
- `Gap`: 10

Recently closed by code (already merged):

- Billing breakdown deepened to SKU/resource dimensions.
- Workload identity MVP for service principals.
- Backup cross-zone policy/job metadata.
- Centralized activity audit logging via gateway + monitor ingest.

Still infra/ops-dependent (cannot be fully closed by code only):

- Enterprise DBaaS rollout (managed engines + PgBouncer + failover operations).
- Multi-site K8s + global traffic steering.
- Hub-spoke networking, multi-NIC VM, no-downtime bandwidth scale proof.
- SLA/benchmark evidence from production-like datacenter environment.

## Already Covered

- IAM + JWT + refresh token flow
- Project-based tenant isolation (`X-Project-ID`)
- RBAC authorization hooks across gateway/services
- Core IaaS/PaaS stack: Compute, Storage, Network, SQL, Billing
- Extended platform: Resource Manager, Registry, App Service, VPN, Firewall, Backup
- Advanced services: Serverless, CDN, Cache, API Management, Event Grid, Cost Management, Policy

## High-Priority Gaps

1. Multi-region disaster recovery orchestration
- Azure equivalent: Site Recovery + geo-redundancy orchestration
- LotusCloud status: backup exists, DR workflow/orchestrator missing
- Suggested implementation:
  - Add DR plans, failover runbooks, and periodic simulation jobs

## Newly Closed Gaps (2026-03-07)

1. Autoscale policies
- Status: implemented (`autoscale-service`, gateway routes, frontend `/autoscale`)

2. Private networking controls
- Status: implemented (`private-link-service`, private endpoints + DNS links, frontend `/private-link`)

3. Messaging tier parity
- Status: implemented (`servicebus-service`, namespaces/queues/topics/subscriptions, frontend `/servicebus`)

4. DDoS protection plan
- Status: implemented (`ddos-service`, plans + mitigated alert telemetry, frontend `/ddos`)

5. Multi-region disaster recovery orchestration
- Status: implemented stub (`dr-service`, plan CRUD + runbook ordered steps + simulation drills with RTO/RPO evidence; frontend not yet wired)

## Security Hardening Applied In This Update

- API Gateway now validates `X-Project-ID` as UUID format
- API Gateway now denies routes with missing RBAC mapping (fail-closed)
- API Gateway RBAC mapping expanded for Phase 6 routes and aliases
- API Gateway proxy now forwards query string to upstream services
- API Gateway adds secure HTTP headers and strict CORS allowlist handling

## Next Recommended Milestone

- Milestone `v0.8` focus:
  - DR plan APIs (phase 1)
  - failover runbooks (phase 2)
  - DR simulation jobs + evidence reporting