skilld
All skills
microsoft avatar

/azure-enterprise-infra-planner

@5f24d7e official
by microsoftmicrosoft/github-copilot-for-azure253 stars
206

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, security, compliance, and multi-resource topologies with WAF alignment. Generates Bicep or Terraform directly (no azd). WHEN: 'plan Azure infrastructure', 'architect Azure landing zone', 'design hub-spoke network', 'plan multi-region DR topology', 'set up VNets firewalls and private endpoints', 'subscription-scope Bicep deployment', 'Azure Backup for VM workloads'. PREFER azure-prepare FOR app-centric workflows.

Ask your Agent

Use this Skill: https://skilld.dev/gh/microsoft/github-copilot-for-azure/azure-enterprise-infra-planner

This session only. Nothing lands on disk.

referencesconstraintssecurity.md

≈609 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Security Pairing Constraints

Key Vault

Paired With Constraint
Storage Account (CMK) Must have enableSoftDelete: true AND enablePurgeProtection: true.
Storage Account (CMK at creation) Storage must use user-assigned managed identity — system-assigned only works for existing accounts.
SQL Server (TDE) Must enable enablePurgeProtection. Key Vault and SQL Server must be in the same Azure AD tenant.
AKS (secrets) Use enableRbacAuthorization: true with Azure RBAC for secrets access. AKS needs azureKeyvaultSecretsProvider addon.
Disk Encryption Must set enabledForDiskEncryption: true. Premium SKU required for HSM-protected keys.
Private Endpoint Set publicNetworkAccess: 'Disabled' and networkAcls.defaultAction: 'Deny' when using private endpoints.
CMK Firewall When any Azure service uses CMK from Key Vault, the Key Vault firewall must enable "Allow trusted Microsoft services to bypass this firewall" — unless using private endpoints to Key Vault.
CMK Key Type Key must be RSA or RSA-HSM, 2048/3072/4096-bit. Other key types are not supported for customer-managed keys.
CMK Cross-Tenant Key Vault and consuming service must be in the same Azure AD tenant. Cross-tenant CMK requires separate configuration.

Managed Identity

Paired With Constraint
Any Resource (identity assignment) Reference the identity resource ID in the resource's identity.userAssignedIdentities object as { '${managedIdentity.id}': {} }.
Key Vault (CMK) Storage accounts using CMK at creation require a user-assigned identity — system-assigned only works for existing accounts.
Container Registry (ACR pull) Assign AcrPull role to the identity's principalId. Reference the identity in the pulling resource (AKS, Container App, etc.).
AKS (workload identity) Create a federated identity credential on the managed identity. Map it to a Kubernetes service account via OIDC issuer.
Role Assignments Use properties.principalId with principalType: 'ServicePrincipal' in Microsoft.Authorization/roleAssignments.
Function App / App Service Set identity.type to 'UserAssigned' and reference the identity resource ID. Use for Key Vault references, storage access, etc.

Source: SKILL.md on GitHub

Third-party checks

No alerts5mo4 checks · Risk SAFE
  • Gen Agent Trust Hub5mo

    This skill provides a comprehensive framework for planning and deploying Azure infrastructure using Bicep and Terraform. It leverages official Microsoft documentation and Azure CLI tools to ensure architectural alignment with the Well-Architected Framework. The skill includes built-in security practices such as managed identity usage, RBAC enforcement, and secure parameter handling.

  • Socket5mo

    No alerts

  • Snyk5mo

    Risk: LOW · No issues

  • ZeroLeaks5mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at 5f24d7e. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated last month

Capability

metadata
{
  "author": "Microsoft",
  "version": "0.0.0-placeholder"
}

Topics

  • Infrastructure
  • azure
  • bicep
  • terraform
  • networking
  • landing-zone
  • hub-spoke
  • identity
  • disaster-recovery
  • compliance

README badge

README badge for microsoft/github-copilot-for-azure/azure-enterprise-infra-planner

What it does

Generates Bicep or Terraform code for enterprise Azure infrastructure from workload descriptions, covering networking, identity, security, and multi-region topologies aligned with Azure Well-Architected Framework. Targets cloud architects and platform engineers planning landing zones, hub-spoke networks, and subscription-scope deployments.

Generated from the current SKILL.md.

Frequently asked

Does this skill generate Terraform or Bicep?
It generates both Bicep and Terraform directly. The skill targets subscription-scope and multi-resource-group deployments without using Azure Developer CLI (azd).
What Azure infrastructure patterns does this skill handle?
It covers enterprise patterns including landing zones, hub-spoke networks, multi-region disaster recovery, VNets, firewalls, private endpoints, VPN gateways, identity, RBAC, and compliance-driven topologies.
Should I use this skill for application-centric workflows?
No. The skill description explicitly recommends using azure-prepare instead for app-centric workflows. This skill is optimized for infrastructure and platform engineering.
Does this skill validate generated infrastructure code?
Yes. It includes validation for both Bicep (az bicep build) and Terraform (terraform validate) and checks for pairing constraint violations before deployment.
What MCP tools does this skill rely on?
It uses insights_get, get_azure_bestpractices_get, wellarchitectedframework_serviceguide_get, microsoft_docs_search, microsoft_docs_fetch, and bicepschema_get to fetch best practices, WAF guidance, and schema definitions.

Generated from the current SKILL.md. These answers refresh after source changes.