/azure-enterprise-infra-planner

by microsoftmicrosoft/github-copilot-for-azure253 stars

206

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, security, compliance, and multi-resource topologies with WAF alignment. Generates Bicep or Terraform directly (no azd). WHEN: 'plan Azure infrastructure', 'architect Azure landing zone', 'design hub-spoke network', 'plan multi-region DR topology', 'set up VNets firewalls and private endpoints', 'subscription-scope Bicep deployment', 'Azure Backup for VM workloads'. PREFER azure-prepare FOR app-centric workflows.

42 files
142.4 KB
MIT
Updated last month
GitHub
No alerts

Ask your Agent

Use this Skill: https://skilld.dev/gh/microsoft/github-copilot-for-azure/azure-enterprise-infra-planner

This session only. Nothing lands on disk.

referencespairing-checks.md

3.7 KB raw

≈939 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Property & Pairing Checks

Cross-check each new resource's properties against every already-written resource it connects to. Only run the checks relevant to this resource's type. Consult the resource file's Pairing Constraints section for type-specific rules.

SKU Compatibility

#	Check	Fix
1	Public IP SKU matches Load Balancer SKU (both Standard or both Basic)	Align to Standard (Basic retiring Sep 2025)
2	Application Gateway v1/v2 on separate subnets; v2 if zone redundancy, autoscaling, or Key Vault integration needed	Upgrade to v2 or split subnets
3	VPN Gateway SKU supports required features (BGP, IPv6, coexistence) — not Basic if any advanced feature is needed	Upgrade SKU
4	App Service Plan SKU meets feature requirements (VNet integration ≥ Basic, slots ≥ Standard, isolation ≥ IsolatedV2)	Upgrade plan SKU
5	Redis Cache tier supports required features (VNet injection = Premium, clustering = Premium/Enterprise)	Upgrade tier

Subnet & Network Conflicts

#	Check	Fix
1	No already-written service with exclusive subnet requirements shares the same subnet as this resource	Assign a separate subnet
2	Subnet delegation matches service requirement — delegated for App Service/Container Apps Workload Profiles; NOT delegated for AKS, Consumption-only Container Apps	Fix delegation setting
3	App Service VNet Integration subnet ≠ App Service Private Endpoint subnet	Split into two subnets
4	Subnet CIDR size meets minimum (/26 for Firewall/Bastion, /27 for Gateway/Container Apps WP, /23 for Container Apps Consumption)	Expand CIDR
5	GatewaySubnet has no NSG; AzureBastionSubnet has an NSG	Add or remove NSG resource

Storage Pairing

#	Check	Fix
1	Functions storage account uses `StorageV2` or `Storage` kind (not BlobStorage/BlockBlob/FileStorage)	Change `kind` to `StorageV2`
2	Functions on Consumption plan do not reference network-secured storage	Remove network rules or upgrade to Premium plan
3	Zone-redundant Functions use ZRS storage (not LRS/GRS)	Change storage SKU to `Standard_ZRS`
4	VM boot diagnostics storage is not Premium or ZRS	Use `Standard_LRS` or `Standard_GRS`

Cosmos DB

#	Check	Fix
1	Multi-region writes + Strong consistency not configured together	Switch to Session consistency or single-region writes
2	Serverless accounts are single-region only, no shared-throughput databases	Remove multi-region config or switch to provisioned throughput

Key Vault & CMK

#	Check	Fix
1	Any service using CMK has its Key Vault with `enableSoftDelete: true` and `enablePurgeProtection: true`	Add properties to Key Vault (or fix the already-written Key Vault entry)
2	CMK at storage creation uses user-assigned managed identity (not system-assigned)	Add a user-assigned identity resource before this resource

SQL Database

#	Check	Fix
1	Zone redundancy not configured on Basic/Standard DTU tiers	Upgrade to Premium, Business Critical, or GP vCore
2	Hyperscale zone-redundant elastic pools use ZRS/GZRS backup storage	Set backup storage redundancy

AKS Networking

#	Check	Fix
1	Pod CIDR does not overlap with cluster subnet, peered VNets, or gateway ranges already in the plan	Adjust CIDR
2	Reserved CIDR ranges (169.254.0.0/16, 172.30.0.0/16, 172.31.0.0/16, 192.0.2.0/24) not used	Change to allowed range
3	CNI Overlay not combined with VM availability sets, virtual nodes, or DCsv2 VMs	Switch CNI plugin or VM series

Source: SKILL.md on GitHub

Third-party checks

No alerts5mo4 checks · Risk SAFE

Gen Agent Trust Hub5mo
This skill provides a comprehensive framework for planning and deploying Azure infrastructure using Bicep and Terraform. It leverages official Microsoft documentation and Azure CLI tools to ensure architectural alignment with the Well-Architected Framework. The skill includes built-in security practices such as managed identity usage, RBAC enforcement, and secure parameter handling.
Socket5mo
No alerts
Snyk5mo
Risk: LOW · No issues
ZeroLeaks5mo
Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at 5f24d7e. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated last month

Capability

metadata: { "author": "Microsoft", "version": "0.0.0-placeholder" }

Topics

Infrastructure
azure
bicep
terraform
networking
landing-zone
hub-spoke
identity
disaster-recovery
compliance

What it does

Generates Bicep or Terraform code for enterprise Azure infrastructure from workload descriptions, covering networking, identity, security, and multi-region topologies aligned with Azure Well-Architected Framework. Targets cloud architects and platform engineers planning landing zones, hub-spoke networks, and subscription-scope deployments.

Generated from the current SKILL.md.

Frequently asked

Does this skill generate Terraform or Bicep?

It generates both Bicep and Terraform directly. The skill targets subscription-scope and multi-resource-group deployments without using Azure Developer CLI (azd).

What Azure infrastructure patterns does this skill handle?

It covers enterprise patterns including landing zones, hub-spoke networks, multi-region disaster recovery, VNets, firewalls, private endpoints, VPN gateways, identity, RBAC, and compliance-driven topologies.

Should I use this skill for application-centric workflows?

No. The skill description explicitly recommends using azure-prepare instead for app-centric workflows. This skill is optimized for infrastructure and platform engineering.

Does this skill validate generated infrastructure code?

Yes. It includes validation for both Bicep (az bicep build) and Terraform (terraform validate) and checks for pairing constraint violations before deployment.

What MCP tools does this skill rely on?

It uses insights_get, get_azure_bestpractices_get, wellarchitectedframework_serviceguide_get, microsoft_docs_search, microsoft_docs_fetch, and bicepschema_get to fetch best practices, WAF guidance, and schema definitions.

Generated from the current SKILL.md. These answers refresh after source changes.

/azure-enterprise-infra-planner