skilld
All skills
microsoft avatar

/azure-enterprise-infra-planner

@5f24d7e official
by microsoftmicrosoft/github-copilot-for-azure253 stars
206

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, security, compliance, and multi-resource topologies with WAF alignment. Generates Bicep or Terraform directly (no azd). WHEN: 'plan Azure infrastructure', 'architect Azure landing zone', 'design hub-spoke network', 'plan multi-region DR topology', 'set up VNets firewalls and private endpoints', 'subscription-scope Bicep deployment', 'Azure Backup for VM workloads'. PREFER azure-prepare FOR app-centric workflows.

Ask your Agent

Use this Skill: https://skilld.dev/gh/microsoft/github-copilot-for-azure/azure-enterprise-infra-planner

This session only. Nothing lands on disk.

referencesphases3-research-resources.md

≈847 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Phase 3: Research Resources

The goal of this phase is to research Azure resources before generating the plan.

Step 1 - Resource Refinement

Cross reference WAF

Read WAF cross-cutting checklist. For every checklist item, either:

  • Add missing resources / harden properties, or;
  • Document the intentional omission in overallReasoning.tradeoffs and inputs.subGoals.

Insights Integration

Read .azure/insights.json produced by Phase 1 and evaluate each insight against the current workload and sub-goals identified in Phase 2:

  • If an insight applies, prefer it over defaults — especially for region, SKU tier, security posture, naming, and tagging.
  • If an insight doesn't apply, document the intentional omission in overallReasoning.tradeoffs.
  • Insights can shape both resource selection and property configuration.
  • Track each insight you apply in inputs.insightsApplied so the user can trace why a decision was made.

Mandatory Security rule: only apply a security-related insight if it results in an equal or stronger security posture than the alternatives. A weaker security posture from an insight is only acceptable when the user has explicitly requested it in the initial prompt.

Step 2 - Resource Lookup

Mandatory: Complete this step for every resource before generating the plan. WAF tools from Phase 2 provide architecture guidance, but do not provide ARM types, naming rules, or pairing constraints. This step fills those gaps.

For each resource identified since Phase 1:

  1. Read the relevant resource reference file to get its ARM type, API version, and CAF prefix. Use resources/README.md as the index to help you find the right file (e.g., resources/compute-infra.md for AKS, resources/data-analytics.md for Cosmos DB).
  2. Read the relevant pairing constraint file using constraints/README.md as the index. Each category file is <2K tokens, you must read the whole file for all resources in that category.
  3. Required — for every resource, spawn a general-purpose sub-agent to fetch its naming rules. Pass the naming rules URL from the resource file and instruct the sub-agent to call microsoft_docs_fetch and return only the min/max length, allowed characters, and uniqueness scope. The resource file's CAF prefix is a style convention only — it does not capture these ARM-enforced constraints, so this step cannot be skipped.

Important Tip: Only load the category files you need. For a plan with AKS + Cosmos DB + VNet + Key Vault, you'd load 4 constraint files and 4 resource files (~5.5K tokens total) instead of the full catalog (~22K tokens).

After completing the steps above, verify from the tool results:

  1. Type — Correct Microsoft.* resource type and API version
  2. SKU — Available in target region, appropriate for workload
  3. Region — Service available, data residency met
  4. Name — CAF-compliant naming constraints
  5. Dependencies — All prerequisites identified and ordered
  6. Properties — Required properties per resource schema
  7. Alternatives — At least one alternative with tradeoff documented

Gate

  • Every resource has an ARM type, naming rules, and pairing constraints checked.
  • Present the preliminary resource list to the user with brief justifications and wait for approval before proceeding.

Source: SKILL.md on GitHub

Third-party checks

No alerts5mo4 checks · Risk SAFE
  • Gen Agent Trust Hub5mo

    This skill provides a comprehensive framework for planning and deploying Azure infrastructure using Bicep and Terraform. It leverages official Microsoft documentation and Azure CLI tools to ensure architectural alignment with the Well-Architected Framework. The skill includes built-in security practices such as managed identity usage, RBAC enforcement, and secure parameter handling.

  • Socket5mo

    No alerts

  • Snyk5mo

    Risk: LOW · No issues

  • ZeroLeaks5mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at 5f24d7e. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated last month

Capability

metadata
{
  "author": "Microsoft",
  "version": "0.0.0-placeholder"
}

Topics

  • Infrastructure
  • azure
  • bicep
  • terraform
  • networking
  • landing-zone
  • hub-spoke
  • identity
  • disaster-recovery
  • compliance

README badge

README badge for microsoft/github-copilot-for-azure/azure-enterprise-infra-planner

What it does

Generates Bicep or Terraform code for enterprise Azure infrastructure from workload descriptions, covering networking, identity, security, and multi-region topologies aligned with Azure Well-Architected Framework. Targets cloud architects and platform engineers planning landing zones, hub-spoke networks, and subscription-scope deployments.

Generated from the current SKILL.md.

Frequently asked

Does this skill generate Terraform or Bicep?
It generates both Bicep and Terraform directly. The skill targets subscription-scope and multi-resource-group deployments without using Azure Developer CLI (azd).
What Azure infrastructure patterns does this skill handle?
It covers enterprise patterns including landing zones, hub-spoke networks, multi-region disaster recovery, VNets, firewalls, private endpoints, VPN gateways, identity, RBAC, and compliance-driven topologies.
Should I use this skill for application-centric workflows?
No. The skill description explicitly recommends using azure-prepare instead for app-centric workflows. This skill is optimized for infrastructure and platform engineering.
Does this skill validate generated infrastructure code?
Yes. It includes validation for both Bicep (az bicep build) and Terraform (terraform validate) and checks for pairing constraint violations before deployment.
What MCP tools does this skill rely on?
It uses insights_get, get_azure_bestpractices_get, wellarchitectedframework_serviceguide_get, microsoft_docs_search, microsoft_docs_fetch, and bicepschema_get to fetch best practices, WAF guidance, and schema definitions.

Generated from the current SKILL.md. These answers refresh after source changes.