| name | azure-defaults |
| description | **UTILITY SKILL** — Applies canonical Azure defaults through an IaC workflow covering governance precedence, CAF naming, AVM-first composition, unique suffixes, cost monitoring, VNet planning, and lifecycle checks. WHEN: "Azure naming convention", "CAF naming", "resource tags", "AVM module", "security baseline", "region default". DO NOT USE FOR: artifact templates or pricing lookups. |
| compatibility | Works with Claude Code, GitHub Copilot, VS Code, and any Agent Skills compatible tool. |
| license | MIT |
| metadata | {"author":"jonathan-vella","version":"3.0","category":"azure-infrastructure"} |
Azure Defaults
Apply the canonical defaults from
.github/copilot-instructions.md
without duplicating them here. Live governance discovered for the target scope
always overrides repository defaults.
Prerequisites
- Read the canonical Azure Defaults section once per session.
- Read
04-governance-constraints.json when it exists.
- Read
sku-manifest.json for creative SKU decisions; do not derive SKUs from
artifact prose.
- Load only the reference needed for the current decision.
IaC Workflow
- Resolve governance precedence — apply live policy constraints before
fallback regions, tags, networking, cost, or security defaults.
- Generate one stable suffix — derive it once from deployment scope and
pass it to every globally unique resource name.
- Apply CAF naming — use resource-specific abbreviations and length limits;
load naming examples when constraints
differ by service.
- Resolve AVM modules live — prefer AVM, pin the latest stable version at
plan time, and record justified stale-pin exceptions in the IaC contract.
- Apply canonical security defaults — use the canonical baseline and load
AVM pitfalls only when module
parameters or lifecycle constraints require detail.
- Run conditional planning gates — apply VNet and cost-monitoring workflows
when their triggers hold; governance remains authoritative.
- Check service lifecycle — use the latest supported GA LTS runtime and
reject retired, classic, preview, or short-lifecycle choices for durable
production workloads unless explicitly approved.
- Validate the output — run the stack validator and the security, AVM pin,
SKU coverage, and governance checks relevant to the produced IaC.
IaC-Specific Invariants
- Unique suffix: generate one deterministic suffix per deployment scope and
pass it into modules rather than recomputing it independently.
- AVM-first: do not hand-roll a resource with an applicable stable AVM module.
- Live pins: resolve module versions at plan time; training-data pins are not
evidence of currency.
- Governance wins: discovered policy overrides every fallback in the
canonical defaults and this workflow.
- VNet planning is interactive: confirm CIDRs when a workload requires VNet
integration, private endpoints, or a VNet-attached service. Production cannot
defer the gate.
- Cost monitoring is explicit: production requires the governed budget,
notification, and anomaly-monitoring contract; non-production exceptions must
use a documented mode.
- Lifecycle is verified live: selectable engine and runtime versions require
current support-policy evidence.
Validation
npm run validate:region-canonical
npm run validate:iac-security-baseline
npm run validate:avm-versions:freeze
npm run validate:sku-iac-coverage
Then run bicep build and bicep lint, or terraform fmt -check and
terraform validate, for the selected stack.
Reference Index
Load references progressively; do not read the directory wholesale.
| Decision area | References |
|---|
| Naming and tags | Naming examples, tag strategy |
| AVM and security | AVM modules, security and AVM pitfalls |
| Networking | VNet planning, identity resolution |
| Cost and sizing | Cost baseline, Bicep, Terraform, pricing, service matrices |
| Governance and lifecycle | Governance discovery, policy effects, deprecated services, workflow gates |
| Architecture and review | WAF criteria, research workflow, review protocol, |
