// Azure infrastructure defaults: regions, tags, naming (CAF), AVM-first policy, security baseline, unique suffix patterns. USE FOR: any agent generating or planning Azure resources. DO NOT USE FOR: artifact template structures (use azure-artifacts), pricing lookups (read references/pricing-guidance.md on demand).
Shared IaC deploy patterns for Bicep and Terraform deploy agents: deployment strategies, circuit breaker, known deploy issues. For preflight validation (auth, governance, stop rules), see azure-validate. USE FOR: Phased deployment, circuit breaker, deploy-specific known issues. DO NOT USE FOR: Preflight validation (use azure-validate), code generation (use azure-bicep-patterns or terraform-patterns).
Artifact template structures, H2 compliance rules, and documentation styling for agent outputs (Steps 1-7). USE FOR: generating any agent artifact, checking H2 structure compliance. DO NOT USE FOR: Azure resource configuration (use azure-defaults), Bicep/Terraform patterns (use bicep-patterns or terraform-patterns).
Reusable Azure Bicep patterns: hub-spoke, private endpoints, diagnostics, AVM composition. USE FOR: Bicep template design, hub-spoke networking, private endpoint patterns, AVM modules. DO NOT USE FOR: Terraform code, architecture decisions, troubleshooting, diagram generation.
Execute Azure deployments for ALREADY-PREPARED applications that have existing infra/{iac}/{project}/.azure/plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires infra/{iac}/{project}/.azure/plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.
ROUTING SKILL — delegates to specialized diagram skills. USE FOR: any diagram request when the caller does not know which tool to use. Routes to drawio, python-diagrams, or mermaid based on diagram type.
Prepare Azure apps for deployment (infra Bicep/Terraform, azure.yaml, Dockerfiles). Use for create/modernize or create+deploy; not cross-cloud migration (use azure-cloud-migrate). WHEN: "create app", "build web app", "create API", "create serverless HTTP API", "create frontend", "create back end", "build a service", "modernize application", "update application", "add authentication", "add caching", "host on Azure", "create and deploy", "deploy to Azure", "deploy to Azure using Terraform", "deploy to Azure App Service", "deploy to Azure App Service using Terraform", "deploy to Azure Container Apps", "deploy to Azure Container Apps using Terraform", "generate Terraform", "generate Bicep", "function app", "timer trigger", "service bus trigger", "event-driven function", "containerized Node.js app", "social media app", "static portfolio website", "todo list with frontend and API", "prepare my Azure application to use Key Vault", "managed identity".
| name | azure-defaults |
| description | Azure infrastructure defaults: regions, tags, naming (CAF), AVM-first policy, security baseline, unique suffix patterns. USE FOR: any agent generating or planning Azure resources. DO NOT USE FOR: artifact template structures (use azure-artifacts), pricing lookups (read references/pricing-guidance.md on demand). |
| compatibility | Works with Claude Code, GitHub Copilot, VS Code, and any Agent Skills compatible tool. |
| license | MIT |
| metadata | {"author":"jonathan-vella","version":"2.0","category":"azure-infrastructure"} |
Single source of truth for Azure infrastructure configuration.
Deep-dive content lives in references/ — load on demand.
| Service | Default Region | Reason |
|---|---|---|
| All resources | swedencentral | EU GDPR-compliant |
| Static Web Apps | westeurope | Not available in swedencentral |
| Failover | germanywestcentral | EU paired alternative |
These 4 tags are the MINIMUM baseline. Always defer to
04-governance-constraints.md for the actual required tag list.
| Tag | Required | Example Values |
|---|---|---|
Environment | Yes | dev, staging, prod |
ManagedBy | Yes | Bicep or Terraform |
Project | Yes | Project identifier |
Owner | Yes | Team or individual name |
Tag Casing Rule: Use PascalCase exactly as shown above (
Environment,ManagedBy,Project,Owner). Never emit bothownerandOwnerorenvironmentandEnvironmentin the same template — Azure Policy treats case-variant tag keys as ambiguous evaluation paths (AmbiguousPolicyEvaluationPathserror).
Generate ONCE, pass to ALL modules:
var uniqueSuffix = uniqueString(resourceGroup().id)
| Setting | Value | Applies To |
|---|---|---|
| HTTPS-only | true | Storage, all |
| TLS minimum | 'TLS1_2' | All services |
| Public blob access | false | Storage |
| Public network (prod) | 'Disabled' | Data services |
| Authentication | Managed Identity | Prefer over keys |
For AVM pitfalls and deprecation patterns, read
references/security-baseline-full.md.
| Deprecated Service | Replacement | Since | Notes |
|---|---|---|---|
| Azure AD B2C | Microsoft Entra External ID | May 2025 | Not available for new tenants |
| Redis Enterprise E50 | Azure Managed Redis (Enterprise) | March 2027 | Plan migration before EOL |
| CDN WAF (classic) | Front Door Standard/Premium WAF | 2025 | CDN WAF creation blocked |
| App Gateway v1 | App Gateway v2 | April 2026 | Classic SKU retiring |
| CDN Standard Microsoft | Front Door Standard | 2027 | Migration required |
Rule: Never recommend deprecated services for greenfield projects. Before recommending any service with a multi-year RI commitment, verify the service retirement timeline extends beyond the commitment period. Check Microsoft Learn deprecation announcements.
| Resource | Abbr | Pattern | Max |
|---|---|---|---|
| Resource Group | rg | rg-{project}-{env} | 90 |
| Virtual Network | vnet | vnet-{project}-{env} | 64 |
| Subnet | snet | snet-{purpose}-{env} | 80 |
| NSG | nsg | nsg-{purpose}-{env} | 80 |
| Key Vault | kv | kv-{short}-{env}-{suffix} | 24 |
| Storage Account | st | st{short}{env}{suffix} | 24 |
| App Service Plan | asp | asp-{project}-{env} | 40 |
| App Service | app | app-{project}-{env} | 60 |
| SQL Server | sql | sql-{project}-{env} | 63 |
| SQL Database | sqldb | sqldb-{project}-{env} | 128 |
| Static Web App | stapp | stapp-{project}-{env} | 40 |
| Log Analytics | log | log-{project}-{env} | 63 |
| App Insights | appi | appi-{project}-{env} | 255 |
For extended abbreviations and length-constraint examples, read
references/naming-full-examples.md.
For the full Bicep + Terraform AVM module registry, read
references/avm-modules.md.
| Rule | Requirement |
|---|---|
| Exact text | Use template H2 text verbatim |
| Exact order | Required H2s in template-defined order |
| Anchor rule | Extra sections only AFTER last required H2 |
| No omissions | All template H2s must appear in output |
| Attribution | > Generated by {agent} agent | {YYYY-MM-DD} |
agent-output/{project}/Load these on demand — do NOT read all at once:
| Reference | When to Load |
|---|---|
references/naming-full-examples.md | Generating names for length-constrained resources |
references/avm-modules.md | Looking up AVM module paths or versions |
references/security-baseline-full.md | Debugging AVM parameter issues or checking deprecations |
references/pricing-guidance.md | Running cost estimates with Azure Pricing MCP |
references/service-matrices.md | Mapping user requirements to Azure service tiers |
references/waf-criteria.md | Scoring WAF pillar assessments |
references/governance-discovery.md | Discovering Azure Policy constraints |
references/policy-effect-decision-tree.md | Translating policy effects into plan/code actions |
references/adversarial-review-protocol.md | Running challenger-review-subagent passes |
references/azure-cli-auth-validation.md | Validating Azure CLI auth before deployments |
references/terraform-conventions.md | Generating Terraform (HCL) code |
references/research-workflow.md | Following the standard 4-step research pattern |