| name | create-workspace |
| description | Provision a Microsoft.Chaos/workspaces resource (v2), bind a managed identity, set scopes, and grant Reader RBAC on the scope. |
CreateWorkspace — Chaos Studio Workspace Provisioning
⛔ ABSOLUTE RULE: Do NOT improvise, skip, or substitute any step. On ANY error, STOP and wait for the user.
When to use this skill (vs. the MCP server)
This skill is the human-interactive path: it persists state to startchaos-state.json, renders cards, and produces the workspace + identity + Reader RBAC in one go. Use it when there is a user in the loop.
If you are an autonomous agent with no user to prompt, call chaos_create_workspace on the chaos-studio MCP server. Same provisioning + identity binding + Reader RBAC, returned as a single tool call. See mcp/README.md.
Both surfaces target Microsoft.Chaos 2026-05-01-preview and use the local az login session for auth.
How It Works
All provisioning logic lives in scripts/Invoke-CreateWorkspace.ps1. The script handles input validation, workspace creation via az chaos workspace create (the CLI awaits the provisioning LRO), identity resolution, RBAC test/grant, and state persistence.
The AI orchestrator's only job is:
- Set
$env:STARTCHAOS_STATE_PATH to ${SESSION_DIR}/startchaos-state.json.
- Run the script with the required parameters.
- Handle exit codes that require user input (see below).
- Re-run with the user's answers as parameters.
Prerequisites
state.auth.status == "done" (run auth pre-flight first; the script refuses to start otherwise)state.context.subscriptionId populated
Running the Script
$env:STARTCHAOS_STATE_PATH = "<session-dir>/startchaos-state.json"
& "<skill-dir>/scripts/Invoke-CreateWorkspace.ps1" `
-ResourceGroup <rg> `
-WorkspaceName <name> `
-Scopes @('<arm-id>', ...) `
[-Location <region>] `
[-IdentityType SystemAssigned|UserAssigned] `
[-UserAssignedIdentityResourceId <uami-arm-id>]
Idempotent: re-runs short-circuit when state.workspace.status == "done".
Exit Codes → AI Actions
| Exit | Meaning | AI Action |
|---|
| 0 | Workspace ready | Done — summary already rendered by script. |
| 1 | Hard error | STOP. Render the error from script output. Wait for user. State has workspace.lastError. |
If a required parameter is missing, PowerShell's parameter binder fails before the script body runs — gather the missing input via ask_user and retry.
Script Parameters
| Parameter | Required | Default | Description |
|---|
-ResourceGroup | yes | — | Azure resource group name |
-WorkspaceName | yes | — | Name for the workspace resource |
-Scopes | yes | — | ARM IDs the workspace is allowed to target (subscription / RG / service group) |
-Location | no | westus2 | Azure region |
-IdentityType | no | SystemAssigned | SystemAssigned or UserAssigned |
-UserAssignedIdentityResourceId | conditional | — | Required when -IdentityType UserAssigned |
What the Script Handles (no AI logic needed)
- Input validation and ARM-ID well-formedness checks
- Workspace creation via
az chaos workspace create (identity + scopes)
- Provisioning LRO awaited by the CLI, with terminal-state surfacing
- Identity resolution (SystemAssigned principalId from response; UserAssigned via UAMI GET)
- Per-scope
Test-CallerCanAssignRoles + Reader role assignment with remediation card on denial
- Atomic state writes with error envelopes
- Idempotent re-runs
Related Skills
start-chaos — orchestrator that invokes this skillsetup-scenario — next phase after workspace creation
