azure-defaults
Maintains a single source of truth for Azure resource configuration, including tagging, regions, and naming policies.
Install
mkdir -p .claude/skills/azure-defaults && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/14902" && unzip -o skill.zip -d .claude/skills/azure-defaults && rm skill.zipInstalls to .claude/skills/azure-defaults
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Azure infrastructure defaults: regions, tags, naming (CAF), AVM-first policy, security baseline, unique suffix patterns. USE FOR: any agent generating or planning Azure resources. DO NOT USE FOR: artifact template structures (use azure-artifacts), pricing lookups (read references/pricing-guidance.md on demand).Key capabilities
- →Define default Azure regions for all resources and specific services like Static Web Apps.
- →Specify required Azure tags, including `Environment`, `ManagedBy`, `Project`, and `Owner`.
- →Generate a unique suffix pattern for globally unique Azure resource names.
- →Apply a security baseline with settings for HTTPS-only, TLS minimum, and public blob access.
- →Adhere to CAF naming conventions for various Azure resources like Resource Groups and Virtual Networks.
- →Prioritize Azure Verified Modules (AVM) for resource deployment.
How it works
The skill provides a single source of truth for Azure infrastructure configuration, detailing default regions, required tags, naming conventions, and security baselines. It guides agents in generating or planning Azure resources by applying these predefined standards.
Inputs & outputs
When to use azure-defaults
- →Setting up Azure resource tags
- →Defining region defaults for deployments
- →Ensuring infrastructure naming compliance
About this skill
Azure Defaults Skill
Single source of truth for Azure infrastructure configuration.
Deep-dive content lives in references/ — load on demand.
Quick Reference (Load First)
Default Regions
| Service | Default Region | Reason |
|---|---|---|
| All resources | swedencentral | EU GDPR-compliant |
| Static Web Apps | westeurope | Not available in swedencentral |
| Failover | germanywestcentral | EU paired alternative |
Required Tags (Azure Policy Enforced)
These 4 tags are the MINIMUM baseline. Always defer to
04-governance-constraints.md for the actual required tag list.
| Tag | Required | Example Values |
|---|---|---|
Environment | Yes | dev, staging, prod |
ManagedBy | Yes | Bicep or Terraform |
Project | Yes | Project identifier |
Owner | Yes | Team or individual name |
Tag Casing Rule: Use PascalCase exactly as shown above (
Environment,ManagedBy,Project,Owner). Never emit bothownerandOwnerorenvironmentandEnvironmentin the same template — Azure Policy treats case-variant tag keys as ambiguous evaluation paths (AmbiguousPolicyEvaluationPathserror).
Unique Suffix Pattern
Generate ONCE, pass to ALL modules:
var uniqueSuffix = uniqueString(resourceGroup().id)
Security Baseline (5-Line Summary)
| Setting | Value | Applies To |
|---|---|---|
| HTTPS-only | true | Storage, all |
| TLS minimum | 'TLS1_2' | All services |
| Public blob access | false | Storage |
| Public network (prod) | 'Disabled' | Data services |
| Authentication | Managed Identity | Prefer over keys |
For AVM pitfalls and deprecation patterns, read
references/security-baseline-full.md.
Deprecated Services (Do NOT Recommend for Greenfield)
| Deprecated Service | Replacement | Since | Notes |
|---|---|---|---|
| Azure AD B2C | Microsoft Entra External ID | May 2025 | Not available for new tenants |
| Redis Enterprise E50 | Azure Managed Redis (Enterprise) | March 2027 | Plan migration before EOL |
| CDN WAF (classic) | Front Door Standard/Premium WAF | 2025 | CDN WAF creation blocked |
| App Gateway v1 | App Gateway v2 | April 2026 | Classic SKU retiring |
| CDN Standard Microsoft | Front Door Standard | 2027 | Migration required |
Rule: Never recommend deprecated services for greenfield projects. Before recommending any service with a multi-year RI commitment, verify the service retirement timeline extends beyond the commitment period. Check Microsoft Learn deprecation announcements.
CAF Naming Conventions
| Resource | Abbr | Pattern | Max |
|---|---|---|---|
| Resource Group | rg | rg-{project}-{env} | 90 |
| Virtual Network | vnet | vnet-{project}-{env} | 64 |
| Subnet | snet | snet-{purpose}-{env} | 80 |
| NSG | nsg | nsg-{purpose}-{env} | 80 |
| Key Vault | kv | kv-{short}-{env}-{suffix} | 24 |
| Storage Account | st | st{short}{env}{suffix} | 24 |
| App Service Plan | asp | asp-{project}-{env} | 40 |
| App Service | app | app-{project}-{env} | 60 |
| SQL Server | sql | sql-{project}-{env} | 63 |
| SQL Database | sqldb | sqldb-{project}-{env} | 128 |
| Static Web App | stapp | stapp-{project}-{env} | 40 |
| Log Analytics | log | log-{project}-{env} | 63 |
| App Insights | appi | appi-{project}-{env} | 255 |
For extended abbreviations and length-constraint examples, read
references/naming-full-examples.md.
Azure Verified Modules (AVM)
- ALWAYS check AVM availability first
- Use AVM defaults for SKUs when available
- NEVER write raw Bicep/TF for a resource that has an AVM module
For the full Bicep + Terraform AVM module registry, read
references/avm-modules.md.
Template-First Output Rules
| Rule | Requirement |
|---|---|
| Exact text | Use template H2 text verbatim |
| Exact order | Required H2s in template-defined order |
| Anchor rule | Extra sections only AFTER last required H2 |
| No omissions | All template H2s must appear in output |
| Attribution | > Generated by {agent} agent | {YYYY-MM-DD} |
Validation Checklist
- Output saved to
agent-output/{project}/ - All required H2 headings present and correctly ordered
- All 4 required tags included in resource definitions
- Unique suffix used for globally unique names
- Security baseline settings applied
- Region defaults correct
Reference Index
Load these on demand — do NOT read all at once:
| Reference | When to Load |
|---|---|
references/naming-full-examples.md | Generating names for length-constrained resources |
references/avm-modules.md | Looking up AVM module paths or versions |
references/security-baseline-full.md | Debugging AVM parameter issues or checking deprecations |
references/pricing-guidance.md | Running cost estimates with Azure Pricing MCP |
references/service-matrices.md | Mapping user requirements to Azure service tiers |
references/waf-criteria.md | Scoring WAF pillar assessments |
references/governance-discovery.md | Discovering Azure Policy constraints |
references/policy-effect-decision-tree.md | Translating policy effects into plan/code actions |
references/adversarial-review-protocol.md | Running challenger-review-subagent passes |
references/azure-cli-auth-validation.md | Validating Azure CLI auth before deployments |
references/terraform-conventions.md | Generating Terraform (HCL) code |
references/research-workflow.md | Following the standard 4-step research pattern |
When not to use it
- →When artifact template structures are needed, use `azure-artifacts`.
- →When pricing lookups are needed, read `references/pricing-guidance.md` on demand.
- →When recommending deprecated services for greenfield projects.
Limitations
- →It does not handle artifact template structures.
- →It does not provide pricing lookups.
- →It does not recommend deprecated services for new projects.
How it compares
This skill centralizes Azure configuration standards, ensuring consistent and compliant deployments, unlike manual configuration which can lead to inconsistencies and policy violations.
Compared to similar skills
azure-defaults side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| azure-defaults (this skill) | 0 | 4mo | No flags | Beginner |
| aws-solution-architect | 20 | 3mo | Review | Advanced |
| terraform-module-library | 7 | 5mo | No flags | Advanced |
| azure-deployment-preflight | 7 | 6mo | Review | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
aws-solution-architect
alirezarezvani
Design AWS architectures for startups using serverless patterns and IaC templates. Use when asked to design serverless architecture, create CloudFormation templates, optimize AWS costs, set up CI/CD pipelines, or migrate to AWS. Covers Lambda, API Gateway, DynamoDB, ECS, Aurora, and cost optimization.
terraform-module-library
wshobson
Build reusable Terraform modules for AWS, Azure, and GCP infrastructure following infrastructure-as-code best practices. Use when creating infrastructure modules, standardizing cloud provisioning, or implementing reusable IaC components.
azure-deployment-preflight
github
Performs comprehensive preflight validation of Bicep deployments to Azure, including template syntax validation, what-if analysis, and permission checks. Use this skill before any deployment to Azure to preview changes, identify potential issues, and ensure the deployment will succeed. Activate when users mention deploying to Azure, validating Bicep files, checking deployment permissions, previewing infrastructure changes, running what-if, or preparing for azd provision.
terraform-azurerm-set-diff-analyzer
github
Analyze Terraform plan JSON output for AzureRM Provider to distinguish between false-positive diffs (order-only changes in Set-type attributes) and actual resource changes. Use when reviewing terraform plan output for Azure resources like Application Gateway, Load Balancer, Firewall, Front Door, NSG, and other resources with Set-type attributes that cause spurious diffs due to internal ordering changes.
terraform-skill
sickn33
Terraform infrastructure as code best practices
aws-advisor
tech-leads-club
Expert AWS Cloud Advisor for architecture design, security review, and implementation guidance. Leverages AWS MCP tools for accurate, documentation-backed answers. Use when user asks about AWS architecture, security, service selection, migrations, troubleshooting, or learning AWS. Triggers on AWS, Lambda, S3, EC2, ECS, EKS, DynamoDB, RDS, CloudFormation, CDK, Terraform, Serverless, SAM, IAM, VPC, API Gateway, or any AWS service.