Skill Claude CodeCodex
Enforces Azure Cloud Adoption Framework naming and tagging conventions: validates resource names match the CAF pattern - - - - using the official abbreviation list, checks required tags (env, costCenter, owner, managedBy), detects missing or wrong type prefixes, and emits a regex pattern set consumable by the…
Skill Claude CodeCodex
Reviews GitHub Actions deployment workflow security beyond azure-bicep-patterns' what-if check. Flags long-lived service-principal secrets used instead of OIDC federated credentials, missing environment protection rules/approval gates on production deploys, deployment identities granted broader roles than the…
Skill Claude CodeCodex
Reviews the ACA / App Service compute host a .NET API lands on — the target azure-aks-governance's Kubernetes checks don't cover. Flags external ingress with no auth/IP restriction, secrets as plaintext env vars instead of secretRef/Key Vault references, minReplicas 0 on a latency-sensitive API or no maxReplicas cap…
Skill Claude CodeCodex
Reviews container image security for AKS/ACA workloads — the image-build-time layer above azure-aks-governance's pod-spec runtime checks. Flags no base-image vulnerability scanning in the build pipeline, images running as root with no non-root user configured, a full OS base image used where a distroless/minimal image…
Skill Claude CodeCodex
Goes beyond the WAF-COST pillar checklist into concrete FinOps tooling — budgets with alert thresholds, autoscale right-sizing playbooks, and cost-anomaly detection. Flags no Azure Budget resource with action-group alerting, autoscale rules with no documented right-sizing review cadence, no cost-anomaly alerts…
Skill Claude CodeCodex
Turns the WAF Reliability pillar's checklist items into concrete Bicep disaster-recovery patterns. Flags a production workload with no paired-region secondary deployment, no Traffic Manager/Front Door failover routing configured, no documented RPO/RTO targets, and a database with no cross-region replication or…
Skill Claude CodeCodex
Reviews the edge tier fronting an Angular SPA + public API — Azure Front Door or App Gateway with a Web Application Firewall (WAF) policy. The edge network firewall, NOT azure-waf-review (which is the Well-Architected Framework review). Flags a public API/SPA with no edge WAF, a policy left in Detection mode never…
Skill Claude CodeCodex
Reviews Azure provisioning of the secret/config store that dotnet-secrets-rotation, dotnet-dynamic-configuration, and dotnet-feature-flags consume. Flags inline secrets instead of Key Vault references, App Configuration via connection string not managed identity, no Key Vault soft-delete/purge-protection, flags in App…
Skill Claude CodeCodex
Reviews enterprise-scale subscription/management-group topology — one level above azure-caf-naming's resource-name-string scope. Flags no management-group hierarchy separating platform from landing-zone subscriptions, a single subscription hosting both production and non-production workloads with no isolation…
Skill Claude CodeCodex
Reviews Azure observability design beyond the WAF-OPS pillar checklist. Flags missing centralized Log Analytics workspace design (per-resource-group workspaces instead of one shared workspace with RBAC), Application Insights sampling left at defaults for high-volume APIs, no alert rules/action groups defined for…
Skill Claude CodeCodex
Checks Azure Bicep resources against the Microsoft security baseline: blocks public blob storage, flags PaaS services without private endpoints, verifies managed identity authentication over connection-string keys, validates Key Vault secret references, checks RBAC least-privilege (no Owner/Contributor at subscription…
Skill Claude CodeCodex
Reviews the Azure infrastructure that scales real-time SignalR — the provisioning side dotnet-realtime RT-002 assumes. Flags a multi-replica app hosting SignalR with no Azure SignalR Service or Redis backplane resource, Default/Serverless service-mode mismatch, the service wired by access key instead of managed…