cloud-cli-safety

Why

This skill exists because of a specific outage.

An AI assistant was asked to update the liveness probe on an Azure Container App. It generated a small YAML file containing only the probes: block and ran:

az containerapp update --yaml probes-only.yaml

The Azure Resource Manager API treats --yaml as a full-resource replacement, not a patch. Every field absent from the file was reset to its default. Within seconds:

• CPU dropped from 2.0 cores to 0.5 (default) — 75% capacity loss.
• Memory dropped from 4 GiB to 1 GiB — 75% loss.
• Every environment variable was deleted, including database connection strings and third-party API keys.
• Liveness probes started failing because the app could no longer reach the database.
• The service was effectively down until env vars were restored from a separate vault and the container was re-provisioned.

The agent did exactly what it was told. The CLI did exactly what it was documented to do. The failure was at the seam: the agent did not query the existing state, did not show the operator the full blast radius, and did not prepare a rollback before pressing enter.

This is not an Azure-specific failure mode. The same shape exists in:

• aws lambda update-function-configuration --environment "Variables={ONLY_ONE=value}" — replaces, does not merge.
• gcloud projects set-iam-policy PROJECT policy.json — overwrites all IAM bindings.
• gcloud run services update SERVICE --set-env-vars ONLY_ONE=value — clears the rest.
• kubectl apply -f partial.yaml against a resource managed elsewhere — race condition + field reset.
• terraform apply against drifted state — destroys whatever the state file no longer remembers.

The rule is the same on every cloud: query → display → confirm → execute → verify → keep rollback ready.

When to apply

Apply whenever the agent is about to invoke any of:

• az (any subcommand that is not pure read: show, list, get-*)
• aws (any subcommand starting with create, update, delete, put, start, stop, terminate, attach, detach, set-)
• gcloud / gsutil (any subcommand that is not pure read)
• kubectl (apply, create, delete, patch, replace, scale, rollout, cordon, drain, taint)
• helm (install, upgrade, uninstall, rollback)
• terraform (apply, destroy, import, state mv, state rm, taint)
• Any custom wrapper script (./deploy.sh, make deploy) where the body is unknown to the agent