azure-sweep

Skill: azure-sweep

Runs the full 8-layer Azure governance sweep using the Azure Sweeper agent.

Description

Executes a prioritised compliance sweep across WAF, CAF, Landing Zone, Policy, Org Rules, Resource Graph, Telemetry, and Remediation layers. Outputs a structured findings report with Bicep, Terraform, and CLI remediation code.

When to Use

• Before a production deployment
• After an environment is provisioned
• During quarterly compliance reviews
• When Advisor or Defender alerts spike
• When onboarding an existing subscription into CAF governance

Prerequisites

Requirement	Check
Azure CLI authenticated	az account show
Correct subscription selected	az account set --subscription <id>
Resource Graph extension installed	az extension add --name resource-graph
Instruction files present	presets/azure-iac/.github/instructions/
Org rules initialised (optional)	.github/instructions/org-rules.instructions.md

Steps

Step 0 — Scope & Setup

Confirm scope before running:

# Set scope variables
$subscriptionId = (az account show --query id -o tsv)
$rg = "<resource-group>"   # or "ALL" for subscription-wide

Write-Host "Sweeping subscription: $subscriptionId"
Write-Host "Resource group scope: $rg"

---

Step 1 — WAF Layer

# Fetch Azure Advisor WAF recommendations
az advisor recommendation list `
  --filter "Category eq 'HighAvailability' or Category eq 'Security' or Category eq 'Cost' or Category eq 'OperationalExcellence' or Category eq 'Performance'" `
  --output json | ConvertFrom-Json | `
  Select-Object category, impact, shortDescription, resourceMetadata

Pass gate: No CRITICAL Advisor items in Reliability or Security pillars.

---

Step 2 — CAF Layer

# Management group placement
az account management-group list --output table

# Tag compliance per resource group
az group list --query "[].{RG:name, Tags:tags}" --output json | ConvertFrom-Json | `
  Where-Object { -not $_.Tags.Environment -or -not $_.Tags.Owner -or -not $_.Tags.CostCenter }