agentmods.dev

iac-security

iac-security is a skill for Claude Code, Codex from vinayaklatthe/microsoft-security-skills. It costs 243 tokens per session (2,452 once invoked), scanned A, original, MIT.

Guidance for securing infrastructure defined as code, such as Bicep, ARM, and Terraform files, together with the pipelines that deploy them to Azure. Infrastructure as code means describing cloud resources in files so they can be created automatically.

In plain words
What is it for?
Use it when securing Azure infrastructure pipelines in GitHub Actions, Azure DevOps, or GitLab, including checks for misconfiguration, secrets, supply-chain risks, and deployment policy violations.
Why use it?
It helps catch unsafe cloud settings during code review or deployment instead of after release. It covers scanning, policy checks, secret handling, pipeline identity, permission controls, and configuration drift.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

not rated 172repo +1 2mo ago A scan 243 tokens original MIT

Good fit Use it when securing Azure infrastructure pipelines in GitHub Actions, Azure DevOps, or GitLab, including checks for misconfiguration, secrets, supply-chain risks, and deployment policy violations.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/vinayaklatthe/microsoft-security-skills/iac-security
View source ↗ vinayaklatthe/microsoft-security-skills
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add vinayaklatthe/microsoft-security-skills --skill iac-security
Clone the repo
git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for iac-security

README.md
[![agentmods](https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/iac-security/github.svg)](https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/iac-security)
Your own site
<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/iac-security"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/iac-security/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for iac-security

Your own site · 80×15
<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/iac-security"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/iac-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 243 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,452 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00243 $0.02452
Opus 5 $0.00121 $0.01226
Sonnet 5 $0.00049 $0.00490
Haiku 4.5 $0.00024 $0.00245

Measured 11d ago against content hash 11203049e50a, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

iac-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/iac-security/SKILL.md · 172 lines

How it starts

The opening of the file, as written. The whole thing — 172 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Infrastructure-as-Code Security on Azure

Most cloud breaches now route through misconfigured infrastructure that was provisioned by code. Hardening the IaC pipeline — Bicep, ARM, Terraform, and the CI/CD that runs them — moves security left of the deploy: misconfigurations get caught at PR review instead of in a Defender for Cloud finding three weeks later.

When to use

Designing or hardening the IaC pipeline (GitHub Actions / Azure DevOps / GitLab) for Azure, including scanning, policy-as-code, pipeline identity, and supply-chain controls.

Do not use this skill for K8s admission control alone (defender-for-containers), general CI/CD architecture, or app-layer security.

Capability stack

Layer Capability
Pipeline identity OIDC federation (no client secrets), Workload Identities Premium
Pre-commit / PR-time scanning Microsoft Security DevOps (MSDO) Action / Extension; Bicep linter; tflint; checkov; trivy; secret scanning
Policy-as-code gate Azure Policy in Audit and Deny modes at deploy; CI evaluation via az policy what-if, Terraform azapi policy preview
Posture connect-back Defender for Cloud DevOps Security connectors to GitHub / Azure DevOps
Drift detection Defender for Cloud, Terraform plan in scheduled CI, GitOps controllers (Flux/ArgoCD) on AKS
Supply chain Signed commits, dependency review, artifact signing (Notation/cosign), allowed module registries

Approach

  1. Replace pipeline secrets with OIDC federation. Every modern Azure CI integration supports federated workload identity:

    • GitHub Actions → Azure: federated credential on user-assigned MI; no AZURE_CREDENTIALS JSON secret.
    • Azure DevOps → Azure: Workload Identity federation service connection. Pin federated credentials to specific environments / branches (environment:prod, not repo:org/repo:*). See entra-workload-identity.

  2. Minimum scopes for pipeline identity. Per-pipeline service principal/MI with role assignments at RG / resource scope, not subscription Owner. Use deployment stacks (Bicep) for blast-radius containment.

Read the full file on GitHub · 172 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 11d ago First seen · 172 lines · 243 tokens per session scan A 11203049e50a

Subscribe to this mod's changes

iac-security is a skill published in the GitHub repository vinayaklatthe/microsoft-security-skills (172 stars, last pushed 2mo ago), licensed MIT. It adds 243 tokens to every session and 2,452 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

CloudDevOps and cloudSecurityai-agentscopilotdefenderentraentra-idmicrosoft
Related

Other skills, from other repositories

deepspeed

Expert guidance for distributed training with DeepSpeed - ZeRO optimization stages, pipeline parallelism, FP16/BF16/FP8, 1-bit Adam, sparse attention.

davila7/claude-code-templates · 38 tokens

agents-sdk-provision

Use when provisioning Azure resources for a Microsoft Agents SDK application — including creating an Azure Bot Service resource, setting up Entra app registrations, configuring identity credentials (UserManagedIdentity, FederatedCredentials, or ClientSecret), adding a Teams channel, running Bicep deployments for SSO…

microsoft/Agents · 131 tokens

detecting-azure-service-principal-abuse

Detect and investigate Azure service principal abuse including privilege escalation, credential compromise, admin consent bypass, and unauthorized enumeration in Microsoft Entra ID environments.

xalgorix/xalgorix · 38 tokens

detecting-azure-lateral-movement

Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.

xalgorix/xalgorix · 54 tokens

aspire

Build, upgrade, and operate Aspire 13.5.x C# or TypeScript application hosts with the current CLI, AppHost, ServiceDefaults, integrations, dashboard, testing, MCP, and deployment patterns for distributed apps. USE FOR: Aspire.AppHost.Sdk, Aspire.Hosting., DistributedApplication.CreateBuilder, apphost.mts…

managedcode/dotnet-skills · 145 tokens

azure-functions

Build, review, or migrate Azure Functions in .NET with correct execution model, isolated worker setup, bindings, DI, and Durable Functions patterns. USE FOR: working on Azure Functions in .NET; migrating from the in-process model to the isolated worker model; adding Durable Functions, bindings, or host configuration.…

managedcode/dotnet-skills · 113 tokens