azure-expert

What this skill does

# Azure Expert

## Overview

Transform into an Azure cloud expert with comprehensive knowledge of Azure services, architecture patterns, deployment strategies, and best practices. This skill provides everything needed to design, deploy, troubleshoot, and optimize Azure solutions across all major services and technology stacks.

## Core Capabilities

### 1. Service Selection & Architecture Design
Guide users through selecting the right Azure services for their needs using decision trees and comparison matrices. Reference `references/compute_services.md` and `references/database_services.md` for detailed service comparisons.

When users ask "which service should I use" or "how do I build X on Azure", consult the reference files to provide informed recommendations based on:
- Workload characteristics (compute, data, event-driven)
- Scalability requirements
- Budget constraints
- Technical stack compatibility
- Compliance and security needs

### 2. Infrastructure Deployment
Deploy Azure resources using Infrastructure as Code (IaC) with Bicep templates. Ready-to-use templates are available in `assets/`:

**Available Templates:**
- `webapp-template.bicep`: Complete web application infrastructure (App Service, SQL Database, Storage, Key Vault, Application Insights) with managed identity, monitoring, and security best practices
- `function-app-template.bicep`: Azure Functions setup (Consumption/Premium plans) with all supporting services
- `github-workflow-webapp.yml`: Full CI/CD pipeline with build, test, staging deployment, and production slot swap

**Usage Pattern:**
1. Identify the required Azure services
2. Select or customize appropriate template from `assets/`
3. Deploy using Azure CLI:
   ```bash
   az deployment group create \
     --resource-group myapp-rg \
     --template-file assets/webapp-template.bicep \
     --parameters appName=myapp environment=prod
   ```
4. Configure post-deployment steps (database permissions, secrets, CI/CD)

### 3. Automated Operations
Execute common Azure operations using Python scripts in `scripts/`:

**deploy_webapp.py**
- Deploy web apps to Azure App Service with proper configuration
- Supports multiple runtimes: .NET, Node.js, Python, Java, PHP
- Automatically configures Application Insights, creates service plans, enables monitoring
- Usage: `python scripts/deploy_webapp.py --resource-group mygroup --name myapp --runtime "DOTNET:8.0"`

**resource_status.py**
- Check status and health of Azure resources
- Supports: Web Apps, Function Apps, Container Apps, SQL Databases
- Provides detailed diagnostics including logs, availability, configuration
- Usage: `python scripts/resource_status.py --resource-group mygroup --type webapp --name myapp`

**cost_analyzer.py**
- Analyze Azure costs by resource group and service
- Identifies expensive resources and optimization opportunities
- Provides actionable recommendations for cost savings
- Usage: `python scripts/cost_analyzer.py --resource-group mygroup --days 30`

**When to Use Scripts:**
- User asks to "deploy" or "create" Azure resources
- User needs to "check status" or "troubleshoot" resources
- User wants to "analyze costs" or "optimize spending"
- Automating repetitive Azure operations

### 4. CI/CD Pipeline Setup
Configure automated deployment pipelines using GitHub Actions or Azure DevOps. The `assets/github-workflow-webapp.yml` template provides:
- Multi-runtime support (.NET, Node.js, Python)
- Build, test, and artifact creation
- Staging slot deployment
- Smoke testing
- Production slot swap with approval gates
- Zero-downtime deployments

**Setup Process:**
1. Copy `assets/github-workflow-webapp.yml` to `.github/workflows/` in user's repository
2. Create Azure Service Principal for GitHub Actions authentication
3. Configure GitHub secrets (AZURE_CREDENTIALS)
4. Customize environment variables in workflow file
5. Set up GitHub environments for staging/production approval gates

### 5. Troubleshooting & Diagnostics
When users encounter Azure issues, follow this diagnostic workflow:

1. **Identify the service and error**
   - Read error messages, logs, or HTTP status codes
   - Determine which Azure service is affected

2. **Check resource status**
   - Use `scripts/resource_status.py` to check health and configuration
   - Review Application Insights for detailed telemetry
   - Check Azure Portal for service health alerts

3. **Common issue patterns:**
   - **Authentication errors**: Check managed identity configuration, RBAC assignments
   - **Connection failures**: Verify firewall rules, private endpoints, NSG rules
   - **Performance issues**: Check service tier, scaling configuration, query performance
   - **Deployment failures**: Review deployment logs, check quotas, validate templates

4. **Reference documentation**
   - Consult `references/best_practices.md` for troubleshooting patterns
   - Check service-specific sections in reference files

### 6. Cost Optimization
Proactively identify cost-saving opportunities:

1. **Run cost analysis**: Use `scripts/cost_analyzer.py` to identify expensive resources
2. **Review recommendations** from the script output
3. **Apply optimizations**:
   - Right-size over-provisioned resources
   - Enable autoscaling for variable workloads
   - Use Reserved Instances for predictable workloads (up to 72% savings)
   - Use Spot VMs for fault-tolerant workloads (up to 90% savings)
   - Delete unused resources (orphaned disks, old backups)
   - Move infrequently accessed data to Cool/Archive storage tiers

4. **Reference**: See "Cost Optimization" section in `references/best_practices.md` for comprehensive strategies

### 7. Security & Compliance
Implement Azure security best practices:

**Authentication & Authorization:**
- Always use managed identities instead of connection strings/keys
- Implement RBAC with principle of least privilege
- Use Azure AD authentication for databases

**Data Protection:**
- Enable Transparent Data Encryption (TDE) for databases
- Use HTTPS/TLS for all communications
- Store secrets in Azure Key Vault
- Enable Azure Disk Encryption for VMs

**Network Security:**
- Use private endpoints for VNet integration
- Configure Network Security Groups (NSG)
- Enable Azure DDoS Protection for public-facing apps
- Implement Web Application Firewall (WAF)

**Reference**: See "Security Best Practices" in `references/best_practices.md`

### 8. Monitoring & Observability
Implement comprehensive monitoring:

**Application Insights:**
- Automatically configured in Bicep templates
- Tracks requests, exceptions, dependencies, custom events
- Provides distributed tracing for microservices

**Log Analytics:**
- Centralized log aggregation
- KQL queries for advanced analysis
- Custom dashboards and workbooks

**Alerting:**
- Configure metric-based alerts (CPU, memory, response time)
- Set up log-based alerts for specific patterns
- Create action groups for notifications (email, SMS, webhooks)

**Reference**: See "Monitoring & Observability" in `references/best_practices.md`

## Working with Azure Services

### Compute Services
Reference `references/compute_services.md` for comprehensive guidance on:
- **App Service**: Web apps, APIs, mobile backends
- **Azure Functions**: Serverless, event-driven compute
- **Container Apps**: Managed Kubernetes-based containers
- **AKS**: Full Kubernetes control
- **Virtual Machines**: Legacy apps, lift-and-shift
- **Static Web Apps**: JAMstack, SPAs

The reference includes service comparison matrices, pricing tiers, best practices, configuration examples, and decision trees.

### Database Services
Reference `references/database_services.md` for detailed information on:
- **Azure SQL Database**: SQL Server managed service
- **Cosmos DB**: Globally distributed NoSQL
- **PostgreSQL/MySQL**: Managed open-source databases
- **Redis Cache**: In-memory caching
- **Table Storage**: Simple key-value storage

The reference covers consistency models, connection strings, security configuration,