mcpbeat Sign in

Apiops Deployment Agent Skill

by thomast1906

Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep/Terraform), CI/CD pipelines (GitHub Actions/Azure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.

6k tokens
context cost
the whole folder, loaded on every use
2
files
instructions only
0
copies elsewhere
how many repositories repackaged it
192
stars on the repo
on the repository, not the skill itself

Install

one command, takes just this skill from the repository 
npx skills add https://github.com/thomast1906/github-copilot-agent-skills --skill apiops-deployment

The instruction itself

25 sections, as written by the author

APIOps Deployment Skill

Provides Infrastructure as Code (Bicep/Terraform) templates and CI/CD pipeline patterns for deploying Azure API Management following APIOps principles and phased deployment strategies.

When to Use This Skill

Activate this skill when users need:

  • Infrastructure deployment: Generate Bicep/Terraform for APIM, Front Door, VNet, supporting services
  • CI/CD pipelines: Create GitHub Actions or Azure DevOps workflows for APIOps
  • Environment promotion: Implement dev → test → prod deployment workflows
  • Configuration management: Environment-specific parameters (dev/test/prod)
  • Disaster recovery: Backup/restore procedures, blue-green deployments
  • Phased rollout: Follow deployment planning guide with 7 phases over 17 weeks

Phased Deployment Strategy

See DEPLOYMENT_PLANNING_GUIDE.md for complete 17-week, 7-phase plan

Phase Summary

| Phase | Duration | Focus | Key Deliverables |

|-------|----------|-------|------------------|

| 1 | Week 1-2 | Core Infrastructure | VNet, APIM(dev), Front Door, Key Vault, monitoring |

| 2 | Week 3-4 | Authentication & IAM | Entra ID, Entra External ID, OAuth policies|

| 3 | Week 5-8 | API Onboarding (Dev) | 5 pilot APIs, policies, developer portal |

| 4 | Week 9-10 | Production Infrastructure | APIM(prod) Premium 3u, zone-redundant |

| 5 | Week 11-12 | Production APIs | Migrate 5 pilot APIs, performance testing |

| 6 | Week 13-15 | Governance & Scaling | API Center, additional APIs, APIOps automation |

| 7 | Week 16-17 | Operations Handoff | Runbooks, training, monitoring dashboards |

Important: MCP Tools (ALWAYS Use Before Code Generation)

1. Get Azure Verified Modules (AVM)

BEFORE writing any Bicep, check for Azure Verified Modules:

Tool: azure_bicep-get_azure_verified_module
ResourceType: "Microsoft.ApiManagement/service"

Why: AVM modules follow Microsoft best practices, reduce code duplication, tested at scale

2. Call Deployment Best Practices FIRST

Tool: mcp_azure_mcp_get_azure_bestpractices
Intent: "Azure API Management deployment best practices Bicep"

3. Search Deployment Documentation

Tool: mcp_azure_mcp_documentation search
Query: "APIM VNet Internal Bicep deployment"

Infrastructure as Code Templates

See references/IaC_TEMPLATES.md for complete Bicep/Terraform templates

Quick Bicep Example: Production APIM

param location string = 'uksouth'
param apimName string = 'apim-api-marketplace-prod-uks'
param publisherEmail string = '[email protected]'
param publisherName string = 'API Marketplace Team'
param vnetName string = 'vnet-apim-prod-uks'
param subnetName string = 'snet-apim'

resource vnet 'Microsoft.Network/virtualNetworks@2023-04-01' existing = {
  name: vnetName
}

resource apim 'Microsoft.ApiManagement/service@2023-05-01-preview' = {
  name: apimName
  location: location
  sku: {
    name: 'Premium'
    capacity: 3 // Zone-redundant: 3 units across 3 availability zones
  }
  properties: {
    publisherEmail: publisherEmail
    publisherName: publisherName
    virtualNetworkType: 'Internal' // VNet Internal mode
    virtualNetworkConfiguration: {
      subnetResourceId: '${vnet.id}/subnets/${subnetName}'
    }
    customProperties: {
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls10': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls11': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Ssl30': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls10': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls11': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Ssl30': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TripleDes168': 'False'
    }
    disableGateway: false
  }
  identity: {
    type: 'SystemAssigned' // Managed Identity for Key Vault access
  }
  zones: [
    '1'
    '2'
    '3'
  ] // Zone redundancy for 99.99% SLA
}

output apimId string = apim.id
output managedIdentityPrincipalId string = apim.identity.principalId

Key Configuration:

  • VNet Internal mode (virtualNetworkType: 'Internal')
  • Premium SKU with 3 units (zone-redundant)
  • TLS 1.2+ only (disable weak protocols)
  • Managed Identity (no service accounts)
  • Zones [1, 2, 3] for 99.99% SLA

APIOps CI/CD Pipeline Pattern

GitHub Actions Workflow (Recommended)

name: APIOps - Deploy APIM Infrastructure

on:
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - 'infra/**'
      - '.github/workflows/deploy-infra.yml'

env:
  AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
  AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
  
jobs:
  # ===== Dev Environment =====
  deploy-dev:
    runs-on: ubuntu-latest
    environment: development
    steps:
      - uses: actions/checkout@v4
      
      - name: Azure Login
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ env.AZURE_TENANT_ID }}
          subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}
      
      - name: Deploy Bicep
        uses: azure/arm-deploy@v2
        with:
          scope: resourcegroup
          resourceGroupName: rg-apim-dev-uks
          template: ./infra/main.bicep
          parameters: ./infra/params/dev.bicepparam
          failOnStdErr: false
      
      - name: Smoke Test
        run: |
          # Verify APIM health endpoint
          curl -f https://management.azure.com/subscriptions/${{ env.AZURE_SUBSCRIPTION_ID }}/resourceGroups/rg-apim-dev-uks/providers/Microsoft.ApiManagement/service/apim-api-marketplace-dev-uks?api-version=2023-05-01-preview \
            -H "Authorization: Bearer $(az account get-access-token --query accessToken -o tsv)"
  
  # ===== Test Environment (After Dev) =====
  deploy-test:
    needs: deploy-dev
    runs-on: ubuntu-latest
    environment: test
    steps:
      # Same steps as dev, use test.bicepparam
      - uses: actions/checkout@v4
      - uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ env.AZURE_TENANT_ID }}
          subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}
      - uses: azure/arm-deploy@v2
        with:
          scope: resourcegroup
          resourceGroupName: rg-apim-test-uks
          template: ./infra/main.bicep
          parameters: ./infra/params/test.bicepparam
          failOnStdErr: false
  
  # ===== Production (Manual Approval Required) =====
  deploy-prod:
    needs: deploy-test
    runs-on: ubuntu-latest
    environment:
      name: production
      # GitHub environment protection rule: Require manual approval
    steps:
      - uses: actions/checkout@v4
      - uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ env.AZURE_TENANT_ID }}
          subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}
      
      - name: Deploy Production APIM
        uses: azure/arm-deploy@v2
        with:
          scope: resourcegroup
          resourceGroupName: rg-apim-prod-uks
          template: ./infra/main.bicep
          parameters: ./infra/params/prod.bicepparam
          failOnStdErr: false
      
      - name: Production Smoke Test
        run: |
          # Verify Front Door → APIM connectivity
          curl -f https://api.yourdomain.com/health
      
      - name: Tag Release
        run: |
          git tag -a "apim-prod-$(date +%Y%m%d-%H%M%S)" -m "Production deployment"
          git push origin --tags

Key Features:

  • Dev → Test → Prod progression (serial jobs with needs)
  • Manual approval for production (environment: production with protection rules)
  • Smoke tests after each deployment
  • Git tags for production releases (audit trail)
  • Federated credential authentication (no secrets in code)

Environment-Specific Parameters

dev.bicepparam

using './main.bicep'

param location = 'uksouth'
param environment = 'dev'
param apimSku = 'Developer' // £45/month
param apimCapacity = 1
param virtualNetworkType = 'Internal'
param enableFrontDoor = false // Dev: Direct APIM access
param tags = {
  Environment: 'Development'
  ManagedBy: 'IaC'
  CostCenter: 'Engineering'
}

prod.bicepparam

using './main.bicep'

param location = 'uksouth'
param environment = 'prod'
param apimSku = 'Premium' // £1,944/month (3 units)
param apimCapacity = 3 // Zone-redundant
param virtualNetworkType = 'Internal'
param enableFrontDoor = true // Prod: Front Door + Private Link
param enableApiCenter = true // £135/month
param tags = {
  Environment: 'Production'
  ManagedBy: 'IaC'
  CostCenter: 'Operations'
  Criticality: 'High'
}

Pattern: Single main.bicep template, environment-specific .bicepparam files for configuration

Backup & Restore Procedures

APIM Backup (Automated)

#!/bin/bash
# backup-apim.sh - Schedule daily via Azure Automation or GitHub Actions

APIM_NAME="apim-api-marketplace-prod-uks"
RESOURCE_GROUP="rg-apim-prod-uks"
STORAGE_ACCOUNT="stapimproduksbkp"
CONTAINER="apim-backups"
BACKUP_NAME="apim-backup-$(date +%Y%m%d-%H%M%S)"

# Trigger APIM backup to Storage Account
az apim backup create \
  --name "$APIM_NAME" \
  --resource-group "$RESOURCE_GROUP" \
  --storage-account-name "$STORAGE_ACCOUNT" \
  --storage-account-container "$CONTAINER" \
  --backup-name "$BACKUP_NAME"

echo "Backup created: $BACKUP_NAME"

APIM Restore (Disaster Recovery)

#!/bin/bash
# restore-apim.sh - Run during DR scenario

APIM_NAME="apim-api-marketplace-prod-uks"
RESOURCE_GROUP="rg-apim-prod-uks"
STORAGE_ACCOUNT="stapimproduksbkp"
CONTAINER="apim-backups"
BACKUP_NAME="apim-backup-20260128-120000" # Latest successful backup

# Restore APIM from backup
az apim backup restore \
  --name "$APIM_NAME" \
  --resource-group "$RESOURCE_GROUP" \
  --storage-account-name "$STORAGE_ACCOUNT" \
  --storage-account-container "$CONTAINER" \
  --backup-name "$BACKUP_NAME"

echo "APIM restored from backup: $BACKUP_NAME"

Backup Retention:

  • Daily backups for 30 days (Azure Storage lifecycle policy)
  • Weekly backups for 12 weeks
  • Monthly backups for 12 months
  • Geo-redundant storage (GRS) to UK West

Deployment Validation Checklist

Before production deployment, verify:

  • Infrastructure Code: Bicep/Terraform linted and validated (az bicep build, terraform validate)
  • Network Configuration: VNet Internal mode, Private Link configured
  • Security: TLS 1.2+, weak protocols disabled, Key Vault integration
  • Authentication: OAuth policies deployed, Entra ID/External ID configured
  • Rate Limiting: All APIs have rate-limit-by-key policies
  • Monitoring: Application Insights, diagnostic logs, alerts configured
  • Backups: Automated daily backups to GRS storage
  • Smoke Tests: Health endpoints responding, Front Door → APIM connectivity verified
  • Manual Approval: Production deployment requires human approval (GitHub environment protection)
  • Rollback Plan: Previous Bicep/Terraform state in Git, APIM backup available

Common Deployment Issues & Solutions

Issue: APIM VNet Integration Fails

Error: The subnet is not valid for API Management instance

Solution:

  • Ensure subnet size ≥ /27 (32 IPs minimum)
  • Subnet must not have any other resources
  • Delegate subnet to Microsoft.ApiManagement/service:
   delegations: [
     {
       name: 'delegation'
       properties: {
         serviceName: 'Microsoft.ApiManagement/service'
       }
     }
   ]

Issue: Private Link Connection Pending

Error: Front Door → APIM Private Link status Pending Approval

Solution:

  • Approve Private Endpoint connection in APIM:
   az network private-endpoint-connection approve \
     --resource-name apim-api-marketplace-prod-uks \
     --resource-group rg-apim-prod-uks \
     --name <connection-name> \
     --type Microsoft.ApiManagement/service
  • Verify status:
   az network private-endpoint-connection list \
     --name apim-api-marketplace-prod-uks \
     --resource-group rg-apim-prod-uks \
     --type Microsoft.ApiManagement/service

Issue: Deployment Takes 45+ Minutes

Cause: APIM Premium with zone redundancy takes 30-60 minutes to deploy

Solution: Expected behavior. Use incremental deployments:

  • Day 1: Deploy APIM infrastructure (wait 45 min)
  • Day 2+: Deploy API configurations (fast, minutes)

Optimization: Use --what-if flag to preview changes without deploying

Related Skills

  • azure-apim-architecture - Understand architecture before deploying
  • apim-policy-authoring - Deploy policies as part of APIOps workflow
  • api-security-review - Validate security before production deployment

Microsoft Documentation

Skill Version: 1.0

Last Updated: 29 January 2026

Primary Knowledge: DEPLOYMENT_PLANNING_GUIDE.md, references/IaC_TEMPLATES.md

Other skills for the same job

different authors, same section of the catalogue
Azure Kubernetes Automatic Readiness
by microsoft
vendor ×3

Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility. Identifies incompatibilities, generates fixes, and guides migration from AKS Standard to AKS Automatic. WHEN: migrate to AKS Automatic, check AKS Automatic readiness, validate manifests for Automatic, assess cluster for Automatic compatibility, fix deployment for Automatic compatibility, identify AKS Automatic migration blockers, is my cluster ready for AKS Automatic.

13k tokens
Capacity
by microsoft
vendor ×3

Discovers available Azure OpenAI model capacity across regions and projects. Analyzes quota limits, compares availability, and recommends optimal deployment locations based on capacity requirements. USE FOR: find capacity, check quota, where can I deploy, capacity discovery, best region for capacity, multi-project capacity search, quota analysis, model availability, region comparison, check TPM availability. DO NOT USE FOR: actual deployment (hand off to preset or customize after discovery), quota increase requests (direct user to Azure Portal), listing existing deployments.

6k tokens scripts
Customize
by microsoft
vendor ×3

Interactive guided deployment flow for Azure OpenAI models with full customization control. Step-by-step selection of model version, SKU (GlobalStandard/Standard/ProvisionedManaged), capacity, RAI policy (content filter), and advanced options (dynamic quota, priority processing, spillover). USE FOR: custom deployment, customize model deployment, choose version, select SKU, set capacity, configure content filter, RAI policy, deployment options, detailed deployment, advanced deployment, PTU deployment, provisioned throughput. DO NOT USE FOR: quick deployment to optimal region (use preset).

8k tokens
Deploy Model
by microsoft
vendor ×3

Unified Azure OpenAI model deployment skill with intelligent intent-based routing. Handles quick preset deployments, fully customized deployments (version/SKU/capacity/RAI policy), and capacity discovery across regions and projects. USE FOR: deploy model, deploy gpt, create deployment, model deployment, deploy openai model, set up model, provision model, find capacity, check model availability, where can I deploy, best region for model, capacity analysis. DO NOT USE FOR: listing existing deployments (use foundry_models_deployments_list MCP tool), deleting deployments, agent creation (use agent/create), project creation (use project/create).

26k tokens scripts
Preset
by microsoft
vendor ×3

Intelligently deploys Azure OpenAI models to optimal regions by analyzing capacity across all available regions. Automatically checks current region first and shows alternatives if needed. USE FOR: quick deployment, optimal region, best region, automatic region selection, fast setup, multi-region capacity check, high availability deployment, deploy to best location. DO NOT USE FOR: custom SKU selection (use customize), specific version selection (use customize), custom capacity configuration (use customize), PTU deployments (use customize).

9k tokens
Lamindb
by christophacham
×3

This skill should be used when working with LaminDB, an open-source data framework for biology that makes data queryable, traceable, reproducible, and FAIR. Use when managing biological datasets (scRNA-seq, spatial, flow cytometry, etc.), tracking computational workflows, curating and validating data with biological ontologies, building data lakehouses, or ensuring data lineage and reproducibility in biological research. Covers data management, annotation, ontologies (genes, cell types, diseases, tissues), schema validation, integrations with workflow managers (Nextflow, Snakemake) and MLOps platforms (W&B, MLflow), and deployment strategies.

22k tokens
Latchbio Integration
by christophacham
×3

Latch platform for bioinformatics workflows. Build pipelines with Latch SDK, @workflow/@task decorators, deploy serverless workflows, LatchFile/LatchDir, Nextflow/Snakemake integration.

12k tokens
Modal
by christophacham
×3

Run Python code in the cloud with serverless containers, GPUs, and autoscaling. Use when deploying ML models, running batch processing jobs, scheduling compute-intensive tasks, or serving APIs that require GPU acceleration or dynamic scaling.

17k tokens

How to use it

Copy the folder

Take thomast1906/apiops-deployment from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.