Waf Assessment Agent Skill

by thomast1906

Assess Azure architectures against Well-Architected Framework (WAF) five pillars - Reliability, Security, Cost Optimization, Operational Excellence, and Performance Efficiency. Provide scores and recommendations.

2k tokens

context cost

the whole folder, loaded on every use

files

instructions only

copies elsewhere

how many repositories repackaged it

192

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/thomast1906/github-copilot-agent-skills --skill waf-assessment

The instruction itself

14 sections, as written by the author

Well-Architected Framework Assessment Skill

Evaluate Azure architectures against Microsoft's Well-Architected Framework (WAF) five pillars to identify strengths, risks, and improvement opportunities.

When to Use

Assess existing or proposed Azure architectures
Validate designs meet WAF best practices
Identify architectural risks and gaps
Provide scored assessment with recommendations
Review before production deployment

Five Pillars Overview

1. Reliability

Ability of the system to recover from failures and continue functioning.

Focus: Availability, resiliency, disaster recovery, health monitoring

2. Security

Protecting applications and data from threats.

Focus: Identity, network security, encryption, secrets management

3. Cost Optimization

Managing costs to maximize value delivered.

Focus: Right-sizing, reserved instances, monitoring, waste elimination

4. Operational Excellence

Operations processes that keep a system running in production.

Focus: IaC, CI/CD, monitoring, incident response, automation

5. Performance Efficiency

Ability of a system to adapt to changes in load.

Focus: Scaling, caching, CDN, resource selection, optimization

Assessment Process

Step 1: Analyze Architecture

Review the architecture for each pillar:

Reliability Checklist:

[ ] Availability Zones configured?
[ ] Multi-region deployment for critical workloads?
[ ] Health checks and monitoring configured?
[ ] Auto-healing and circuit breakers implemented?
[ ] Backup strategy defined with RPO/RTO?
[ ] Disaster recovery plan documented?

Security Checklist:

[ ] Managed identities used (no credentials in code)?
[ ] Private endpoints for PaaS services?
[ ] HTTPS only with TLS 1.2+?
[ ] Network security groups with least privilege?
[ ] Key Vault for secrets management?
[ ] Azure AD authentication and RBAC configured?
[ ] Data encrypted at rest and in transit?

Cost Optimization Checklist:

[ ] Resources right-sized for actual usage?
[ ] Auto-scaling configured?
[ ] Reserved instances considered for predictable workloads?
[ ] Storage tiering implemented (Hot/Cool/Archive)?
[ ] Unused resources identified?
[ ] Cost monitoring and alerts configured?

Operational Excellence Checklist:

[ ] Infrastructure as Code (Bicep/Terraform)?
[ ] CI/CD pipelines implemented?
[ ] Application Insights for telemetry?
[ ] Centralized logging (Log Analytics)?
[ ] Alerts configured for critical scenarios?
[ ] Deployment automation and rollback?

Performance Efficiency Checklist:

[ ] CDN for static content?
[ ] Caching strategy (Redis, CDN)?
[ ] Asynchronous processing for long operations?
[ ] Appropriate compute SKUs selected?
[ ] Auto-scaling rules defined?
[ ] Performance testing completed?

Step 2: Score Each Pillar

Use 0-100 scoring system:

Scoring Criteria:

80-100 (Excellent): Meets all best practices, production-ready
60-79 (Good): Meets most practices, minor gaps
40-59 (Fair): Some practices missing, moderate risk
20-39 (Poor): Many gaps, significant improvements needed
0-19 (Critical): Major gaps, not production-ready

Step 3: Provide Recommendations

For each identified gap:

Finding: What's missing or problematic
Risk: Impact if not addressed
Recommendation: Specific action to take
Priority: Critical / High / Medium / Low
Effort: Hours or days to implement

Assessment Output Format

# Well-Architected Framework Assessment
**Architecture**: [Name]
**Assessment Date**: [Date]
**Overall Score**: [Average of 5 pillars]/100

## Executive Summary
[2-3 sentences on overall health, key strengths, top risks]

## Pillar Scores

| Pillar | Score | Status |
|--------|-------|--------|
| Reliability | 75/100 | 🟢 Good |
| Security | 65/100 | 🟡 Fair |
| Cost Optimization | 80/100 | 🟢 Good |
| Operational Excellence | 70/100 | 🟡 Fair |
| Performance Efficiency | 85/100 | 🟢 Excellent |
| **Overall** | **75/100** | **🟢 Good** |

---

## 1. Reliability (75/100) - 🟢 Good

### Strengths
Availability Zones configured for App Service and Azure SQL
Health checks implemented with automatic failover
Backup strategy defined (RPO: 1 hour, RTO: 4 hours)

### Gaps & Recommendations

#### Finding #1: No Multi-Region Deployment
**Risk**: Regional outage causes complete service unavailability
**Recommendation**: Implement active-passive multi-region with Azure Front Door
**Priority**: High
**Effort**: 3-5 days
**Implementation**: Deploy secondary region (West US), configure Azure Front Door with priority routing

#### Finding #2: Missing Circuit Breaker Pattern
**Risk**: Cascading failures when dependencies are degraded
**Recommendation**: Implement circuit breaker using Polly library
**Priority**: Medium
**Effort**: 1-2 days

---

## 2. Security (65/100) - 🟡 Fair

### Strengths
Azure AD authentication configured
HTTPS enforced with TLS 1.2
Key Vault used for connection strings

### Gaps & Recommendations

#### Finding #1: Service Principal Used Instead of Managed Identity
**Risk**: Credential rotation required, potential secret exposure
**Recommendation**: Replace service principal with system-assigned managed identity
**Priority**: Critical
**Effort**: 4 hours
**Implementation**: 
1. Enable managed identity on App Service
2. Grant RBAC permissions to SQL and Key Vault
3. Remove service principal credentials

#### Finding #2: No Private Endpoints
**Risk**: PaaS services exposed to public internet
**Recommendation**: Implement private endpoints for SQL, Storage, Key Vault
**Priority**: High
**Effort**: 1 day

---

## 3-5. [Remaining Pillars Follow Same Structure]

---

## Priority Roadmap

### Critical (Fix Immediately)
1. Replace service principal with managed identity
2. Implement private endpoints for PaaS services

### High (Next 30 Days)
3. Multi-region deployment (active-passive)
4. Infrastructure as Code implementation
5. Implement comprehensive alerting

### Medium (Next 90 Days)
6. Circuit breaker pattern
7. Reserved instances for predictable workloads
8. Performance testing automation

### Low (Future Enhancements)
9. Chaos engineering tests
10. Additional caching layers

---

## Cost Impact Summary
- **Savings Opportunities**: ~$480/month (right-sizing, reserved instances)
- **Security Enhancements**: +$200/month (private endpoints)
- **Multi-Region**: +$850/month (passive region infrastructure)
- **Net Impact**: +$570/month for significantly improved resilience and security

---

## Conclusion
[Summary of assessment with key takeaways and prioritized next steps]

Tips for Effective Assessments

Be Specific: Reference exact resources and configurations

Quantify Risk: Use concrete examples of potential impact

Actionable Recommendations: Provide implementation steps, not just principles

Prioritize Ruthlessly: Help teams focus on what matters most

Show Business Impact: Connect technical gaps to business risks

Include Quick Wins: Balance strategic improvements with fast fixes

Cost-Aware: Show ROI for recommendations (cost vs benefit)

Avoid: Generic advice, overwhelming lists, missing priorities, theoretical recommendations

Other skills for the same job

different authors, same section of the catalogue

Azure Kubernetes Automatic Readiness

by microsoft

vendor ×3

Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility. Identifies incompatibilities, generates fixes, and guides migration from AKS Standard to AKS Automatic. WHEN: migrate to AKS Automatic, check AKS Automatic readiness, validate manifests for Automatic, assess cluster for Automatic compatibility, fix deployment for Automatic compatibility, identify AKS Automatic migration blockers, is my cluster ready for AKS Automatic.

Discovers available Azure OpenAI model capacity across regions and projects. Analyzes quota limits, compares availability, and recommends optimal deployment locations based on capacity requirements. USE FOR: find capacity, check quota, where can I deploy, capacity discovery, best region for capacity, multi-project capacity search, quota analysis, model availability, region comparison, check TPM availability. DO NOT USE FOR: actual deployment (hand off to preset or customize after discovery), quota increase requests (direct user to Azure Portal), listing existing deployments.

Interactive guided deployment flow for Azure OpenAI models with full customization control. Step-by-step selection of model version, SKU (GlobalStandard/Standard/ProvisionedManaged), capacity, RAI policy (content filter), and advanced options (dynamic quota, priority processing, spillover). USE FOR: custom deployment, customize model deployment, choose version, select SKU, set capacity, configure content filter, RAI policy, deployment options, detailed deployment, advanced deployment, PTU deployment, provisioned throughput. DO NOT USE FOR: quick deployment to optimal region (use preset).

Unified Azure OpenAI model deployment skill with intelligent intent-based routing. Handles quick preset deployments, fully customized deployments (version/SKU/capacity/RAI policy), and capacity discovery across regions and projects. USE FOR: deploy model, deploy gpt, create deployment, model deployment, deploy openai model, set up model, provision model, find capacity, check model availability, where can I deploy, best region for model, capacity analysis. DO NOT USE FOR: listing existing deployments (use foundry_models_deployments_list MCP tool), deleting deployments, agent creation (use agent/create), project creation (use project/create).

Intelligently deploys Azure OpenAI models to optimal regions by analyzing capacity across all available regions. Automatically checks current region first and shows alternatives if needed. USE FOR: quick deployment, optimal region, best region, automatic region selection, fast setup, multi-region capacity check, high availability deployment, deploy to best location. DO NOT USE FOR: custom SKU selection (use customize), specific version selection (use customize), custom capacity configuration (use customize), PTU deployments (use customize).

This skill should be used when working with LaminDB, an open-source data framework for biology that makes data queryable, traceable, reproducible, and FAIR. Use when managing biological datasets (scRNA-seq, spatial, flow cytometry, etc.), tracking computational workflows, curating and validating data with biological ontologies, building data lakehouses, or ensuring data lineage and reproducibility in biological research. Covers data management, annotation, ontologies (genes, cell types, diseases, tissues), schema validation, integrations with workflow managers (Nextflow, Snakemake) and MLOps platforms (W&B, MLflow), and deployment strategies.

Latch platform for bioinformatics workflows. Build pipelines with Latch SDK, @workflow/@task decorators, deploy serverless workflows, LatchFile/LatchDir, Nextflow/Snakemake integration.

Run Python code in the cloud with serverless containers, GPUs, and autoscaling. Use when deploying ML models, running batch processing jobs, scheduling compute-intensive tasks, or serving APIs that require GPU acceleration or dynamic scaling.

17k tokens

How to use it

Copy the folder

Take thomast1906/waf-assessment from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.