Now liveThe Skillselion MCP - thousands of ranked skills, loaded into your agent mid-task. No install.Get it →
alirezarezvani avatar

Azure Cloud Architect

alirezarezvani/claude-skills

  • 582 installs
  • 23.5k repo stars
  • Updated July 17, 2026
  • alirezarezvani/claude-skills

azure-cloud-architect is a Claude Code skill that designs cost-bounded Azure stacks, Bicep and ARM templates, and DevOps deployment paths for developers planning AKS, App Service, Functions, or Cosmos DB before committin

About

azure-cloud-architect is a Claude Code skill from alirezarezvani/claude-skills that designs scalable, cost-effective Azure architectures with Bicep infrastructure-as-code templates. The workflow gathers application type, expected users, requests per second, and compliance needs, then recommends services including AKS, App Service, Azure Functions, and Cosmos DB with cost optimization guidance. Developers reach for azure-cloud-architect when migrating workloads to Azure, drafting IaC before provisioning, or setting up Azure DevOps pipelines. The skill covers startup and enterprise scenarios, producing architecture decisions and Bicep shapes rather than running live deployments.

  • Structured requirements pass: app type, RPS, budget cap, compliance (GDPR, HIPAA, SOC 2, ISO 27001), RPO/RTO, and region
  • architecture_designer.py CLI recommends patterns, service stacks, pros/cons, and estimated monthly USD cost
  • Covers AKS, App Service, Azure Functions, Cosmos DB, Front Door, Key Vault, and Entra ID in example stacks
  • Explicit workflow from requirements → architecture design → Bicep infrastructure-as-code templates
  • Oriented to startups and enterprises migrating or greenfielding on Azure with cost optimization

Azure Cloud Architect by the numbers

  • 582 all-time installs (skills.sh)
  • Ranked #349 of 1,039 Cloud & Infrastructure skills by installs in the Skillselion catalog
  • Security screen: LOW risk (skills.sh audit)
  • Data as of Jul 31, 2026 (Skillselion catalog sync)
npx skills add https://github.com/alirezarezvani/claude-skills --skill azure-cloud-architect

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

Listed on Skillselion
Installs582
repo stars★ 23.5k
Security audit3 / 3 scanners passed
Last updatedJuly 17, 2026
Repositoryalirezarezvani/claude-skills ↗

How do you design a cost-bounded Azure architecture in Bicep?

Design cost-bounded Azure stacks, Bicep/ARM shapes, and DevOps paths before you commit spend on AKS, App Service, Functions, or Cosmos DB.

Who is it for?

Platform engineers and architects planning Azure migrations or greenfield deployments who need Bicep templates and cost-bounded service selection.

Skip if: Teams on AWS or GCP only, or developers needing live Terraform apply and runtime monitoring should use cloud-specific ops tools instead.

When should I use this skill?

A developer asks to design Azure infrastructure, create Bicep templates, optimize Azure costs, or plan an Azure DevOps migration.

What you get

Azure architecture recommendation with Bicep or ARM templates, service selection, and cost-optimized DevOps pipeline plan.

  • Bicep or ARM template drafts
  • Azure architecture recommendation document

Files

SKILL.mdMarkdownGitHub ↗

Azure Cloud Architect

Design scalable, cost-effective Azure architectures for startups and enterprises with Bicep infrastructure-as-code templates.

---

Workflow

Step 1: Gather Requirements

Collect application specifications:

- Application type (web app, mobile backend, data pipeline, SaaS, microservices)
- Expected users and requests per second
- Budget constraints (monthly spend limit)
- Team size and Azure experience level
- Compliance requirements (GDPR, HIPAA, SOC 2, ISO 27001)
- Availability requirements (SLA, RPO/RTO)
- Region preferences (data residency, latency)

Step 2: Design Architecture

Run the architecture designer to get pattern recommendations:

python scripts/architecture_designer.py \
  --app-type web_app \
  --users 10000 \
  --requirements '{"budget_monthly_usd": 500, "compliance": ["SOC2"]}'

Example output:

{
  "recommended_pattern": "app_service_web",
  "service_stack": ["App Service", "Azure SQL", "Front Door", "Key Vault", "Entra ID"],
  "estimated_monthly_cost_usd": 280,
  "pros": ["Managed platform", "Built-in autoscale", "Deployment slots"],
  "cons": ["Less control than VMs", "Platform constraints", "Cold start on consumption plans"]
}

Select from recommended patterns:

  • App Service Web: Front Door + App Service + Azure SQL + Redis Cache
  • Microservices on AKS: AKS + Service Bus + Cosmos DB + API Management
  • Serverless Event-Driven: Functions + Event Grid + Service Bus + Cosmos DB
  • Data Pipeline: Data Factory + Synapse Analytics + Data Lake Storage + Event Hubs

See references/architecture_patterns.md for detailed pattern specifications.

Validation checkpoint: Confirm the recommended pattern matches the team's operational maturity and compliance requirements before proceeding to Step 3.

Step 3: Generate IaC Templates

Create infrastructure-as-code for the selected pattern:

# Web app stack (Bicep)
python scripts/bicep_generator.py --arch-type web-app --output main.bicep

Example Bicep output (core web app resources):

@description('The environment name')
param environment string = 'dev'

@description('The Azure region for resources')
param location string = resourceGroup().location

@description('The application name')
param appName string = 'myapp'

// App Service Plan
resource appServicePlan 'Microsoft.Web/serverfarms@2023-01-01' = {
  name: '${environment}-${appName}-plan'
  location: location
  sku: {
    name: 'P1v3'
    tier: 'PremiumV3'
    capacity: 1
  }
  properties: {
    reserved: true // Linux
  }
}

// App Service
resource appService 'Microsoft.Web/sites@2023-01-01' = {
  name: '${environment}-${appName}-web'
  location: location
  properties: {
    serverFarmId: appServicePlan.id
    httpsOnly: true
    siteConfig: {
      linuxFxVersion: 'NODE|20-lts'
      minTlsVersion: '1.2'
      ftpsState: 'Disabled'
      alwaysOn: true
    }
  }
  identity: {
    type: 'SystemAssigned'
  }
}

// Azure SQL Database
resource sqlServer 'Microsoft.Sql/servers@2023-05-01-preview' = {
  name: '${environment}-${appName}-sql'
  location: location
  properties: {
    administrators: {
      azureADOnlyAuthentication: true
    }
    minimalTlsVersion: '1.2'
  }
}

resource sqlDatabase 'Microsoft.Sql/servers/databases@2023-05-01-preview' = {
  parent: sqlServer
  name: '${appName}-db'
  location: location
  sku: {
    name: 'GP_S_Gen5_2'
    tier: 'GeneralPurpose'
  }
  properties: {
    autoPauseDelay: 60
    minCapacity: json('0.5')
  }
}
Full templates including Front Door, Key Vault, Managed Identity, and monitoring are generated by bicep_generator.py and also available in references/architecture_patterns.md.

Bicep is the recommended IaC language for Azure. Prefer Bicep over ARM JSON templates: Bicep compiles to ARM JSON, has cleaner syntax, supports modules, and is first-party supported by Microsoft.

Step 4: Review Costs

Analyze estimated costs and optimization opportunities:

python scripts/cost_optimizer.py \
  --config current_resources.json \
  --json

Example output:

{
  "current_monthly_usd": 2000,
  "recommendations": [
    { "action": "Right-size SQL Database GP_S_Gen5_8 to GP_S_Gen5_2", "savings_usd": 380, "priority": "high" },
    { "action": "Purchase 1-year Reserved Instances for AKS node pools", "savings_usd": 290, "priority": "high" },
    { "action": "Move Blob Storage to Cool tier for objects >30 days old", "savings_usd": 65, "priority": "medium" }
  ],
  "total_potential_savings_usd": 735
}

Output includes:

  • Monthly cost breakdown by service
  • Right-sizing recommendations
  • Reserved Instance and Savings Plan opportunities
  • Potential monthly savings

Step 5: Configure CI/CD

Set up Azure DevOps Pipelines or GitHub Actions with Azure:

# GitHub Actions — deploy Bicep to Azure
name: Deploy Infrastructure
on:
  push:
    branches: [main]

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - uses: azure/arm-deploy@v2
        with:
          resourceGroupName: rg-myapp-dev
          template: ./infra/main.bicep
          parameters: environment=dev
# Azure DevOps Pipeline
trigger:
  branches:
    include:
      - main

pool:
  vmImage: 'ubuntu-latest'

steps:
  - task: AzureCLI@2
    inputs:
      azureSubscription: 'MyServiceConnection'
      scriptType: 'bash'
      scriptLocation: 'inlineScript'
      inlineScript: |
        az deployment group create \
          --resource-group rg-myapp-dev \
          --template-file infra/main.bicep \
          --parameters environment=dev

Step 6: Security Review

Validate security posture before production:

  • Identity: Entra ID (Azure AD) with RBAC, Managed Identity for service-to-service auth — never store credentials in code
  • Secrets: Key Vault for all secrets, certificates, and connection strings
  • Network: NSGs on all subnets, Private Endpoints for PaaS services, Application Gateway with WAF
  • Encryption: TLS 1.2+ in transit, Azure-managed or customer-managed keys at rest
  • Monitoring: Microsoft Defender for Cloud enabled, Azure Policy for guardrails
  • Compliance: Azure Policy assignments for SOC 2 / HIPAA / ISO 27001 initiatives

If deployment fails:

1. Check the deployment status:

   az deployment group show \
     --resource-group rg-myapp-dev \
     --name main \
     --query 'properties.error'

2. Review Activity Log for RBAC or policy errors. 3. Validate the Bicep template before deploying:

   az bicep build --file main.bicep
   az deployment group validate \
     --resource-group rg-myapp-dev \
     --template-file main.bicep

Common failure causes:

  • RBAC permission errors — verify the deploying principal has Contributor on the resource group
  • Resource provider not registered — run az provider register --namespace Microsoft.Web
  • Naming conflicts — Azure resource names are often globally unique (storage accounts, web apps)
  • Quota exceeded — request quota increase via Azure Portal > Subscriptions > Usage + quotas

---

Tools

architecture_designer.py

Generates architecture pattern recommendations based on requirements.

python scripts/architecture_designer.py \
  --app-type web_app \
  --users 50000 \
  --requirements '{"budget_monthly_usd": 1000, "compliance": ["HIPAA"]}' \
  --json

Input: Application type, expected users, JSON requirements Output: Recommended pattern, service stack, cost estimate, pros/cons

cost_optimizer.py

Analyzes Azure resource configurations for cost savings.

python scripts/cost_optimizer.py --config resources.json --json

Input: JSON file with current Azure resource inventory Output: Recommendations for:

  • Idle resource removal
  • VM and database right-sizing
  • Reserved Instance purchases
  • Storage tier transitions
  • Unused public IPs and load balancers

bicep_generator.py

Generates Bicep template scaffolds from architecture type.

python scripts/bicep_generator.py --arch-type microservices --output main.bicep

Output: Production-ready Bicep templates with:

  • Managed Identity (no passwords)
  • Key Vault integration
  • Diagnostic settings for Azure Monitor
  • Network security groups
  • Tags for cost allocation

---

Quick Start

Web App Architecture (< $100/month)

Ask: "Design an Azure web app for a startup with 5000 users"

Result:
- App Service (B1 Linux) for the application
- Azure SQL Serverless for relational data
- Azure Blob Storage for static assets
- Front Door (free tier) for CDN and routing
- Key Vault for secrets
- Estimated: $40-80/month

Microservices on AKS ($500-2000/month)

Ask: "Design a microservices architecture on Azure for a SaaS platform with 50k users"

Result:
- AKS cluster with 3 node pools (system, app, jobs)
- API Management for gateway and rate limiting
- Cosmos DB for multi-model data
- Service Bus for async messaging
- Azure Monitor + Application Insights for observability
- Multi-zone deployment

Serverless Event-Driven (< $200/month)

Ask: "Design an event-driven backend for processing orders"

Result:
- Azure Functions (Consumption plan) for compute
- Event Grid for event routing
- Service Bus for reliable messaging
- Cosmos DB for order data
- Application Insights for monitoring
- Estimated: $30-150/month depending on volume

Data Pipeline ($300-1500/month)

Ask: "Design a data pipeline for ingesting 10M events/day"

Result:
- Event Hubs for ingestion
- Stream Analytics or Functions for processing
- Data Lake Storage Gen2 for raw data
- Synapse Analytics for warehouse
- Power BI for dashboards

---

Input Requirements

Provide these details for architecture design:

RequirementDescriptionExample
Application typeWhat you're buildingSaaS platform, mobile backend
Expected scaleUsers, requests/sec10k users, 100 RPS
BudgetMonthly Azure limit$500/month max
Team contextSize, Azure experience3 devs, intermediate
ComplianceRegulatory needsHIPAA, GDPR, SOC 2
AvailabilityUptime requirements99.9% SLA, 1hr RPO

JSON Format:

{
  "application_type": "saas_platform",
  "expected_users": 10000,
  "requests_per_second": 100,
  "budget_monthly_usd": 500,
  "team_size": 3,
  "azure_experience": "intermediate",
  "compliance": ["SOC2"],
  "availability_sla": "99.9%"
}

---

Anti-Patterns

Anti-PatternWhy It FailsDo This Instead
ARM JSON templates for new projectsVerbose, hard to read, no modulesUse Bicep — compiles to ARM, cleaner syntax
Storing secrets in App SettingsSecrets visible in portal, no rotationUse Key Vault references in App Settings
Single large AKS node poolCannot optimize for different workloadsUse multiple node pools: system, app, jobs
Public endpoints on PaaS servicesExposed attack surfaceUse Private Endpoints + VNet integration
Over-provisioning "just in case"Wastes budget month oneStart small, use autoscale, right-size monthly
Shared resource groups for everythingBlast radius, RBAC nightmaresOne resource group per environment per workload
No tagging strategyCannot track costs or ownershipTag: environment, owner, cost-center, app-name
Using classic resourcesDeprecated, limited featuresUse ARM/Bicep resources exclusively

---

Output Formats

Architecture Design

  • Pattern recommendation with rationale
  • Service stack diagram (ASCII)
  • Monthly cost estimate and trade-offs

IaC Templates

  • Bicep: Recommended — first-party, module support, clean syntax
  • ARM JSON: Generated from Bicep when needed
  • Terraform HCL: Multi-cloud compatible using azurerm provider

Cost Analysis

  • Current spend breakdown with optimization recommendations
  • Priority action list (high/medium/low) and implementation checklist

---

Cross-References

SkillRelationship
engineering-team/aws-solution-architectAWS equivalent — same 6-step workflow, different services
engineering-team/gcp-cloud-architectGCP equivalent — completes the cloud trifecta
engineering-team/senior-devopsBroader DevOps scope — pipelines, monitoring, containerization
engineering/terraform-patternsIaC implementation — use for Terraform modules targeting Azure
engineering/ci-cd-pipeline-builderPipeline construction — automates Azure DevOps and GitHub Actions

---

Reference Documentation

DocumentContents
references/architecture_patterns.md5 patterns: web app, microservices/AKS, serverless, data pipeline, multi-region
references/service_selection.mdDecision matrices for compute, database, storage, messaging, networking
references/best_practices.mdNaming conventions, tagging, RBAC, network security, monitoring, DR

Related skills

microsoftAzure AiIntegrates Azure AI Content Safety, Document Intelligence, Speech, and Search services into Java-based agents and applications.479k1.3kmicrosoftAzure PrepareGenerate the exact Azure infrastructure files, Dockerfiles, and azure.yaml configuration needed before deploying any new or modernized application.479k1.3kmicrosoftAzure StorageConnect agents and applications to Azure Blob Storage, File Shares, Queues, Tables, and Data Lake without leaving the coding environment.478k1.3kmicrosoftAppinsights InstrumentationAutomatically instrument web applications running on Azure App Service with Application Insights for observability without manual configuration.478k1.3kmicrosoftAzure Resource LookupInstantly list, query, and discover any Azure resources across subscriptions without leaving the agent chat.478k1.3kmicrosoftAzure AigatewayConfigure Azure API Management as a secure, governed gateway for routing traffic to LLMs, MCP servers, and agent tools.478k1.3k

FAQ

Which Azure services does azure-cloud-architect cover?

azure-cloud-architect covers AKS, App Service, Azure Functions, Cosmos DB, Bicep and ARM templates, Azure DevOps pipelines, and cost optimization for startup and enterprise workloads.

What does azure-cloud-architect deliver?

azure-cloud-architect delivers cost-bounded Azure architecture recommendations with Bicep infrastructure-as-code templates and DevOps deployment paths based on application type, scale, and compliance requirements.

Is Azure Cloud Architect safe to install?

skills.sh reports 3 of 3 security scanners passed. Review the Security Audits panel on this page before installing in production.

Cloud & Infrastructuredeployinfra
Browse by category
AI & AgentsFrontend & DesignBackend & DataDev ToolsAutomationTesting & ReviewSecurityMonitoring & CloudDocs & Planning
Design & frontend
Design systemsAnimation & motionAccessibility (a11y)CSS & TailwindUI designUXDesign to codeshadcn/uiLanding pagesBest design skills
Most searched skills
find-skillscavemanfrontend-designbrainstormingsystematic-debuggingstop-slopemil-design-engui-ux-pro-maxkarpathy-guidelinesweb-design-guidelinesreact-best-practicesgrill-meimprovemicrosoft-foundryagent-browser
Browse all listings
All agent skillsAll MCP serversAll marketplacesAll plugins

This week in AI coding

Five minutes, every Monday - the tools, releases and tactics for developers.

unsubscribe anytime.