Azure Cloud Architect
End-to-end Azure-specific architecture: service selection, Well-Architected Framework assessment, identity and networking patterns, cost optimization, and operational defaults. Provider-specific complement to our generic senior-cloud-architect skill — that one covers cross-cloud patterns; this one knows AKS pricing tiers, when to pick Cosmos over SQL DB, and how Front Door differs from Application Gateway.
Core Capabilities
- Compute selection — decision tree across AKS, App Service, Container Apps, Functions, VMs/VMSS, Batch, Static Web Apps, and API gateways.
- Data store selection — relational, NoSQL/document, cache, blob, time-series, search, vector, and warehouse decision trees.
- Networking design — VNets, Private/Service Endpoints, gateways (App Gateway, Front Door, Firewall, NAT, VPN/ER), hub-and-spoke and Private Link patterns.
- Identity design — Entra ID, Managed Identity (system/user-assigned), Workload Identity, Service Principals, and least-privilege RBAC scoping.
- WAF assessment — score workloads across Reliability, Security, Cost, Operational Excellence, and Performance Efficiency pillars.
- Cost optimization — right-sizing, reservations, autoscaling, spot, storage tiering, and egress-reduction levers with anti-pattern detection.
When to Use
| Situation |
Skill applies |
| Designing an Azure architecture from scratch |
Yes — start with the compute decision tree |
| Reviewing an existing Azure architecture |
Yes — run WAF assessment via scripts/azure_waf_scorer.py |
| Validating an ARM/Bicep/Terraform plan |
Yes — scripts/azure_architecture_validator.py |
| Estimating Azure cost for a workload |
Yes — scripts/azure_cost_estimator.py |
| Picking compute, data store, networking, or identity |
Yes — see the decision-trees reference |
| Going to production without WAF review |
Don't — run the WAF scorer first |
Clarify First
Before designing or assessing, confirm these inputs. If any is unknown or vague, ASK — do not assume:
Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.
Tools
| Tool |
Purpose |
Command |
azure_architecture_validator.py |
Validate a Bicep/ARM/YAML workload for anti-patterns and missing best-practice settings |
python scripts/azure_architecture_validator.py --bicep ./infra/*.bicep |
azure_cost_estimator.py |
Estimate monthly Azure cost from a YAML workload spec |
python scripts/azure_cost_estimator.py --workload-config workload.yaml |
azure_waf_scorer.py |
Score a workload against the five Well-Architected pillars |
python scripts/azure_waf_scorer.py --workload-config workload.yaml |
All scripts: stdlib only, argparse CLI, JSON or markdown output (--format).
References
Load the reference that matches the task — keep this file lean and pull detail on demand:
- references/azure-decision-trees.md — full compute, data store, networking, and identity decision trees with building-block, gateway, and RBAC tables. Read when selecting services or designing topology.
- references/azure-workflows-and-antipatterns.md — the five WAF pillars, cost levers and anti-patterns, the design/review/migrate workflows, Azure-specific anti-patterns, and tooling outputs. Read when running a design or review.
- references/azure-services-reference.md — per-service depth: tiers, SLAs, limits, when to upgrade. Read when choosing a specific SKU or tier.
- references/azure-well-architected.md — 5-pillar WAF assessment with the 10-question checklist per pillar, common findings, and remediations. Read during a WAF review.
- references/azure-cost-optimization.md — full cost lever catalog, anti-patterns, and detection heuristics. Read when optimizing spend.
Related skills
engineering/senior-cloud-architect — generic multi-cloud architecture patternsengineering/aws-solution-architect — AWS counterpartengineering/gcp-cloud-architect — GCP counterpartengineering/kubernetes-operator — for AKS operator-pattern workloadsra-qm-team/information-security-manager-iso27001 — for compliance-mapped controls (Azure has built-in Defender / Compliance Manager)ra-qm-team/soc2-compliance-expert — Azure-specific SOC 2 evidence collection
1---
2name: azure-cloud-architect
3description: >
4 Design, review, and validate Azure cloud architectures. Use when choosing Azure
5 compute, storage, networking, or identity services, or applying the Azure
6 Well-Architected Framework to a workload.
7license: MIT + Commons Clause
8metadata:
9 version: 1.1.0
10 author: borghei
11 category: engineering
12 domain: engineering
13 updated: 2026-06-17
14 tags: [azure, cloud-architecture, well-architected-framework, aks, app-service, entra-id, networking, cost-optimization]
15---
16
17# Azure Cloud Architect
18
19End-to-end Azure-specific architecture: service selection, Well-Architected Framework assessment, identity and networking patterns, cost optimization, and operational defaults. Provider-specific complement to our generic `senior-cloud-architect` skill — that one covers cross-cloud patterns; this one knows AKS pricing tiers, when to pick Cosmos over SQL DB, and how Front Door differs from Application Gateway.
20
21## Core Capabilities
22
23- **Compute selection** — decision tree across AKS, App Service, Container Apps, Functions, VMs/VMSS, Batch, Static Web Apps, and API gateways.
24- **Data store selection** — relational, NoSQL/document, cache, blob, time-series, search, vector, and warehouse decision trees.
25- **Networking design** — VNets, Private/Service Endpoints, gateways (App Gateway, Front Door, Firewall, NAT, VPN/ER), hub-and-spoke and Private Link patterns.
26- **Identity design** — Entra ID, Managed Identity (system/user-assigned), Workload Identity, Service Principals, and least-privilege RBAC scoping.
27- **WAF assessment** — score workloads across Reliability, Security, Cost, Operational Excellence, and Performance Efficiency pillars.
28- **Cost optimization** — right-sizing, reservations, autoscaling, spot, storage tiering, and egress-reduction levers with anti-pattern detection.
29
30## When to Use
31
32| Situation | Skill applies |
33|-----------|---------------|
34| Designing an Azure architecture from scratch | Yes — start with the **compute decision tree** |
35| Reviewing an existing Azure architecture | Yes — run **WAF assessment** via `scripts/azure_waf_scorer.py` |
36| Validating an ARM/Bicep/Terraform plan | Yes — `scripts/azure_architecture_validator.py` |
37| Estimating Azure cost for a workload | Yes — `scripts/azure_cost_estimator.py` |
38| Picking compute, data store, networking, or identity | Yes — see the decision-trees reference |
39| Going to production without WAF review | Don't — run the WAF scorer first |
40
41## Clarify First
42
43Before designing or assessing, confirm these inputs. If any is unknown or vague, ASK — do not assume:
44
45- [ ] **Task** — design from scratch, review an existing architecture, validate IaC, or estimate cost (selects `azure_architecture_validator.py` vs `azure_cost_estimator.py` vs `azure_waf_scorer.py`)
46- [ ] **Workload spec** — the YAML workload config, or the Bicep/ARM/Terraform files (the input the scripts parse)
47- [ ] **Priority pillar** — reliability, security, cost, operational excellence, or performance (weights the WAF assessment and which recommendations lead)
48
49Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.
50
51## Tools
52
53| Tool | Purpose | Command |
54|------|---------|---------|
55| `azure_architecture_validator.py` | Validate a Bicep/ARM/YAML workload for anti-patterns and missing best-practice settings | `python scripts/azure_architecture_validator.py --bicep ./infra/*.bicep` |
56| `azure_cost_estimator.py` | Estimate monthly Azure cost from a YAML workload spec | `python scripts/azure_cost_estimator.py --workload-config workload.yaml` |
57| `azure_waf_scorer.py` | Score a workload against the five Well-Architected pillars | `python scripts/azure_waf_scorer.py --workload-config workload.yaml` |
58
59All scripts: stdlib only, argparse CLI, JSON or markdown output (`--format`).
60
61## References
62
63Load the reference that matches the task — keep this file lean and pull detail on demand:
64
65- **[references/azure-decision-trees.md](references/azure-decision-trees.md)** — full compute, data store, networking, and identity decision trees with building-block, gateway, and RBAC tables. Read when selecting services or designing topology.
66- **[references/azure-workflows-and-antipatterns.md](references/azure-workflows-and-antipatterns.md)** — the five WAF pillars, cost levers and anti-patterns, the design/review/migrate workflows, Azure-specific anti-patterns, and tooling outputs. Read when running a design or review.
67- **[references/azure-services-reference.md](references/azure-services-reference.md)** — per-service depth: tiers, SLAs, limits, when to upgrade. Read when choosing a specific SKU or tier.
68- **[references/azure-well-architected.md](references/azure-well-architected.md)** — 5-pillar WAF assessment with the 10-question checklist per pillar, common findings, and remediations. Read during a WAF review.
69- **[references/azure-cost-optimization.md](references/azure-cost-optimization.md)** — full cost lever catalog, anti-patterns, and detection heuristics. Read when optimizing spend.
70
71## Related skills
72
73- `engineering/senior-cloud-architect` — generic multi-cloud architecture patterns
74- `engineering/aws-solution-architect` — AWS counterpart
75- `engineering/gcp-cloud-architect` — GCP counterpart
76- `engineering/kubernetes-operator` — for AKS operator-pattern workloads
77- `ra-qm-team/information-security-manager-iso27001` — for compliance-mapped controls (Azure has built-in Defender / Compliance Manager)
78- `ra-qm-team/soc2-compliance-expert` — Azure-specific SOC 2 evidence collection
borghei