Azure Defaults

Azure Defaults

Apply the canonical defaults from .github/copilot-instructions.md without duplicating them here. Live governance discovered for the target scope always overrides repository defaults.

Prerequisites

• Read the canonical Azure Defaults section once per session.
• Read 04-governance-constraints.json when it exists.
• Read sku-manifest.json for creative SKU decisions; do not derive SKUs from artifact prose.
• Load only the reference needed for the current decision.

IaC Workflow

1. Resolve governance precedence — apply live policy constraints before fallback regions, tags, networking, cost, or security defaults.
2. Generate one stable suffix — derive it once from deployment scope and pass it to every globally unique resource name.
3. Apply CAF naming — use resource-specific abbreviations and length limits; load naming examples when constraints differ by service.
4. Resolve AVM modules live — prefer AVM, pin the latest stable version at plan time, and record justified stale-pin exceptions in the IaC contract.
5. Apply canonical security defaults — use the canonical baseline and load AVM pitfalls only when module parameters or lifecycle constraints require detail.
6. Run conditional planning gates — apply VNet and cost-monitoring workflows when their triggers hold; governance remains authoritative.
7. Check service lifecycle — use the latest supported GA LTS runtime and reject retired, classic, preview, or short-lifecycle choices for durable production workloads unless explicitly approved.
8. Validate the output — run the stack validator and the security, AVM pin, SKU coverage, and governance checks relevant to the produced IaC.

IaC-Specific Invariants

• Unique suffix: generate one deterministic suffix per deployment scope and pass it into modules rather than recomputing it independently.
• AVM-first: do not hand-roll a resource with an applicable stable AVM module.
• Live pins: resolve module versions at plan time; training-data pins are not evidence of currency.
• Governance wins: discovered policy overrides every fallback in the canonical defaults and this workflow.
• VNet planning is interactive: confirm CIDRs when a workload requires VNet integration, private endpoints, or a VNet-attached service. Production cannot defer the gate.
• Cost monitoring is explicit: production requires the governed budget, notification, and anomaly-monitoring contract; non-production exceptions must use a documented mode.
• Lifecycle is verified live: selectable engine and runtime versions require current support-policy evidence.

Validation

npm run validate:region-canonical
npm run validate:iac-security-baseline
npm run validate:avm-versions:freeze
npm run validate:sku-iac-coverage

Then run bicep build and bicep lint, or terraform fmt -check and terraform validate, for the selected stack.

Reference Index

Load references progressively; do not read the directory wholesale.