konradcinkusz Azure operations: identity-first infrastructure and the pipeline that runs it
Read references/AZURE-OPERATIONS.md before applying any of this.
That file is the standard; everything below it is a summary to help you decide
whether this skill applies and to check your work afterwards.
What this standard covers
- Provision vs deploy
- Passwordless SQL end to end
- The permission matrix document
- CI hardening
- Storage without keys
- Model deployments and capacity
- Container Apps manifest idioms
- Container Apps jobs and escape hatches
Failure modes
| Symptom | Cause |
|---|---|
| Permissions fix merged, live env still 403s | Fix shipped via deploy; role assignments only apply on provision |
| First blob/agent call fails right after provisioning | RBAC propagation lag; poll the data plane before first use |
App deployed, DB login fails as <identity-name> |
Contained DB user never created — the deploymentScripts half is missing |
| Two services, one DB principal | Shared managed identity; one identity per service |
deploymentScripts fails inside a VNet |
No delegated subnet + staging storage for script execution |
| Wrong-subscription deploy with no clear error | No credential preflight; assert az account show post-login |
| Re-provision after destroy fails on name collision | Soft-deleted account not detected/restored |
| Parallel model deployments conflict | One deployment operation at a time; chain dependsOn |
| Empty-secret deployment failure | Optional secret rendered as an empty block instead of conditionally omitted |
| BFF proxy 403s in one environment only | IP allowlist applied to a backend API; move it to the frontend |
| Job "updated" but behaves old | job update silently dropped the flags; delete + recreate |
| One-line agent change requires a full pipeline run | No targeted-re-run escape hatch with azd env refresh |
Checklist
- All auth is managed identity + RBAC; no keys, no SQL passwords,
allowSharedKeyAccess: false - Entra-only SQL with a UAMI admin; contained users via deploymentScripts with retry; connection-string surgery centralized in the kernel
- One identity per service (database principals included)
- Permission matrix committed with the added-by-infra column; error-string decoder table alongside
- CI: credential preflight + post-login account assertion; soft-delete detect/restore; RBAC data-plane polling before first use
- Model deployments chained; capacity split planned; model tiers parameterized
- Manifests: env-conditional minReplicas, conditional secret blocks, fail-closed allowlists on frontends only, conditional domains/SNI
- Jobs recreated not updated; targeted re-run workflows exist; destroy typed-confirmed, per-env gated, purging
- Provision-vs-deploy distinction written into the deployment checklist ("why this step matters" column)
Generated from docs/guides/AZURE-OPERATIONS.md by scripts/build-marketplace.mjs. Do not edit this file: change the source document, or its entry in catalog/marketplace.catalog.json, and re-run the generator.