Azure Validate

Azure Validate

Systematically validate deployments against infrastructure, security, performance, and operational readiness criteria. Provide go/no-go decision for production release.

Use This Skill When

• The user has deployed to staging and needs production readiness verification
• The user asks for preflight checks, health verification, or sign-off gates
• Deployment is ready but needs validation against SLA and compliance requirements
• There's a need to verify monitoring, alerting, and incident response readiness

Context: Validation Maturity

Immature: Manual spot checks, no automation, inconsistent criteria
Developing: Some automated tests, partial validation, manual sign-off
Managed: Automated checks, clear pass/fail criteria, documented gates → Target
Optimized: Full CI/CD integration, policy-as-code, real-time compliance dashboards

Required Inputs

• Deployment scope: All resources, environment, regions
• SLA targets: Availability (%), latency (ms, p99), throughput (req/sec)
• Traffic model: Expected load profile and peak burst
• Security & compliance: HIPAA, PCI-DSS, SOC2, audit requirements?
• User journeys: Critical paths to test (e.g., user signup → purchase → confirmation)
• Acceptance criteria: Performance baseline, error rate threshold
• Rollback plan: How to revert if validation fails?

Decision Tree

Have all infrastructure resources been provisioned?
├─ No → BLOCK: Complete infrastructure deployment first
└─ Yes → Continue

Are all required monitoring and alerting configured?
├─ No → WARNING: Cannot track production health; recommend staging validation only
└─ Yes → Continue

Has security baseline been applied (NSGs, RBAC, encryption)?
├─ No → BLOCK: Security validation must pass before production
└─ Yes → Continue

Do all smoke tests and end-to-end flows pass?
├─ No → BLOCK: Application logic failures prevent release
└─ Yes → Continue

Does load testing meet SLA targets?
├─ No → WARNING: May fail under expected load; consider remediation
└─ Yes → READY FOR PRODUCTION

Workflow

Phase 1: Infrastructure Validation (5-10 min)

1. Inventory and quota check:

   az resource list --resource-group $RG --query "[].{name:name, type:type, state:properties.provisioningState}"
   az vm list-usage --location eastus --query "[?limit >= currentValue * 1.2].{name:name.value, current:currentValue, limit:limit}"
   

2. Verify networking, storage, and databases:

   • VNets, subnets, peering in place?
   • NSGs configured (least-privilege ingress)?
   • Encryption enabled (at-rest, in-transit)?
   • Backups with retention policy?
   • Firewall rules (internal only)?

Phase 2: Identity & Access Validation (5 min)

1. RBAC check:

   • Role assignments complete and minimal?
   • No Contributor on production?
   • Service principals scoped appropriately?

2. Key Vault & secrets:

   • All secrets provisioned?
   • Access policies/RBAC configured?
   • Audit logging enabled?

Phase 3: Application Health (10-15 min)

1. Smoke tests:

   curl -I https://$APP/health  # HTTP 200
   

2. End-to-end flows:

   • User signup → confirmation
   • Payment → inventory → receipt

3. Data integrity:

   • No unhandled exceptions
   • No orphaned records

Phase 4: Performance & Scaling (15-30 min)

1. Load test (1000 req, 100 concurrent):

   • 95% complete in <500ms
   • Error rate <1%

2. Verify auto-scaling:

   • Scaled up under load?
   • Latency within SLA?
   • Even distribution?

3. Cost validation:

   • Budget vs. actual
   • Unused resources?

Phase 5: Monitoring & Alerting (5 min)

1. Instrumentation:

   • Application Insights active?
   • Custom metrics for KPIs?

2. Alerts:

   • Rules for errors, latency, CPU?
   • Channels configured?
   • Thresholds aligned with SLA?

Phase 6: Security & Compliance (10 min)

1. Security baseline:

   • Defender enabled?
   • No unintended public IPs?
   • No secrets in logs?

2. Compliance:

   • Audit logging enabled?
   • Encryption verified?
   • Data residency correct?

3. Security tests:

   • Unauthenticated cannot access admin
   • HTTPS enforced
   • No exposed secrets

Phase 7: DR Readiness (5 min)

1. Incident response:

   • On-call assigned?
   • Runbooks documented?

2. Test rollback:

   • Previous version available?
   • Procedure documented?

Output Contract

1. Validation Report: Status, date, environment
2. Checklist Results: Per category (PASS/WARNING/FAIL)
3. Blocking Issues: Must-fix before release
4. Warnings: Mitigations accepted?
5. Sign-Off: Approved by [Name, Date]

Guardrails

• Automate all checks; manual spot checks miss issues.
• Define clear pass/fail criteria before testing.
• Never skip security validation; security is blocking.
• Test rollback before release.
• Separate blockers from recommendations; non-blocking warnings don't delay release.
• Document all assumptions (e.g., "peak load 500 req/sec").
• Validate in production-like environment; staging differences mask issues.