# Azure Backup Readiness

> >

- **Type:** Skill
- **Install:** `agentstack add skill-aiappsgbb-awesome-gbb-azure-backup-readiness`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [aiappsgbb](https://agentstack.voostack.com/s/aiappsgbb)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [aiappsgbb](https://github.com/aiappsgbb)
- **Source:** https://github.com/aiappsgbb/awesome-gbb/tree/main/skills/azure-backup-readiness

## Install

```sh
agentstack add skill-aiappsgbb-awesome-gbb-azure-backup-readiness
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# azure-backup-readiness

Audits Azure backup coverage at a resource group scope. Vault-type aware.

## When to use

- threadlight v0.5.4 needs to flip BAK-401 from `kind: manual` to
  `kind: sibling-skill` — this skill's `probe()` is the sibling.
- Pre-pilot review: confirm a candidate Foundry RG has at least one
  vault with protected items before a customer pilot.
- Spoke landing-zone check: detect RGs that have an RSV / Backup Vault
  resource but no policies attached.

## Probing an RG

```python
from azure_backup_readiness.probe import probe

result = probe(
    subscription_id="",
    resource_group="",
    # protected_item_types=["VM", "SQLDataBase"],  # optional REL-007 filter
)
# result["vaults"]                         → list of {kind, name, id, protected_item_count}
# result["summary"]["total_vaults"]        → int
# result["summary"]["rsv_count"]           → int  (RSV count)
# result["summary"]["bv_count"]            → int  (BackupVault count)
# result["summary"]["total_protected_items"] → int  (sum across vaults, after type filter)
# result["summary"]["protected_item_types_filter"] → list[str] | None (echo of applied filter)
# result["summary"]["confidence"]          → 0.0..1.0
# result["summary"]["probe_error"]         → str | None
# result["findings"]                       → list of typed findings
# result["manifest_path"]                  → path to JSON manifest on disk
```

`protected_item_types` (the REL-007 sibling-contract input) is an
**optional** list of workload/datasource type tokens. When provided,
only protected items whose type matches one of the tokens
(case-insensitive substring) count toward
`total_protected_items` / per-vault `protected_item_count`. When
omitted (default), every protected item counts. The applied filter is
echoed back in `summary.protected_item_types_filter`.

The probe **never raises**. If one vault API denies (e.g. RSV is
forbidden but Backup Vault works), the probe still completes and
returns `confidence: 0.5`. If both deny, returns `confidence: 0.0`
and `probe_error` populated.

> **MUST:** Copy verbatim from
> [`references/python/probe.py`](references/python/probe.py).
> Do NOT redefine inline — the validator enforces single-source-of-truth.

## Vault-type awareness (decision)

Per spec §4.4 Q-D1 (locked decision), this skill probes **both**
Recovery Services Vaults and Backup Vaults. These are two distinct
Azure backup surfaces:

| Vault kind | SDK | When to use |
|------------|-----|-------------|
| Recovery Services Vault | `azure-mgmt-recoveryservices` | Classic VM / SQL / file backup |
| Backup Vault (DataProtection) | `azure-mgmt-dataprotection` | Modern Blob / Disk / PostgreSQL backup |

A Foundry RG may have neither, one, or both. The probe doesn't
prefer either — both are reported in `result["vaults"]` with their
`kind` field set accordingly.

## CLI

```bash
python -m azure_backup_readiness --sub  --rg 
# optional REL-007 type filter:
python -m azure_backup_readiness --sub  --rg  --protected-item-types VM SQLDataBase
```

Outputs JSON to stdout AND writes the same content to
`out/.json`. Override via
`AZURE_BACKUP_READINESS_OUT=`.

## Auth

Uses `DefaultAzureCredential`. Caller needs at minimum `Backup Reader`
at the RG scope (built-in role). Without it, the probe returns a
shape with `probe_error` populated rather than raising.

## See also

- `azure-resource-diagnostics` — peer skill for diagnostic settings audit.
- `foundry-rbac-audit` — peer skill for RBAC posture audit.
- `azure-monitor-alert-baseline` — peer skill for alert coverage audit.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [aiappsgbb](https://github.com/aiappsgbb)
- **Source:** [aiappsgbb/awesome-gbb](https://github.com/aiappsgbb/awesome-gbb)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-aiappsgbb-awesome-gbb-azure-backup-readiness
- Seller: https://agentstack.voostack.com/s/aiappsgbb
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.