# Azure Resource Diagnostics

> >

- **Type:** Skill
- **Install:** `agentstack add skill-aiappsgbb-awesome-gbb-azure-resource-diagnostics`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [aiappsgbb](https://agentstack.voostack.com/s/aiappsgbb)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [aiappsgbb](https://github.com/aiappsgbb)
- **Source:** https://github.com/aiappsgbb/awesome-gbb/tree/main/skills/azure-resource-diagnostics

## Install

```sh
agentstack add skill-aiappsgbb-awesome-gbb-azure-resource-diagnostics
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# azure-resource-diagnostics

Audits Azure diagnostic-settings coverage at a resource group scope.

## When to use

- threadlight v0.5.x needs to flip OBS-106 from `kind: manual` to
  `kind: sibling-skill` — this skill's `probe()` is the sibling.
- Pre-pilot review: confirm a candidate Foundry RG routes its resource
  logs somewhere (Log Analytics / Event Hubs / Storage) before a
  customer pilot.
- Spoke landing-zone check: detect resources that have no diagnostic
  settings configured at all.

## Probing an RG

```python
from azure_resource_diagnostics.probe import probe

result = probe(
    subscription_id="",
    resource_group="",
    # target_resource_types=["storage_account", "key_vault"],  # optional OBS-106 filter
)
# result["resources"]                          → list of {id, name, type, configured, destinations, setting_count}
# result["summary"]["total_resources"]         → int (after type filter)
# result["summary"]["configured_count"]        → int (≥1 destination set)
# result["summary"]["unconfigured_count"]      → int (no destination)
# result["summary"]["target_resource_types_filter"] → list[str] | None (echo of applied filter)
# result["summary"]["confidence"]              → 0.0..1.0
# result["summary"]["probe_error"]             → str | None
# result["findings"]                           → list of no-diagnostic-settings findings
# result["manifest_path"]                      → path to JSON manifest on disk
```

`target_resource_types` (the OBS-106 sibling-contract input) is an
**optional** list of resource-type tokens. Matching is robust: each
token is normalized (lowercased, non-alphanumerics stripped) and
matched as a substring of the normalized ARM type, so both raw ARM
types (`Microsoft.Storage/storageAccounts`) and snake_case logical
kinds (`storage_account`) select the same resources. When omitted
(default), every resource in the RG is probed. The applied filter is
echoed back in `summary.target_resource_types_filter`.

The probe **never raises**. If the RG resource listing is denied
(RBAC missing), the probe still returns a shape with `probe_error`
populated and `confidence: 0.0`. Resource types that don't support
diagnostic settings (Monitor returns 404) are treated as having no
destinations, not as a denial.

> **MUST:** Copy verbatim from
> [`references/python/probe.py`](references/python/probe.py).
> Do NOT redefine inline — the validator enforces single-source-of-truth.

## "Any destination counts" (decision)

Per spec §4.4 Q-D2 (locked decision), a resource is **configured** if
it has **any** diagnostic setting routing to **any** destination:

| Destination | Setting attribute | Meaning |
|-------------|-------------------|---------|
| Log Analytics | `workspace_id` | Logs → LAW workspace |
| Event Hubs | `event_hub_authorization_rule_id` | Logs → Event Hubs |
| Storage | `storage_account_id` | Logs → Storage account |

A diagnostic setting that exists but routes nowhere counts as
**unconfigured**. Each unconfigured resource produces a
`no-diagnostic-settings` finding.

## CLI

```bash
python -m azure_resource_diagnostics --sub  --rg 
# optional OBS-106 type filter (ARM types or logical kinds):
python -m azure_resource_diagnostics --sub  --rg  --target-resource-types storage_account key_vault
```

Outputs JSON to stdout AND writes the same content to
`out/.json`. Override via
`AZURE_RESOURCE_DIAGNOSTICS_OUT=`.

## Auth

Uses `DefaultAzureCredential`. Caller needs at minimum `Monitoring
Reader` at the RG scope (built-in role) plus `Reader` to list
resources. Without it, the probe returns a shape with `probe_error`
populated rather than raising.

## See also

- `azure-backup-readiness` — peer skill for backup-coverage audit.
- `azure-monitor-alert-baseline` — peer skill for alert coverage audit.
- `foundry-rbac-audit` — peer skill for RBAC posture audit.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [aiappsgbb](https://github.com/aiappsgbb)
- **Source:** [aiappsgbb/awesome-gbb](https://github.com/aiappsgbb/awesome-gbb)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-aiappsgbb-awesome-gbb-azure-resource-diagnostics
- Seller: https://agentstack.voostack.com/s/aiappsgbb
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.