Azure Storage

Azure Storage

Select and configure Azure storage with optimal redundancy, performance tiering, and access controls. Balance cost, durability, latency, and compliance requirements.

Use This Skill When

• The user needs file, object, or queue storage in Azure
• The user needs lifecycle, replication, or retention policy design
• The user needs secure access model for storage workloads
• The user wants to optimize storage costs while maintaining SLA

Context: Storage Maturity

Immature: Hot tier only, public access, no lifecycle, account key auth Developing: Correct tiering, RBAC, some lifecycle rules Managed: LRS for dev, GRS for prod, managed identity auth, lifecycle to cool/archive → Target Optimized: Geo-redundant reads, tiered access based on traffic, real-time cost optimization

Required Inputs

• Data type: Documents, logs, video, database backups, transactional
• Access pattern: Frequent (hot), occasional (cool), rare (archive), cold
• Size & growth: 10GB initial, 10% monthly growth? Or 1TB spike?
• Latency requirement: 80% of account quota
• Throttling (requests > per-second limit)
• Unusual deletion patterns
• Unauthorized access attempts

Output Contract

1. Storage Design

• Type selected (Blob, Files, Queues, ADLS) and justification
• Account creation commands
• Redundancy model (LRS, ZRS, GRS) and failover strategy

1. Security & Access

• Auth method (managed identity, SAS, keys) recommended
• Network isolation (private endpoints, firewalls)
• Encryption: at-rest (CMK or Microsoft-managed), in-transit (HTTPS)

1. Performance & Tiering

• Access tier choices (Hot/Cool/Archive/Cold)
• Lifecycle policy (automatic tiering rules)
• Cost estimation (hot vs. tiered vs. archive)

1. Backup & Retention

• Soft delete enabled? Versioning? Immutable retention?
• Lifecycle deletion policy
• RTO/RPO (can geo-failover if GRS)

1. Operational Checklist

• Monitoring enabled (metrics, logging)
• Alert thresholds set
• Cost optimization review cadence (quarterly)

Guardrails

• Prefer managed identity: No secrets in code; DefaultAzureCredential() handles token.
• Deny public access by default: Only allow explicit access (IP, VNet, SAS).
• Use lifecycle policies: Automatically move cold data to cheaper tiers; avoid manual re-tiering.
• Enable soft delete: Protects against accidental deletion; costs minimal.
• For compliance: Use immutable policies: Write-once-read-many (WORM) for audit logs.
• Monitor for throttling: If sustained >20,000 req/sec, consider sharding (multiple accounts).
• Audit access: Enable logging and monitor unexpected access patterns.
• Encrypt sensitive data: Use customer-managed keys (CMK) for highly regulated workloads.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: manu14357
• Source: manu14357/zskills
• License: MIT
• Homepage: https://zskills.vercel.app

Install and usage instructions live in the source repository linked above.