# Well Architected Review

> Run a Well-Architected Framework (WAF) review against Azure resources in scope. Use when asked about best practices, architecture review, WAF assessment, or pillar compliance (Reliability, Security, Cost, Operational Excellence, Performance Efficiency).

- **Type:** Skill
- **Install:** `agentstack add skill-ricmmartins-azure-sre-agent-skills-01-well-architected-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [ricmmartins](https://agentstack.voostack.com/s/ricmmartins)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [ricmmartins](https://github.com/ricmmartins)
- **Source:** https://github.com/ricmmartins/azure-sre-agent-skills/tree/main/skills/01-well-architected-review

## Install

```sh
agentstack add skill-ricmmartins-azure-sre-agent-skills-01-well-architected-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Well-Architected Review

## Purpose
Perform a structured assessment of Azure resources against the five pillars of the Microsoft Azure Well-Architected Framework. Produce a scored report with prioritized recommendations.

## When to use this skill
- User asks "are we following best practices?"
- User asks for a WAF or Well-Architected review
- User wants to assess architecture quality before a launch or audit
- Periodic (quarterly) architecture health check

## Pillars and checks

### 1. Reliability
Run the following checks and report findings:

1. **Availability design**: Check if critical workloads use availability zones or availability sets
   ```bash
   az vm list --query "[].{name:name, zones:zones, availabilitySet:availabilitySet.id}" -o table
   az appservice plan list --query "[].{name:name, zoneRedundant:zoneRedundant, sku:sku.name}" -o table
   ```
2. **Backup coverage**: Verify Recovery Services vaults and backup policies exist for VMs, databases, and file shares
   ```bash
   az backup vault list -o table
   ```
   Then for each vault:
   ```bash
   az backup item list --vault-name  --resource-group  --backup-management-type AzureIaasVM -o table
   ```
3. **Disaster recovery**: Check for paired regions, ASR replication, or geo-redundant storage
4. **Health probes**: Verify App Service health checks, load balancer probes, and Container Apps health endpoints
5. **Auto-healing**: Check if App Service auto-heal rules or AKS pod disruption budgets are configured

### 2. Security
1. **Identity**: Check for managed identities vs. stored credentials
   ```bash
   az webapp identity show --name  --resource-group 
   az ad app list --query "[].{name:displayName, passwordCredentials:passwordCredentials}" -o table
   ```
2. **Network isolation**: Check for private endpoints, NSGs, and service endpoints
   ```bash
   az network private-endpoint list -o table
   az network nsg list -o table
   ```
3. **Encryption**: Verify encryption at rest (storage, databases) and in transit (TLS)
4. **Key management**: Check Key Vault usage and key/secret expiration dates
   ```bash
   az keyvault list -o table
   az keyvault secret list --vault-name  --query "[].{name:name, expires:attributes.expires}" -o table
   ```
5. **Defender for Cloud**: Check Secure Score and outstanding recommendations

### 3. Cost Optimization
1. **Rightsizing**: Identify underutilized VMs (CPU  -o table
   ```
4. **Deployment practices**: Check for deployment slots, blue-green, or canary configurations
5. **Automation**: Check for runbooks, Logic Apps, or scheduled tasks for routine operations

### 5. Performance Efficiency
1. **Autoscaling**: Verify autoscale rules exist for App Service plans, VMSS, and Container Apps
   ```bash
   az monitor autoscale list --resource-group  -o table
   ```
   Note: `az monitor autoscale list` requires `--resource-group`. Iterate over relevant resource groups, or use Azure Resource Graph:
   ```bash
   az graph query -q "resources | where type == 'microsoft.insights/autoscalesettings'" -o table
   ```
2. **Caching**: Check for Redis Cache or CDN usage on high-traffic workloads
3. **Database performance**: Check DTU/vCore utilization, index recommendations
4. **Content delivery**: Verify static assets use CDN or Front Door
5. **Connection pooling**: Check for connection string patterns suggesting missing pooling

## Scoring model

For each check, assign one of:
- ✅ **Pass** — follows best practice
- ⚠️ **Needs attention** — partially implemented or at risk
- ❌ **Fail** — not implemented, risk exposure

## Expected output

### Report header (mandatory — use this exact format)

## Well-Architected Review Report

| Field | Value |
|-------|-------|
| Subscription | (name + ID) |
| Assessment Date | YYYY-MM-DD |
| Overall Score | XX% |

### Summary
A table with pillar scores:

| Pillar | Pass | Needs Attention | Fail | Score |
|--------|------|----------------|------|-------|
| Reliability | X | Y | Z | X/(X+Y+Z) % |
| Security | ... | ... | ... | ... |
| Cost Optimization | ... | ... | ... | ... |
| Operational Excellence | ... | ... | ... | ... |
| Performance Efficiency | ... | ... | ... | ... |
| **Overall** | | | | **avg %** |

### Detailed findings
For each pillar, list every check with:
- Status (pass/attention/fail)
- Evidence (command output or observation)
- Recommendation (specific action to take)
- Priority (Critical / High / Medium / Low)
- Reference link to WAF documentation

### Top 5 recommendations
Ordered by impact, with estimated effort (hours/days) for each.

### Remediation guidance
For each ❌ or ⚠️ finding, include in the output:
1. The specific `az` CLI command to remediate (suggest only — do not execute)
2. Use `GetAzCliHelp` to validate the command syntax before suggesting
3. The official Microsoft Learn documentation link for the remediation

### References
- WAF Overview: https://learn.microsoft.com/en-us/azure/well-architected/
- Reliability: https://learn.microsoft.com/en-us/azure/well-architected/reliability/
- Security: https://learn.microsoft.com/en-us/azure/well-architected/security/
- Cost Optimization: https://learn.microsoft.com/en-us/azure/well-architected/cost-optimization/
- Operational Excellence: https://learn.microsoft.com/en-us/azure/well-architected/operational-excellence/
- Performance Efficiency: https://learn.microsoft.com/en-us/azure/well-architected/performance-efficiency/

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [ricmmartins](https://github.com/ricmmartins)
- **Source:** [ricmmartins/azure-sre-agent-skills](https://github.com/ricmmartins/azure-sre-agent-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-ricmmartins-azure-sre-agent-skills-01-well-architected-review
- Seller: https://agentstack.voostack.com/s/ricmmartins
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.