Azure Infra Preflight

Azure Infra Preflight

A pre-deploy checklist that prevents the most common first-run failures in Azure Terraform workflows. Run this before writing a terraform plan.

1. Verify toolchain

mcp__claude-skills-cli__list_available_clis

Confirm az and terraform are both available. If either is missing, stop and tell the user which tool to install.

Check Terraform version:

mcp__claude-skills-cli__run_command { cli: "terraform", args: ["version"] }

Gate on >= 1.6 (required for import {} block syntax support).

2. Azure login + record subscription

mcp__claude-skills-cli__run_command { cli: "az", args: ["account", "show", "--output", "json"] }

If exitCode ≠ 0: stop. Tell the user to run az login manually (the MCP server cannot open a browser).

If exitCode = 0: write the JSON to /.claude//subscription.json via mcp__filesystem__write_file so subsequent sessions skip this step.

3. SSH key type check (Azure rejects ed25519)

Before writing terraform.tfvars with an SSH public key:

1. Check ~/.ssh/id_rsa.pub first (preferred for Azure).
2. If only ~/.ssh/id_ed25519.pub exists, do not use it — Azure

azurerm_linux_virtual_machine rejects ed25519 at terraform plan time with a hard error, even though init succeeds.

1. If no RSA key exists, generate one:

`` mcp__claude-skills-cli__run_command { cli: "ssh-keygen", // only if on allow-list, otherwise use Bash args: ["-t", "rsa", "-b", "4096", "-f", "/.claude//deploy-key", "-N", ""] } ` On Windows, use Git Bash via Bash tool if ssh-keygen is not on the CLI allow-list: `bash ssh-keygen -t rsa -b 4096 -f "/deploy-key" -N "" && cat "/deploy-key.pub" ``

4. Check whether resources already exist (import-before-apply)

mcp__claude-skills-cli__run_command {
  cli: "az",
  args: ["group", "exists", "--name", ""]
}

• stdout = false: resources are new — proceed with terraform plan normally.
• stdout = true: resources already exist. List them:

`` mcp__claude-skills-cli__run_command { cli: "az", args: ["resource", "list", "--resource-group", "", "--output", "json"] } ` For each resource, generate a native import {} block (TF >= 1.7): `hcl import { to = azurerm_. id = "/subscriptions/.../resourceGroups//providers//" } ` Write these to imports.tf in the Terraform root. Running terraform plan with import blocks present will reconcile state without destroying resources. Remove import blocks once terraform apply` completes.

Why: skipping this step causes terraform apply to attempt creating resources that already exist, producing ResourceAlreadyExists errors and requiring manual terraform import calls for each resource.

⚠ Windows / Git Bash path mangling — if using the legacy terraform import CLI (not import {} blocks), Git Bash converts /subscriptions/... to C:/Program Files/Git/subscriptions/..., breaking the import. Always pass env: { MSYS_NO_PATHCONV: "1" } in the run_command call: `` mcp__claude-skills-cli__run_command { cli: "terraform", args: ["import", "azurerm_resource_group.rg", "/subscriptions//resourceGroups/"], cwd: "", env: { MSYS_NO_PATHCONV: "1" } } ` **Prefer import {} blocks** over CLI import loops — they are written as HCL to imports.tf` and are not subject to shell path mangling.

5. Write a run-log entry

Append to /.claude//run-log.md:

## Preflight — 
- az login: ✓ 
- SSH key: RSA-4096 at 
- RG : exists=
- Resources found:  (import blocks written to imports.tf)
- TF version: 

6. Hand-offs

• terraform plan errors after preflight → terraform-plan-review
• 403 / AuthorizationFailed → azure-rbac-diagnostics
• CI pipeline failures → ci-pipeline-debug

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: sergeyitaly
• Source: sergeyitaly/claude-skill-deployer
• License: MIT

Install and usage instructions live in the source repository linked above.