azure-enterprise-infra-planner
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- Gated Infrastructure Pipeline: The skill implements a structured 7-phase workflow. Each phase has specific completion criteria (gates) that must be met before the agent proceeds, ensuring architectural consistency and safety.
- Secure-by-Default Configuration: Phase 6 of the workflow enforces mandatory security controls on generated infrastructure, such as disabling public network access for data services, prioritizing Managed Identities over keys, and enforcing minimum TLS 1.2.
- Mandatory Security Scanning: The skill integrates security scanning directly into its workflow. Generated infrastructure-as-code must pass a local validation check and a Checkov security scan with no unresolved high or critical findings before it is presented for deployment.
- Deployment Safeguards: A 'Destructive Action Gate' is implemented in Phase 7, requiring the user to explicitly acknowledge risks and provide confirmation before any deployment commands are executed. This prevents deployment based on implicit or vague instructions.
- Official Resource Integration: The skill references official Microsoft documentation and schemas (e.g., learn.microsoft.com) to ensure that the infrastructure plans are based on authoritative and up-to-date guidance.
Audit Metadata