azure-defaults

# Azure Defaults Skill

IaC-flavoured mirror of the canonical Azure defaults declared in
[`.github/copilot-instructions.md`](../../copilot-instructions.md#azure-defaults-canonical).
Deep-dive content lives in `references/` — load on demand.

> **Canonical source rule**: if the tables below disagree with
> [`copilot-instructions.md`](../../copilot-instructions.md#azure-defaults-canonical),
> the canonical declaration wins. This skill restates them for IaC-output
> convenience only.

---

## Quick Reference (Load First)

### Default Regions

| Service             | Default Region       | Reason                         |
| ------------------- | -------------------- | ------------------------------ |
| **All resources**   | `swedencentral`      | EU GDPR-compliant              |
| **Static Web Apps** | `westeurope`         | Not available in swedencentral |
| **Failover**        | `germanywestcentral` | EU paired alternative          |

### Required Tags (Azure Policy Enforced)

**These 9 lowercase tags are the APEX baseline** — they mirror the
org-wide resource-group tag-deny policy (every key must exist on the RG
or the deployment is denied). Use lowercase keys (mixing `owner` +
`Owner` triggers `AmbiguousPolicyEvaluationPaths`). Always defer to
`04-governance-constraints.md` for the project's actual required list —
discovered policy always wins.

| Tag                 | Required | Example Values           |
| ------------------- | -------- | ------------------------ |
| `environment`       | Yes      | `dev`, `staging`, `prod` |
| `owner`             | Yes      | `team-platform@…`        |
| `costcenter`        | Yes      | `cc-12345`               |
| `application`       | Yes      | `mindthehack`            |
| `workload`          | Yes      | `apex-aks`               |
| `sla`               | Yes      | `production`, `dev`      |
| `backup-policy`     | Yes      | `daily-35d`, `none`      |
| `maint-window`      | Yes      | `sat-02:00-04:00`        |
| `technical-contact` | Yes      | `alerts@…`               |

### Unique Suffix Pattern

Generate ONCE, pass to ALL modules:

```bicep
var uniqueSuffix = uniqueString(resourceGroup().id)
```

### Security Baseline (5-Line Summary)

| Setting               | Value            | Applies To       |
| --------------------- | ---------------- | ---------------- |
| HTTPS-only            | `true`           | Storage, all     |
| TLS minimum           | `'TLS1_2'`       | All services     |
| Public blob access    | `false`          | Storage          |
| Public network (prod) | `'Disabled'`     | Data services    |
| Authentication        | Managed Identity | Prefer over keys |

For AVM pitfalls and deprecation patterns, read
`references/security-baseline-full.md`.

### Cost Monitoring Baseline

Non-negotiable for prod. Governance (`04-governance-constraints.json`
`cost_monitoring.*`) always wins. Budget thresholds: 5 notifications
(actual 80/100/125 + forecast 100/125). Required: budget + Action Group
(AVM, create-or-reuse via preflight) + subscription-scoped anomaly alert.
Opt-out via `cost_monitoring_mode ∈ {enforced, minimal, deferred}`
(`minimal`/`deferred` non-prod only).

For the full contract, AVM lookup, governance precedence, and exception
schema, read [`references/cost-alerts-baseline.md`](references/cost-alerts-baseline.md).
For stack-specific snippets, read
[`references/cost-alerts-bicep.md`](references/cost-alerts-bicep.md) or
[`references/cost-alerts-terraform.md`](references/cost-alerts-terraform.md).

### VNet Planning Baseline

Interactive. Architect Phase 6b (between 6a SKU confirmation and Step 7
pricing) runs the gate whenever **either** trigger holds:
(a) any `services[].requires[]` row contains `vnet-integration` or
`private-endpoints`, OR (b) any `services[].service_name` is in the
vnet-attached whitelist (App Gateway, AKS, VM/VMSS, APIM internal,
Bastion, Azure Firewall, VPN/ER Gateway, NAT Gateway, App Gateway for
Containers). Default address space `10.0.0.0/16` (greenfield;
at least `/22`). Recommendation style: a single subnet table followed
by per-row `Apply edit / Skip / Done` askMe loop. Opt-out via
`vnet_planning_mode ∈ {guided, fast, deferred}` (`deferred` blocked
for prod). Governance `network_constraints` always wins.

For the full contract — trigger contract, askQuestions templates,
subnet sizing matrix per workload with Microsoft Learn citations,
CIDR math, existing-VNet validation, AVM modules — read
[`references/vnet-planning.md`](references/vnet-planning.md).

### Deprecated Services (Do NOT Recommend for Greenfield)

Never recommend deprecated services (Azure AD B2C, Redis Enterprise E50,
CDN WAF classic, App Gateway v1, CDN Standard Microsoft) for greenfield.
Full retirement table + replacement guidance:
[`references/deprecated-services.md`](references/deprecated-services.md).

### Engine / Runtime Version Currency

For any managed service with a selectable engine or runtime version
(MySQL / PostgreSQL, Redis, AKS Kubernetes version, Cosmos API, App
Service runtime), pin the **latest GA LTS** version and confirm it
against the service's version-support policy at plan time. Two failure
modes to avoid:

- **Retiring versions** carried over from an older template (e.g. MySQL
  `8.0`, whose standard support ends 2026-04-30). The version literal is
  a creative decision — resolve it live, don't copy it from a prior
  project.
- **Innovation / preview releases** (e.g. MySQL `9.x`) for durable data
  workloads. Innovation releases exclude HA, replicas, and automated
  backups and have a short server lifecycle.

Example: MySQL Flexible Server → `version: '8.4'` (GA LTS → 8.4.x), not
the retiring `8.0` or the innovation `9.x`. A major-version change on an
**existing** server is a separate concern — see
[`iac-common/known-deploy-issues.md`](../iac-common/references/known-deploy-issues.md).

---

## CAF Naming Conventions

| Resource         | Abbr    | Pattern                     | Max |
| ---------------- | ---