Skip to content

Commit 1049fa8

Browse files
Ba4besBa4bes
authored
Merge pull request #4 from Ba4bes/ba4bes/fix-azure-iac-generator-skill
feat: Implement Azure IaC generator with Bicep conversion and diagram…
2 parents a94d8a0 + a7cc75b commit 1049fa8

16 files changed

Lines changed: 915 additions & 9 deletions

‎ba4bes-unific-travis.sln‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
Microsoft Visual Studio Solution File, Format Version 12.00
2+
# Visual Studio Version 17
3+
VisualStudioVersion = 17.5.2.0
4+
MinimumVisualStudioVersion = 10.0.40219.1
5+
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "tests", "tests", "{0AB3BF05-4346-4AA6-1389-037BE0695223}"
6+
EndProject
7+
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "appinsights-instrumentation", "appinsights-instrumentation", "{ACF383C6-5B38-4A54-7773-CC6029374F88}"
8+
EndProject
9+
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "resources", "resources", "{66E69BC0-5302-D2DC-C6CF-C9DDB9A11B2B}"
10+
EndProject
11+
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "aspnetcore-app", "tests\appinsights-instrumentation\resources\aspnetcore-app\aspnetcore-app.csproj", "{CABCA128-4474-8808-9FCB-383890941946}"
12+
EndProject
13+
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "azure-prepare", "azure-prepare", "{A44C729E-0F82-40BC-04DE-9CBB89B4F9EB}"
14+
EndProject
15+
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "eval", "eval", "{79540773-9505-E730-EBDE-F703833C4BC5}"
16+
EndProject
17+
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "fixtures", "fixtures", "{1F2AA042-BF07-CA97-0662-E6B6BC8CBC3F}"
18+
EndProject
19+
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "dotnet-cosmosdb", "dotnet-cosmosdb", "{50619CA1-9D12-3683-C115-3022E34003B1}"
20+
EndProject
21+
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "MyFunctions", "tests\azure-prepare\eval\fixtures\dotnet-cosmosdb\MyFunctions.csproj", "{74C8039D-26B2-72B9-DE91-46D23FAD45F6}"
22+
EndProject
23+
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "dotnet-http", "dotnet-http", "{5FDD7ED6-3A7A-71F0-7FB3-F520640D44DD}"
24+
EndProject
25+
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "MyFunctions", "tests\azure-prepare\eval\fixtures\dotnet-http\MyFunctions.csproj", "{465FB149-DF7E-536B-A0C3-40707ED77907}"
26+
EndProject
27+
Global
28+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
29+
Debug|Any CPU = Debug|Any CPU
30+
Release|Any CPU = Release|Any CPU
31+
EndGlobalSection
32+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
33+
{CABCA128-4474-8808-9FCB-383890941946}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
34+
{CABCA128-4474-8808-9FCB-383890941946}.Debug|Any CPU.Build.0 = Debug|Any CPU
35+
{CABCA128-4474-8808-9FCB-383890941946}.Release|Any CPU.ActiveCfg = Release|Any CPU
36+
{CABCA128-4474-8808-9FCB-383890941946}.Release|Any CPU.Build.0 = Release|Any CPU
37+
{74C8039D-26B2-72B9-DE91-46D23FAD45F6}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
38+
{74C8039D-26B2-72B9-DE91-46D23FAD45F6}.Debug|Any CPU.Build.0 = Debug|Any CPU
39+
{74C8039D-26B2-72B9-DE91-46D23FAD45F6}.Release|Any CPU.ActiveCfg = Release|Any CPU
40+
{74C8039D-26B2-72B9-DE91-46D23FAD45F6}.Release|Any CPU.Build.0 = Release|Any CPU
41+
{465FB149-DF7E-536B-A0C3-40707ED77907}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
42+
{465FB149-DF7E-536B-A0C3-40707ED77907}.Debug|Any CPU.Build.0 = Debug|Any CPU
43+
{465FB149-DF7E-536B-A0C3-40707ED77907}.Release|Any CPU.ActiveCfg = Release|Any CPU
44+
{465FB149-DF7E-536B-A0C3-40707ED77907}.Release|Any CPU.Build.0 = Release|Any CPU
45+
EndGlobalSection
46+
GlobalSection(SolutionProperties) = preSolution
47+
HideSolutionNode = FALSE
48+
EndGlobalSection
49+
GlobalSection(NestedProjects) = preSolution
50+
{ACF383C6-5B38-4A54-7773-CC6029374F88} = {0AB3BF05-4346-4AA6-1389-037BE0695223}
51+
{66E69BC0-5302-D2DC-C6CF-C9DDB9A11B2B} = {ACF383C6-5B38-4A54-7773-CC6029374F88}
52+
{CABCA128-4474-8808-9FCB-383890941946} = {66E69BC0-5302-D2DC-C6CF-C9DDB9A11B2B}
53+
{A44C729E-0F82-40BC-04DE-9CBB89B4F9EB} = {0AB3BF05-4346-4AA6-1389-037BE0695223}
54+
{79540773-9505-E730-EBDE-F703833C4BC5} = {A44C729E-0F82-40BC-04DE-9CBB89B4F9EB}
55+
{1F2AA042-BF07-CA97-0662-E6B6BC8CBC3F} = {79540773-9505-E730-EBDE-F703833C4BC5}
56+
{50619CA1-9D12-3683-C115-3022E34003B1} = {1F2AA042-BF07-CA97-0662-E6B6BC8CBC3F}
57+
{74C8039D-26B2-72B9-DE91-46D23FAD45F6} = {50619CA1-9D12-3683-C115-3022E34003B1}
58+
{5FDD7ED6-3A7A-71F0-7FB3-F520640D44DD} = {1F2AA042-BF07-CA97-0662-E6B6BC8CBC3F}
59+
{465FB149-DF7E-536B-A0C3-40707ED77907} = {5FDD7ED6-3A7A-71F0-7FB3-F520640D44DD}
60+
EndGlobalSection
61+
GlobalSection(ExtensibilityGlobals) = postSolution
62+
SolutionGuid = {8E98131F-80C5-4D1E-A0E7-CC00D7F68BE0}
63+
EndGlobalSection
64+
EndGlobal

‎plugin/skills/azure-iac-generator/SKILL.md‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,12 @@ description: "Generate deployment-ready Bicep templates from existing Azure envi
44
license: MIT
55
metadata:
66
author: Microsoft
7-
version: "1.0.0"
7+
version: "1.0.1"
88
---
99

1010
# Azure IaC Generator
1111

12-
Reverse-engineer live Azure resources or Draw.io diagrams into deployment-ready, modular Bicep. The goal is an **environment-identical** redeployment — every runtime version, SKU, and setting must match the Azure source.
12+
Reverse-engineer live Azure resources or Draw.io diagrams into deployment-ready, modular Bicep. The goal is an **environment-identical** redeployment for supported configurations. When Azure uses an end-of-life runtime, preserve the extracted value in comments and default to the current supported upgrade path.
1313

1414
## Prerequisites
1515

@@ -32,6 +32,10 @@ Reverse-engineer live Azure resources or Draw.io diagrams into deployment-ready,
3232
| **CLI fallback** | `az resource show --ids <id>`, `az webapp show`, `az webapp config appsettings list` |
3333
| **Output** | Project folder with `main.bicep`, `.bicepparam`, `modules/`, `dependencies/`, `README.md` |
3434

35+
## Design Notes
36+
37+
Named `azure-iac-generator` rather than `azure-bicep-generator` to accommodate future IaC tooling such as Terraform. Bicep is the only supported target today; Terraform support is reserved for a future iteration.
38+
3539
## Routing — MUST follow the matched workflow
3640

3741
```
@@ -49,6 +53,7 @@ User request
4953
- [azure-resource-configs.md](references/azure-resource-configs.md) — Per-type property extraction
5054
- [azure-deployment-verification.md](references/azure-deployment-verification.md) — Pre-deployment checks
5155
- [version-currency.md](references/version-currency.md) — API + runtime version rules
56+
- [bicep-parsing.md](references/procedures/bicep-parsing.md) — Parse existing Bicep and `.bicepparam` files when merging with generated output
5257

5358
## Output Structure — MUST create this folder layout
5459

‎plugin/skills/azure-iac-generator/references/azure-deployment-verification.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
# Azure Deployment Verification Rules
22

3+
> **Canonical copy:** Shared deployment-verification rules used by Azure IaC skills. Keep local copies aligned when this rule set changes.
4+
5+
36
Shared pre-deployment verification rules for generated Bicep templates. These cover **gotcha-prone constraints** that are easy to miss — SKU dependencies, resource compatibility, and networking rules that cause deployment failures.
47

58
For rules not listed here (security defaults like TLS 1.2, HTTPS enforcement, runtime version currency), verify against Bicep MCP `get_az_resource_type_schema`, [bicep-best-practices.md](bicep-best-practices.md), and Microsoft documentation.

‎plugin/skills/azure-iac-generator/references/azure-resource-model.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
# Azure Resource Metadata Model
22

3+
> **Canonical copy:** Shared resource-model schema used across Azure IaC and diagram skills. Keep local copies aligned when this schema changes.
4+
5+
36
Shared internal representation used by AzVerify skills (sketch-to-diagram, diagram-to-bicep, diagram-azure-sync).
47

58
## Schema

‎plugin/skills/azure-iac-generator/references/azure-stencil-mapping.json‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
{
2+
"_canonicalCopy": {
3+
"description": "Shared Azure stencil mapping copied into azure-iac-generator so diagram-parsing references resolve locally.",
4+
"maintainers": [
5+
"Azure IaC skills"
6+
]
7+
},
8+
"resources": [
9+
{
10+
"type": "Microsoft.Compute/virtualMachines",
11+
"imagePath": "img/lib/azure2/compute/Virtual_Machine.svg"
12+
},
13+
{
14+
"type": "Microsoft.Web/sites",
15+
"imagePath": "img/lib/azure2/app_services/App_Services.svg"
16+
},
17+
{
18+
"type": "Microsoft.Web/serverfarms",
19+
"imagePath": "img/lib/azure2/app_services/App_Service_Plans.svg"
20+
},
21+
{
22+
"type": "Microsoft.Storage/storageAccounts",
23+
"imagePath": "img/lib/azure2/storage/Storage_Accounts.svg"
24+
},
25+
{
26+
"type": "Microsoft.KeyVault/vaults",
27+
"imagePath": "img/lib/azure2/security/Key_Vaults.svg"
28+
},
29+
{
30+
"type": "Microsoft.Sql/servers",
31+
"imagePath": "img/lib/azure2/databases/SQL_Server.svg"
32+
},
33+
{
34+
"type": "Microsoft.Sql/servers/databases",
35+
"imagePath": "img/lib/azure2/databases/SQL_Database.svg"
36+
},
37+
{
38+
"type": "Microsoft.Network/virtualNetworks",
39+
"imagePath": "img/lib/azure2/networking/Virtual_Networks.svg"
40+
},
41+
{
42+
"type": "Microsoft.Network/virtualNetworks/subnets",
43+
"imagePath": "img/lib/azure2/networking/Subnets.svg"
44+
},
45+
{
46+
"type": "Microsoft.Network/networkSecurityGroups",
47+
"imagePath": "img/lib/azure2/networking/Network_Security_Groups.svg"
48+
},
49+
{
50+
"type": "Microsoft.Network/privateEndpoints",
51+
"imagePath": "img/lib/azure2/networking/Private_Link.svg"
52+
},
53+
{
54+
"type": "Microsoft.Network/privateDnsZones",
55+
"imagePath": "img/lib/azure2/networking/Private_DNS_Zones.svg"
56+
},
57+
{
58+
"type": "Microsoft.Network/applicationGateways",
59+
"imagePath": "img/lib/azure2/networking/Application_Gateways.svg"
60+
},
61+
{
62+
"type": "Microsoft.Network/loadBalancers",
63+
"imagePath": "img/lib/azure2/networking/Load_Balancers.svg"
64+
},
65+
{
66+
"type": "Microsoft.Network/publicIPAddresses",
67+
"imagePath": "img/lib/azure2/networking/Public_IP_Addresses.svg"
68+
},
69+
{
70+
"type": "Microsoft.ContainerRegistry/registries",
71+
"imagePath": "img/lib/azure2/containers/Container_Registries.svg"
72+
},
73+
{
74+
"type": "Microsoft.ContainerService/managedClusters",
75+
"imagePath": "img/lib/azure2/containers/Kubernetes_Services.svg"
76+
},
77+
{
78+
"type": "Microsoft.App/containerApps",
79+
"imagePath": "img/lib/azure2/containers/Container_Apps.svg"
80+
},
81+
{
82+
"type": "Microsoft.DocumentDB/databaseAccounts",
83+
"imagePath": "img/lib/azure2/databases/Azure_Cosmos_DB.svg"
84+
},
85+
{
86+
"type": "Microsoft.Cache/redis",
87+
"imagePath": "img/lib/azure2/databases/Azure_Cache_for_Redis.svg"
88+
},
89+
{
90+
"type": "Microsoft.ServiceBus/namespaces",
91+
"imagePath": "img/lib/azure2/integration/Service_Bus.svg"
92+
},
93+
{
94+
"type": "Microsoft.EventHub/namespaces",
95+
"imagePath": "img/lib/azure2/analytics/Event_Hubs.svg"
96+
},
97+
{
98+
"type": "Microsoft.Insights/components",
99+
"imagePath": "img/lib/azure2/monitor/Application_Insights.svg"
100+
},
101+
{
102+
"type": "Microsoft.OperationalInsights/workspaces",
103+
"imagePath": "img/lib/azure2/monitor/Log_Analytics_Workspaces.svg"
104+
},
105+
{
106+
"type": "Microsoft.ManagedIdentity/userAssignedIdentities",
107+
"imagePath": "img/lib/azure2/identity/Managed_Identities.svg"
108+
}
109+
]
110+
}

‎plugin/skills/azure-iac-generator/references/azure-to-bicep-workflow.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ Get target scope: resource group name(s) and subscription ID. If not specified,
1414

1515
## Step 3 — Discover Resources
1616

17-
Use `azure_mcp-group_resource_list` (or `az resource list --resource-group <name>`) to enumerate all resources. Extract: `id`, `name`, `type`, `location`, `tags`, `sku`. If no resources found, stop with an error.
17+
Use `group_resource_list` (or `az resource list --resource-group <name>`) to enumerate all resources. Extract: `id`, `name`, `type`, `location`, `tags`, `sku`. If no resources found, stop with an error.
1818

1919
## Step 4 — Filter Non-Deployable Resources
2020

@@ -65,14 +65,14 @@ Follow [bicep-best-practices.md](bicep-best-practices.md) strictly. Call Bicep M
6565
| `main.bicep` | `targetScope = 'resourceGroup'`; all params with `@description()` and `@secure()` where needed; one `module` block per category; outputs for key endpoints/IDs |
6666
| `<scope>.bicepparam` | `using 'main.bicep'`; every param value matching current Azure config; 1-3 line comments per param (what it controls, alternatives with cost impact, version EOL dates); `readEnvironmentVariable()` for secrets |
6767
| `modules/networking.bicep` | VNets, subnets, NSGs, private endpoints, NICs, firewalls |
68-
| `modules/compute.bicep` | VMs, App Services, Functions, Container Apps — **use actual runtime from Azure** (e.g., `DOTNETCORE|8.0` exactly as extracted, not guessed) |
68+
| `modules/compute.bicep` | VMs, App Services, Functions, Container Apps — follow the runtime defaulting rules in [version-currency.md](version-currency.md) |
6969
| `modules/data.bicep` | Storage, SQL, Cosmos DB, Redis, Key Vault |
7070
| `modules/identity.bicep` | User-assigned managed identities, role assignments |
7171
| `modules/monitoring.bicep` | App Insights, Log Analytics, action groups |
7272

7373
Only create module files that have resources. Each module receives only the params it needs. Use `parent:` for child resources, `existing` blocks for cross-module refs, symbolic references (`foo.id`) — never `resourceId()`.
7474

75-
**Runtime version rule**: Use the exact runtime version from Azure. If the extracted version is end-of-life per [version-currency.md](version-currency.md), keep the current value as default but add a comment recommending the upgrade with EOL date.
75+
Apply the runtime defaulting and comment rules from [version-currency.md](version-currency.md). That file is the single source of truth for supported-versus-EOL handling.
7676

7777
## Step 9 — Generate Dependencies Folder
7878

‎plugin/skills/azure-iac-generator/references/procedures/azure-authentication.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
# Azure Authentication Check
22

3+
> **Canonical copy:** Shared authentication gate used by Azure IaC and diagram skills. Keep local copies aligned when this procedure changes.
4+
5+
36
Canonical procedure for verifying Azure session before any Azure operations. Referenced by all skills that interact with Azure.
47

58
---

‎plugin/skills/azure-iac-generator/references/procedures/bicep-parsing.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
# Bicep Parsing Procedure
22

3+
> **Canonical copy:** Shared Bicep parsing procedure used by Azure IaC and comparison skills. Keep local copies aligned when this procedure changes.
4+
5+
36
Parse Bicep templates into a structured resource model for comparison. Referenced by skills that analyze existing Bicep files.
47

58
---

‎plugin/skills/azure-iac-generator/references/procedures/diagram-parsing.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
# Diagram Parsing Procedure
22

3+
> **Canonical copy:** Shared diagram-parsing procedure used by Azure IaC and diagram skills. Keep local copies aligned when this procedure changes.
4+
5+
36
Parse a Draw.io XML file into a structured resource model. Referenced by all skills that consume Draw.io diagrams.
47

58
---

‎plugin/skills/azure-iac-generator/references/procedures/resource-filtering.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Resource Filtering for Azure-to-Bicep
2+
3+
> **Canonical copy:** Shared resource-filtering rules used by Azure IaC skills. Keep local copies aligned when this filter list changes.
4+
5+
6+
Use this table during Azure-to-Bicep discovery to remove resources that should not become first-class Bicep resources in generated output.
7+
8+
## Filtering Table
9+
10+
| Resource Pattern or Type | Why It Is Filtered | Exclude for Bicep |
11+
|---|---|---|
12+
| `Microsoft.Resources/deployments` | Deployment history is operational metadata, not desired-state infrastructure. | Yes |
13+
| `Microsoft.Insights/metricalerts` generated by platform onboarding | Often auto-created during monitoring enablement and not part of the requested baseline. | Yes |
14+
| `Microsoft.AlertsManagement/smartDetectorAlertRules` | Auto-generated smart detection rules are service-managed. | Yes |
15+
| `microsoft.insights/webtests` created by availability defaults | Synthetic tests may be optional operational assets rather than core infrastructure. | Yes |
16+
| Resources with `hidden-` prefixes or `hidden-link:` tags | Platform-generated link resources are derived artifacts, not author-managed infrastructure. | Yes |
17+
| Extension resources whose lifecycle is entirely platform-managed | These resources are recreated by the parent service and should not be emitted directly. | Yes |
18+
| `Microsoft.Insights/components` | Application Insights is deployable infrastructure and should be preserved. | No |
19+
| `Microsoft.OperationalInsights/workspaces` | Log Analytics workspaces are deployable infrastructure and should be preserved. | No |
20+
| `Microsoft.ManagedIdentity/userAssignedIdentities` | User-assigned identities are first-class deployable resources. | No |
21+
| `Microsoft.Insights/diagnosticSettings` | Diagnostic settings are deployable and often required for parity. | No |
22+
23+
## Procedure
24+
25+
1. Start with the full `group_resource_list` output.
26+
2. Exclude rows marked **Yes** in the table above.
27+
3. Keep all rows marked **No**, even when they were created by portal workflows.
28+
4. If a resource is ambiguous, prefer keeping it and note the uncertainty in the generated `README.md`.

0 commit comments

Comments
 (0)