agentsclimarketplace

Techtide azure waf security review

Skill TechTideOhio/techtide-harness-kit/skills/azure/techtide-azure-waf-security-review

Trust contracts for AI agent skills: JSON Schema risk tiers, tool permissions, deny-by-default egress, approval gates, prompt-injection fixtures, ~28 CI validation gates. Apache-2.0.

Install
npx -y skills add TechTideOhio/techtide-harness-kit --skill techtide-azure-waf-security-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Review Azure workload security posture against the Well-Architected Framework Security pillar: identity and access, network boundaries, data protection, threat detection, DevSecOps maturity, and policy compliance.

SKILL.md

4.6 KB, as published. Nobody here has run it

Azure WAF Security Review

The Azure Well-Architected Framework Security pillar provides guidance for protecting workload data, systems, and assets while maintaining confidentiality and integrity.

8 Security Design Principles

  1. Plan your security readiness - understand security requirements, threats, and compliance obligations before building
  2. Design to protect confidentiality - prevent exposure of sensitive data through encryption, access controls, and data classification
  3. Design to protect integrity - detect and prevent unauthorized access to systems and data; use identity-based access
  4. Design to protect availability - defend against attacks that deny access to workloads; use DDoS protection and redundancy
  5. Sustain and evolve your security posture - continuously monitor, learn from incidents, and improve defenses
  6. Defense in depth - layer multiple security controls so no single failure exposes the workload
  7. Zero trust - verify explicitly, use least privilege access, assume breach
  8. Minimize the blast radius - limit the scope of impact from security incidents

Azure Security Service Areas

Identity

  • Azure Active Directory (Entra ID), Conditional Access, MFA, Privileged Identity Management (PIM), Managed Identity

Network Security

  • Azure Firewall Premium, Azure Front Door + WAF, DDoS Protection Standard, Network Security Groups (NSG), Azure Private Link, Virtual Network Service Endpoints

Data Protection

  • Azure Key Vault (keys, secrets, certificates), Azure Disk Encryption, Storage Service Encryption, Always Encrypted (SQL), Microsoft Purview (data governance, sensitivity labels)

Threat Detection

  • Microsoft Defender for Cloud, Microsoft Sentinel (SIEM/SOAR), Azure Monitor, Defender for Servers/Containers/SQL/Storage/App Service

Governance

  • Azure Policy, Management Groups, Blueprints (deprecated → use Deployment Stacks), Microsoft Cloud Security Benchmark (MCSB)

DevSecOps

  • GitHub Advanced Security (CodeQL SAST, secret scanning), Microsoft Defender for DevOps, Container image scanning in ACR, Infrastructure scanning (PSRule for Azure, Checkov)

Assessment Questions

  • How do you manage identity and access to your workload resources?
  • How do you protect your network boundaries?
  • How do you classify and protect your data?
  • How do you detect and respond to security threats?
  • How do you ensure your workload and supply chain are free of vulnerabilities?
  • How do you enforce and validate compliance with security policies?
  • How do you segment access and contain blast radius?

Validation Checklist

  • All human access uses Entra ID - no local accounts or shared credentials on Azure resources
  • Managed Identity used for all Azure service-to-service access - no client secrets or certificates in code
  • MFA enforced via Conditional Access for all users with Azure RBAC assignments
  • PIM used for privileged roles (Owner, Contributor, User Access Administrator) with approval workflow and just-in-time access
  • Azure Policy assignments block public storage accounts, unapproved VM SKUs, non-compliant regions
  • Microsoft Defender for Cloud Standard tier enabled across all subscriptions; security score tracked
  • All storage accounts and Key Vaults use Private Endpoints - no public network access
  • Key Vault soft-delete and purge protection enabled for all key vaults
  • Azure Monitor diagnostic settings enabled for all critical resources; logs sent to Log Analytics
  • Microsoft Sentinel connected to Log Analytics workspace with MCSB analytics rules enabled
  • NSG Flow Logs enabled for all production VNets
  • Container images scanned in ACR; Defender for Containers enabled for AKS

Response Shape

Identity and access posture → network security assessment → data protection → threat detection coverage → DevSecOps maturity → policy compliance → prioritized recommendations → open risks

Official Documentation

Security Notes

Read-only advisory. Do not modify Entra ID policies, Conditional Access rules, Azure Policy, or Defender configurations without explicit approval.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.