azure-storage

Files (1)

• SKILL.md

SKILL.md (first lines)

# Azure Storage

Select and configure Azure storage with optimal redundancy, performance tiering, and access controls.
Balance cost, durability, latency, and compliance requirements.

## Use This Skill When

- The user needs file, object, or queue storage in Azure
- The user needs lifecycle, replication, or retention policy design
- The user needs secure access model for storage workloads
- The user wants to optimize storage costs while maintaining SLA

## Context: Storage Maturity

**Immature**: Hot tier only, public access, no lifecycle, account key auth  
**Developing**: Correct tiering, RBAC, some lifecycle rules  
**Managed**: LRS for dev, GRS for prod, managed identity auth, lifecycle to cool/archive → **Target**  
**Optimized**: Geo-redundant reads, tiered access based on traffic, real-time cost optimization

## Required Inputs

- **Data type**: Documents, logs, video, database backups, transactional
- **Access pattern**: Frequent (hot), occasional (cool), rare (archive), cold
- **Size & growth**: 10GB initial, 10% monthly growth? Or 1TB spike?
- **Latency requirement**: <100ms or batch-oriented?
- **Durability**: RPO/RTO targets? Geographic redundancy needed?
- **Access model**: Public, private, user-scoped, application-only?
- **Compliance**: Data residency, encryption, retention, audit requirements?
- **Budget**: Cost-driven or performance-driven?

## Decision Tree

```
What type of data needs storage?
├─ Unstructured files (docs, images, video) → Blob Storage
├─ Shared file system (SMB/NFS for apps) → Azure Files
├─ Message queue → Queue Storage
├─ NoSQL key-value → Table Storage
├─ Big data analytics → Data Lake Storage
└─ Structured relational → SQL Database (not storage)

How frequently is this data accessed?
├─ Daily (hot, <1 day SLA) → Hot tier ($0.012/GB/month)
├─ Weekly-monthly (cool, <30 day SLA) → Cool tier ($0.001/GB/month)
├─ Rarely, compliance hold (archive, <90 day SLA) → Archive tier ($0.0004/GB/month)
└─ Cold (7+ year retention) → Cold tier ($0.00099/GB/month)

Do you need geographic failover?
├─ Single region (dev/test) → LRS (locally redundant, cheapest, 11x durability)
├─ Single region + replication → ZRS (zone redundant, same-region HA)
├─ Multi-region failover → GRS (geo-redundant, read from secondary)
└─ Multi-region read (active-active) → RA-GRS (read-access geo-redundant)

How should apps access storage?
├─ Internal/private → Private endpoints, firewall rules
├─ Managed identity → System/user-assigned identity with role
├─ Public but controlled → SAS tokens (time-bound, scoped)
└─ Public read-only → Blob public access (for content CDN)
```

## Workflow

### Phase 1: Choose Storage Type & Account

1. **Create storage account**:
   ```bash
   az storage account create \
     --resource-group $RG \
     --name "st${app}${env}" \
     --location eastus \
     --kind StorageV2 \
     --sku Standard_GRS \
     --access-tier Hot \
     --https-only \
     --default-action Deny
   ```

2. **Configure networking** (private by default):
   ```bash
   # Block all public access
   az storage account update \
     --resource-group $RG \
     --name "st${app}${env}" \
     --public-network-access-enabled false
   
   # Or allow only specific IPs/VNets
   az storage account network-rule add \
     --resource-group $RG \
     --account-name "st${app}${env}" \
     --vnet-name $VNET \
     --subnet-name $SUBNET
   ```

3. **Enable encryption** (at-rest, in-transit):
   ```bash
   # HTTPS only (enforced above)
   # At-rest: Default Microsoft-managed keys OR customer-managed key (CMK)
   
   # Use CMK from Key Vault for sensitive data
   az storage account update \
     --resource-group $RG \
     --name "st${app}${env}" \
     --encryption-key-name "storage-cmk" \
     --encryption-key-vault $KV_ID
   ```

### Phase 2: Create Containers/Shares & Set Tiering

1. **For Blob Storage**:
   ```bash
   # Create container
   az storage container create \
     --account-name "st${app}${env}" \
     --name "documents" \
     --public-access off
   
   # Or create via Python/C#
   # container_client = blob_client.create_container(name="documents")
   ```

From manu14357/zskills, MIT.

More from manu14357/zskills