Skills azure-cloud-migrate

📦

azure-cloud-migrate

Name: azure-cloud-migrate
Author: microsoft

v0.0.0-placeholder Content revision r1 High Risk 🔑 Env variables🌐 Network access📁 Filesystem access⚙️ External commands⚡ Contains scripts

Migrate Cloud Workloads to Azure

Cloud migrations require careful service mapping, code changes, and deployment planning. This skill guides assessment and migration work for Azure Functions, App Service, and Container Apps.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "azure-cloud-migrate" from https://skillstore.io/skills/microsoft-azure-cloud-migrate.md and its manifest at https://skillstore.io/api/skills/microsoft-azure-cloud-migrate/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/microsoft-azure-cloud-migrate.md Signed manifest GET /api/skills/microsoft-azure-cloud-migrate/manifest Signed lockfile GET /api/skills/microsoft-azure-cloud-migrate/lockfile

Test it

Using "azure-cloud-migrate". A repository contains three AWS Lambda functions with S3, SQS, and API Gateway triggers.

Expected outcome:

A migration assessment report lists each function, runtime, trigger, dependency, and Azure Functions equivalent.
The report recommends managed identity, binding-first code changes, and infrastructure handoff tasks.

Using "azure-cloud-migrate". A Heroku app uses Postgres, Redis, config vars, a Procfile, and a worker process.

Expected outcome:

The migration plan maps the web process to Azure App Service and the worker to WebJobs or Container Apps.
Secrets are assigned to Key Vault references, and database access is moved toward managed identity where supported.

Using "azure-cloud-migrate". A Kubernetes namespace contains deployments, services, ingress, secrets, and persistent volumes.

Expected outcome:

The assessment separates supported Container Apps resources from blockers such as StatefulSets or unsupported storage.
The plan describes image migration, service discovery updates, Key Vault use, and validation tests.

Security Audit

High Risk

v6 • 7/23/2026 Open versioned report

Most of the 400 presented findings are documentation false positives involving links, code fences, managed identity examples, and visible migration commands. Confirmed risks involve shared cloud keys, decoded secret transfer through CLI arguments, and local secret materialization. The 30 omitted static matches require manual review before publication. Static review was capped at 400/430 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Files scanned

4,622

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (9)

High

references/services/container-apps/deployment-guide.md:82

System reconnaissance

> **Tip**: Prefer piping decoded secret values directly to `az keyvault secret set --value` to avoid

The line recommends or uses command-line secret transfer through az keyvault secret set --value. That can expose decoded secret material through process arguments, logs, or shell history.

High

references/services/container-apps/deployment-guide.md:21-22

Kubernetes Secrets Exported Into Workspace

The guide exports deployments, services, ingress, ConfigMaps, and Secret objects to all-resources.yaml. Base64-encoded Kubernetes secrets can remain recoverable in the workspace.

The command explicitly includes Secret objects in a YAML export file. This directly materializes sensitive values during migration.

High

references/services/container-apps/deployment-guide.md:89-91 references/services/container-apps/deployment-guide.md:108-112 references/services/container-apps/cloudrun-deployment-guide.md:114-116 references/services/container-apps/cloudrun-deployment-guide.md:135-137

Decoded Secrets Passed Through CLI Arguments

Several examples pass decoded secrets to az keyvault secret set with --value. Process listings, command logging, terminal history, or shell history may expose them.

The cited examples retrieve decoded secret values and pass them as CLI arguments. The exposure risk is direct despite legitimate migration intent.

Medium

references/services/container-apps/cloudrun-deployment-guide.md:57

System reconnaissance

--logs-workspace-id "$LOG_ID" --logs-workspace-key "$LOG_KEY"

The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.

Medium

references/services/container-apps/cloudrun-deployment-guide.md:68

System reconnaissance

--logs-workspace-id $workspace.customerId --logs-workspace-key $keys.primarySharedKey

The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.

Medium

references/services/container-apps/cloudrun-deployment-guide.md:81

System reconnaissance

--logs-workspace-id "$LOG_ID" --logs-workspace-key "$LOG_KEY" \

The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.

Medium

references/services/container-apps/cloudrun-deployment-guide.md:92

System reconnaissance

--logs-workspace-id $workspace.customerId --logs-workspace-key $keys.primarySharedKey `

The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.

Medium

references/services/container-apps/fargate-deployment-guide.md:114

System reconnaissance

aws secretsmanager get-secret-value --secret-id <secret-id> --region <region> \

The command extracts live AWS Secrets Manager values during migration. The guide uses cleanup controls, but the secret is still materialized in the local execution environment.

Show all 9 confirmed findings

Medium

references/services/container-apps/fargate-deployment-guide.md:144

System reconnaissance

aws secretsmanager get-secret-value --secret-id <secret-id> --region <region> `

The command extracts live AWS Secrets Manager values during migration. The guide uses cleanup controls, but the secret is still materialized in the local execution environment.

Capability review items (14)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/services/container-apps/spring-deployment-guide.md:103

Database connection strings

read -s -p "Enter database password: " DB_PASSWORD

The example asks for a database password and writes it into a temporary file for Key Vault import. Cleanup is present, but the flow still materializes secret data locally.

High

references/services/container-apps/spring-deployment-guide.md:104

Database connection strings

echo -n "$DB_PASSWORD" > "$SECRET_FILE"

The example asks for a database password and writes it into a temporary file for Key Vault import. Cleanup is present, but the flow still materializes secret data locally.

High

references/services/container-apps/cloudrun-deployment-guide.md:116

Shell command substitution

--value "$(gcloud secrets versions access latest --secret=<secret-id> --project="$GCP_PROJECT")"

The line recommends or uses command-line secret transfer through az keyvault secret set --value. That can expose decoded secret material through process arguments, logs, or shell history.

High

references/services/container-apps/deployment-guide.md:91

Shell command substitution

az keyvault secret set --vault-name myapp-kv --name password --value "$(kubectl get secret mysecret

The line recommends or uses command-line secret transfer through az keyvault secret set --value. That can expose decoded secret material through process arguments, logs, or shell history.

Medium

references/services/container-apps/fargate-deployment-guide.md:144-146

Ruby/shell backtick execution

aws secretsmanager get-secret-value --secret-id <secret-id> --region <region> `

The command extracts live AWS Secrets Manager values during migration. The guide uses cleanup controls, but the secret is still materialized in the local execution environment.

Medium

references/services/container-apps/spring-deployment-guide.md:83-85

Ruby/shell backtick execution

--azure-file-account-name "$STORAGE_ACCOUNT" --azure-file-account-key "$STORAGE_KEY" `

The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.

Medium

references/services/container-apps/cloudrun-deployment-guide.md:55

Shell command substitution

LOG_KEY=$(az monitor log-analytics workspace get-shared-keys -g "$RG" -n "${RG}-logs" --query primar

The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.

Medium

references/services/container-apps/deployment-guide.md:64

Shell command substitution

LOG_KEY=$(az monitor log-analytics workspace get-shared-keys --resource-group myapp-rg --workspace-n

The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.

Medium

references/services/container-apps/fargate-deployment-guide.md:112

Shell command substitution

secret_file="$(mktemp)"

The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.

Medium

references/services/container-apps/spring-deployment-guide.md:12

Shell command substitution

LOG_KEY=$(az monitor log-analytics workspace get-shared-keys --resource-group spring-rg --workspace-

The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.

Medium

references/services/container-apps/spring-deployment-guide.md:69

Shell command substitution

STORAGE_KEY=$(az storage account keys list --account-name "$STORAGE_ACCOUNT" --resource-group spring

The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.

Medium

references/services/container-apps/spring-deployment-guide.md:101

Shell command substitution

SECRET_FILE=$(mktemp)

The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.

Medium

references/services/container-apps/fargate-deployment-guide.md:112

Temp file creation

secret_file="$(mktemp)"

The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.

Medium

references/services/container-apps/spring-deployment-guide.md:101

Temp file creation

SECRET_FILE=$(mktemp)

The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.

Risk Factors

🔑 Env variables (50)

🌐 Network access (23)

📁 Filesystem access (7)

references/services/app-service/code-migration.md:91 references/services/container-apps/fargate-deployment-guide.md:112 references/services/container-apps/spring-deployment-guide.md:102 references/services/container-apps/spring-deployment-guide.md:101 references/services/functions/runtimes/javascript.md:8 references/services/functions/runtimes/javascript.md:93 references/services/functions/runtimes/python.md:9

⚙️ External commands (50)

⚡ Contains scripts (12)

Detected Patterns

System reconnaissance×7

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/microsoft-azure-cloud-migrate/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/microsoft-azure-cloud-migrate/security.svg)](https://skillstore.io/skills/microsoft-azure-cloud-migrate?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/microsoft-azure-cloud-migrate?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/microsoft-azure-cloud-migrate/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/microsoft-azure-cloud-migrate.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

microsoft. (2026). azure-cloud-migrate security audit report (audit version 6) [Author version 0.0.0-placeholder]. Skillstore. https://skillstore.io/skills/microsoft-azure-cloud-migrate/audits/6

BibTeX citation

@techreport{microsoft-microsoft-azure-cloud-migrate-2026,
  author = {microsoft},
  title = {azure-cloud-migrate security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/microsoft-azure-cloud-migrate/audits/6},
  note = {Author version 0.0.0-placeholder}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "azure-cloud-migrate security audit report (audit version 6)"
version: "0.0.0-placeholder"
type: report
authors:
  - name: "microsoft"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/microsoft-azure-cloud-migrate/audits/6"
identifiers:
  - type: other
    value: "skillstore:microsoft-azure-cloud-migrate:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Assess Lambda migration readiness

Inventory Lambda functions, triggers, dependencies, and IAM mappings before moving to Azure Functions.

Plan web app migration

Map Heroku, Elastic Beanstalk, or App Engine applications to Azure App Service with configuration and identity guidance.

Move container workloads

Evaluate Kubernetes, Fargate, Cloud Run, or Spring workloads for Azure Container Apps compatibility and deployment planning.

Try These Prompts

Assess my source workload

Assess this project for Azure migration. Identify the source platform, required Azure target services, blockers, and the next files you need from me.

Create a migration report

Generate the required migration assessment report for this workload. Include service mapping, dependencies, security mapping, effort, risks, and recommended next steps.

Convert service configuration

Convert this source platform configuration to the closest Azure target configuration. Keep the original app unchanged and write all output to the Azure migration folder.

Design a phased Azure migration

Build a phased migration plan from assessment through deployment. Include identity, secrets, networking, observability, rollback, and validation steps for each phase.

Best Practices

Run the assessment phase and review the report before requesting code migration.
Review every generated cloud command before execution in a live subscription or project.
Use managed identity and Key Vault references instead of copying secrets into files or command arguments.

Avoid

Skipping the assessment report and moving directly to deployment commands.
Running generated migration commands against production without review and backups.
Storing decoded secrets, connection strings, or cloud keys in the workspace.