tune-ai-landing-zone-advanced — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tune-ai-landing-zone-advanced (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
| Resource | Dev/Test SKU | Production SKU | When to Upgrade |
|---|---|---|---|
| Azure Firewall | Standard | Premium | Need IDPS, TLS inspection |
| NAT Gateway | Standard (1 IP) | Standard (4+ IPs) | >100 concurrent SNAT connections |
| VPN Gateway | VpnGw1 | VpnGw2AZ | >650 Mbps throughput needed |
| Bastion | Basic | Standard | Need file transfer, IP-based connect |
| Log Analytics | Pay-as-you-go | Commitment tier | >100 GB/day ingestion |
Diagnostic: Check Azure Advisor for right-sizing recommendations
az advisor recommendation list --category cost --query "[?shortDescription.solution=='Right-size']" -o table| Factor | Weight | Optimization |
|---|---|---|
| AI service availability | High | Check GPU/model availability per region |
| User proximity | High | Deploy in regions closest to users |
| Pricing delta | Medium | Same service can cost 10-30% less in some regions |
| Compliance (data residency) | Critical | GDPR → EU regions, HIPAA → US regions |
| Paired region | Medium | Use paired regions for DR |
Multi-region pattern: Primary + DR in paired region, Firewall in each hub.
| Phase | Recommended Effect | Rationale |
|---|---|---|
| Initial rollout | Audit | Discover non-compliance without blocking |
| After 30 days | Deny (new resources) | Prevent new violations |
| After 60 days | DeployIfNotExists | Auto-remediate existing resources |
| Ongoing | Deny + DINE | Full enforcement + auto-remediation |
Per-policy tuning:
Require private endpoints → Start Audit (find existing public), then DenyRequire managed identity → Deny immediately (no reason for keys)Require diagnostic settings → DINE (auto-deploy, no user action needed)Allowed locations → Deny immediately (compliance critical)| Strategy | Savings | Complexity |
|---|---|---|
| Reserved instances (1y) | 30-40% on VMs, Firewall | Low |
| Reserved instances (3y) | 50-60% on VMs, Firewall | Low |
| Dev/test pricing | 40% on Windows VMs | Low (needs VS subscription) |
| Spot VMs for non-critical | 60-90% on compute | Medium |
| Commitment tier (Log Analytics) | 15-30% on ingestion | Low |
| Auto-shutdown (dev/test) | 50% on non-prod compute | Low |
Monthly cost estimate (hub infrastructure):
| Component | Dev | Prod |
|---|---|---|
| Azure Firewall | $912/mo (Standard) | $912/mo (Premium: $1,824) |
| NAT Gateway | $32/mo | $32/mo |
| VPN Gateway | $138/mo (VpnGw1) | $380/mo (VpnGw2AZ) |
| Bastion | $139/mo (Basic) | $278/mo (Standard) |
| Log Analytics | ~$50/mo (10GB/day) | ~$500/mo (100GB/day) |
| Total hub | ~$1,271/mo | ~$3,014/mo |
With 1-year reservations: Dev ~$890 → Prod ~$2,110 (30% savings).
| Rule Type | Use Case | Performance Impact |
|---|---|---|
| Network rules | IP-based, fastest | Lowest latency |
| Application rules | FQDN-based, TLS inspection | Medium latency |
| NAT rules | Inbound DNAT | Lowest latency |
Optimization steps:
After tuning, compare before/after:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.