Azure Cloud Migrate

MicrosoftOfficialCreated by Microsoft

Skill
Workflow
Cloud and DevOps
MIT
Low risk

From the author

Assess and migrate cross-cloud workloads to Azure with reports and code conversion. Supports Lambda→Functions, Beanstalk/Heroku/App Engine→App Service, Fargate/Kubernetes/Cloud Run/Spring Boot→Container Apps. WHEN: migrate Lambda to Functions, AWS to Azure, migrate Beanstalk, migrate Heroku, migrate App Engine, Cloud Run migration, Fargate to ACA, ECS/Kubernetes/GKE/EKS to Container Apps, Spring Boot to Container Apps, cross-cloud migration.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Azure Cloud Migrate provides a structured, multi-phase workflow for transitioning applications from various cloud platforms to Azure. It focuses on assessing the current architecture, mapping services to Azure equivalents, and performing the necessary code and configuration conversions. The skill ensures a methodical approach by requiring an assessment report before any migration actions occur, and it provides specific guidance for common migration paths such as AWS Lambda to Azure Functions, Heroku to App Service, and Kubernetes to Container Apps.

What it does

Generates comprehensive migration assessment reports for cross-cloud workloads.
Maps source platform services, compute configurations, and dependencies to Azure equivalents.
Provides guidance for converting application code and configuration files.
Audits source code for platform-specific service discovery patterns.
Creates architecture diagrams for both current and target states.
Tracks migration progress and provides resource-level status updates.

When to use it

When planning to migrate workloads from AWS Lambda, Elastic Beanstalk, or Fargate to Azure.
When moving applications from Heroku or Google App Engine to Azure App Service.
When transitioning Kubernetes or Cloud Run deployments to Azure Container Apps.
When you need a structured assessment of migration readiness and effort.

Advantages

Ensures a consistent, step-by-step migration process.
Reduces risk by requiring a detailed assessment report before code changes.
Provides clear mapping between source platform features and Azure services.
Includes specific checks for common migration pitfalls like hardcoded service discovery.

Usage examples

“Assess my current AWS Lambda project for migration to Azure Functions.”: The agent will analyze the Lambda project, map the services to Azure Functions, and generate a migration assessment report in the output directory.
“Migrate my Heroku application to Azure App Service.”: The agent will perform an assessment, guide the conversion of configuration files, and assist in setting up the application for Azure App Service.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/azure-cloud-migrate/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip azure-cloud-migrate.zip -d .agents/skills

Documentation by Microsoft

Azure Cloud Migrate

This skill handles assessment and code migration of existing cloud workloads to Azure.

Rules

Follow phases sequentially — do not skip
Generate assessment before any code migration
Load the scenario reference and follow its rules
Use mcp_azure_mcp_get_azure_bestpractices and mcp_azure_mcp_documentation MCP tools
Use the latest supported runtime for the target service
Destructive actions require ask_user — functions global-rules | app-service global-rules
Report progress to user — During long-running operations (deployments, image pushes), provide resource-level status updates so the user is never left waiting without feedback — see workflow-details.md
Audit service discovery in app code — Kubernetes DNS names (e.g., http://order-service:3001) do not resolve in Container Apps. During assessment, scan source code for hardcoded hostnames/ports in HTTP clients and flag them for env-var-driven URL injection

Migration Scenarios

Source	Target	Reference
AWS Lambda	Azure Functions	lambda-to-functions.md (assessment, code-migration)
AWS Elastic Beanstalk	Azure App Service	beanstalk-to-app-service.md
Heroku	Azure App Service	heroku-to-app-service.md
Google App Engine	Azure App Service	app-engine-to-app-service.md
AWS Fargate (ECS)	Azure Container Apps	fargate-to-container-apps.md (assessment, deployment)
Kubernetes (GKE/EKS/Self-hosted)	Azure Container Apps	k8s-to-container-apps.md
GCP Cloud Run	Azure Container Apps	cloudrun-to-container-apps.md
Spring Boot (Azure Spring Apps/VMs)	Azure Container Apps	spring-apps-to-aca.md

No matching scenario? Use mcp_azure_mcp_documentation and mcp_azure_mcp_get_azure_bestpractices tools.

Output Directory

All output goes to <workspace-root-basename>-azure/ at workspace root, where <workspace-root-basename> is the name of the top-level workspace directory itself (NOT a subdirectory within it). Never modify the source directory.

Steps

Create <workspace-root-basename>-azure/ at workspace root
Assess — Analyze source, map services, generate report using the scenario-specific assessment guide → functions assessment | app-service assessment
Migrate — Convert code/config using the scenario-specific migration guide → functions code-migration | app-service code-migration
Ask User — "Migration complete. Test locally or deploy to Azure?"
Hand off to azure-prepare for infrastructure, testing, and deployment

Track progress in migration-status.md — see workflow-details.md.

Files

ATTRIBUTION.mdAdded by AutoGineer989 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md4.3 KiB
references/services/app-service/app-engine-to-app-service.md7.1 KiB
references/services/app-service/assessment.md5.2 KiB
references/services/app-service/beanstalk-to-app-service.md6.4 KiB
references/services/app-service/code-migration.md5.0 KiB
references/services/app-service/global-rules.md2.8 KiB
references/services/app-service/heroku-to-app-service.md7.5 KiB
references/services/container-apps/assessment-guide.md7.0 KiB
references/services/container-apps/cloudrun-assessment-guide.md2.5 KiB
references/services/container-apps/cloudrun-deployment-guide.md7.9 KiB
references/services/container-apps/cloudrun-to-container-apps.md2.2 KiB
references/services/container-apps/deployment-guide.md9.6 KiB
references/services/container-apps/fargate-assessment-guide.md2.4 KiB
references/services/container-apps/fargate-deployment-guide.md10.1 KiB
references/services/container-apps/fargate-to-container-apps.md4.0 KiB
references/services/container-apps/k8s-to-container-apps.md4.9 KiB
references/services/container-apps/spring-apps-to-aca.md3.8 KiB
references/services/container-apps/spring-assessment-guide.md5.2 KiB
references/services/container-apps/spring-dependency-patterns.md1.2 KiB
references/services/container-apps/spring-deployment-guide.md15.1 KiB
references/services/functions/assessment.md6.3 KiB
references/services/functions/code-migration.md6.0 KiB
references/services/functions/global-rules.md3.3 KiB
references/services/functions/lambda-to-functions.md10.2 KiB
references/services/functions/runtimes/csharp.md5.5 KiB
references/services/functions/runtimes/java.md6.4 KiB
references/services/functions/runtimes/javascript.md8.5 KiB
references/services/functions/runtimes/powershell.md5.0 KiB
references/services/functions/runtimes/python.md6.4 KiB
references/services/functions/runtimes/typescript.md3.5 KiB
references/workflow-details.md2.3 KiB

references/services/container-apps/fargate-deployment-guide.md

Deployment: Fargate to Container Apps

Prerequisites

Azure CLI 2.53+ with containerapp extension, AWS CLI v2, Docker, ACR, Key Vault, Log Analytics

Phase 1: Container Registry Migration

set -euo pipefail
aws ecr get-login-password --region "$AWS_REGION" | \
  docker login --username AWS --password-stdin "${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com"
az acr login --name "$ACR_NAME"
docker pull "${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${IMAGE}"
docker tag "${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${IMAGE}" "${ACR_NAME}.azurecr.io/${IMAGE}"
docker push "${ACR_NAME}.azurecr.io/${IMAGE}"

$ErrorActionPreference = 'Stop'
$ecrPassword = aws ecr get-login-password --region $env:AWS_REGION
$ecrPassword | docker login --username AWS --password-stdin "$($env:AWS_ACCOUNT_ID).dkr.ecr.$($env:AWS_REGION).amazonaws.com"
az acr login --name $env:ACR_NAME
docker pull "$($env:AWS_ACCOUNT_ID).dkr.ecr.$($env:AWS_REGION).amazonaws.com/$($env:IMAGE)"
docker tag "$($env:AWS_ACCOUNT_ID).dkr.ecr.$($env:AWS_REGION).amazonaws.com/$($env:IMAGE)" "$($env:ACR_NAME).azurecr.io/$($env:IMAGE)"
docker push "$($env:ACR_NAME).azurecr.io/$($env:IMAGE)"

Phase 2: Infrastructure

Choose ONE path: basic (without VNet) OR VNet-integrated.

Basic (no VNet)

set -euo pipefail
az group create --name "$RG" --location "$LOCATION"
az monitor log-analytics workspace create -g "$RG" -n "${RG}-logs" -l "$LOCATION"
LOG_ID=$(az monitor log-analytics workspace show -g "$RG" -n "${RG}-logs" --query customerId -o tsv)
# Keyless (recommended): avoids handling the shared key entirely
az containerapp env create -n "${RG}-env" -g "$RG" -l "$LOCATION" \
  --logs-destination azure-monitor --logs-workspace-id "$LOG_ID"
# Fallback: use shared key if azure-monitor destination is not available
# LOG_KEY=$(az monitor log-analytics workspace get-shared-keys -g "$RG" -n "${RG}-logs" --query primarySharedKey -o tsv)
# az containerapp env create -n "${RG}-env" -g "$RG" -l "$LOCATION" \
#   --logs-workspace-id "$LOG_ID" --logs-workspace-key "$LOG_KEY"

$ErrorActionPreference = 'Stop'
az group create --name $env:RG --location $env:LOCATION
az monitor log-analytics workspace create -g $env:RG -n "$($env:RG)-logs" -l $env:LOCATION
$logId = az monitor log-analytics workspace show -g $env:RG -n "$($env:RG)-logs" --query customerId -o tsv
# Keyless (recommended): avoids handling the shared key entirely
az containerapp env create -n "$($env:RG)-env" -g $env:RG -l $env:LOCATION `
  --logs-destination azure-monitor --logs-workspace-id $logId
# Fallback: use shared key if azure-monitor destination is not available
# $logKey = az monitor log-analytics workspace get-shared-keys -g $env:RG -n "$($env:RG)-logs" --query primarySharedKey -o tsv
# az containerapp env create -n "$($env:RG)-env" -g $env:RG -l $env:LOCATION `
#   --logs-workspace-id $logId --logs-workspace-key $logKey

VNet-Integrated

set -euo pipefail
az group create --name "$RG" --location "$LOCATION"
az monitor log-analytics workspace create -g "$RG" -n "${RG}-logs" -l "$LOCATION"
LOG_ID=$(az monitor log-analytics workspace show -g "$RG" -n "${RG}-logs" --query customerId -o tsv)
az network vnet create -g "$RG" -n "${RG}-vnet" \
  --address-prefix 10.0.0.0/16 --subnet-name aca-subnet --subnet-prefix 10.0.0.0/23
SUBNET_ID=$(az network vnet subnet show -g "$RG" --vnet-name "${RG}-vnet" -n aca-subnet --query id -o tsv)
az containerapp env create -n "${RG}-env" -g "$RG" -l "$LOCATION" \
  --logs-destination azure-monitor --logs-workspace-id "$LOG_ID" \
  --infrastructure-subnet-resource-id "$SUBNET_ID"

$ErrorActionPreference = 'Stop'
az group create --name $env:RG --location $env:LOCATION
az monitor log-analytics workspace create -g $env:RG -n "$($env:RG)-logs" -l $env:LOCATION
$logId = az monitor log-analytics workspace show -g $env:RG -n "$($env:RG)-logs" --query customerId -o tsv
az network vnet create -g $env:RG -n "$($env:RG)-vnet" `
  --address-prefix 10.0.0.0/16 --subnet-name aca-subnet --subnet-prefix 10.0.0.0/23
$subnet = az network vnet subnet show -g $env:RG --vnet-name "$($env:RG)-vnet" -n aca-subnet | ConvertFrom-Json
az containerapp env create -n "$($env:RG)-env" -g $env:RG -l $env:LOCATION `
  --logs-destination azure-monitor --logs-workspace-id $logId `
  --infrastructure-subnet-resource-id $subnet.id

Phase 3: Secrets & Identity

set -euo pipefail
az keyvault create --name "$KEY_VAULT" -g "$RG" -l "$LOCATION" \
  --enable-rbac-authorization true
IDENTITY_ID=$(az identity create -n "${RG}-id" -g "$RG" -l "$LOCATION" --query id -o tsv)
PRINCIPAL_ID=$(az identity show --ids "$IDENTITY_ID" --query principalId -o tsv)

# Grant Key Vault access — use RBAC (recommended) or access policies
# Option A: RBAC (enabled on the vault created above)
KV_ID=$(az keyvault show --name "$KEY_VAULT" --query id -o tsv)
az role assignment create --assignee "$PRINCIPAL_ID" \
  --role "Key Vault Secrets User" --scope "$KV_ID"
# Option B: Access policies (if vault uses access policy mode)
# az keyvault set-policy --name "$KEY_VAULT" --object-id "$PRINCIPAL_ID" --secret-permissions get list

# Migrate secrets more safely: avoid passing the secret as a CLI argument.
# Use a locked-down temporary file, import with --file, and remove it immediately.
# Do not run this in shared, monitored, or recorded environments.
umask 077
secret_file="$(mktemp)"
trap 'rm -f "$secret_file"' EXIT
aws secretsmanager get-secret-value --secret-id <secret-id> --region <region> \
  --query SecretString --output text > "$secret_file"
az keyvault secret set --vault-name "$KEY_VAULT" --name <secret-name> \
  --file "$secret_file"
rm -f "$secret_file"
trap - EXIT

# ACR pull access
ACR_ID=$(az acr show --name "$ACR_NAME" --query id -o tsv)
az role assignment create --assignee "$PRINCIPAL_ID" --role AcrPull --scope "$ACR_ID"

$ErrorActionPreference = 'Stop'
az keyvault create --name $env:KEY_VAULT -g $env:RG -l $env:LOCATION --enable-rbac-authorization true
$identityId = az identity create -n "$($env:RG)-id" -g $env:RG -l $env:LOCATION --query id -o tsv
$principalId = az identity show --ids $identityId --query principalId -o tsv

# Grant Key Vault access — use RBAC (recommended) or access policies
# Option A: RBAC (enabled on the vault created above)
$kvId = az keyvault show --name $env:KEY_VAULT --query id -o tsv
az role assignment create --assignee $principalId `
  --role "Key Vault Secrets User" --scope $kvId
# Option B: Access policies (if vault uses access policy mode)
# az keyvault set-policy --name $env:KEY_VAULT --object-id $principalId --secret-permissions get list

# Migrate secrets more safely: use a temp file instead of passing as CLI argument.
# Do not run this in shared, monitored, or recorded environments.
$secretFile = [System.IO.Path]::GetTempFileName()
try {
    aws secretsmanager get-secret-value --secret-id <secret-id> --region <region> `
      --query SecretString --output text | Set-Content -Path $secretFile -NoNewline
    az keyvault secret set --vault-name $env:KEY_VAULT --name <secret-name> `
      --file $secretFile
} finally {
    Remove-Item -Path $secretFile -Force -ErrorAction SilentlyContinue
}

# ACR pull access
$acrId = az acr show --name $env:ACR_NAME --query id -o tsv
az role assignment create --assignee $principalId --role AcrPull --scope $acrId

Phase 4: Deploy

set -euo pipefail
SECRET_URI=$(az keyvault secret show --vault-name "$KEY_VAULT" --name db-password --query id -o tsv)
az containerapp create --name <app-name> -g "$RG" --environment "${RG}-env" \
  --image "${ACR_NAME}.azurecr.io/<image>:<tag>" --target-port 8080 --ingress external \
  --cpu 0.5 --memory 1Gi --min-replicas 1 --max-replicas 10 \
  --user-assigned "$IDENTITY_ID" --registry-identity "$IDENTITY_ID" \
  --registry-server "${ACR_NAME}.azurecr.io" \
  --secrets db-pass=keyvaultref:"${SECRET_URI}",identityref:"${IDENTITY_ID}" \
  --env-vars ENV=production DB_PASSWORD=secretref:db-pass

$ErrorActionPreference = 'Stop'
$secretUri = az keyvault secret show --vault-name $env:KEY_VAULT --name db-password --query id -o tsv
az containerapp create --name <app-name> -g $env:RG --environment "$($env:RG)-env" `
  --image "$($env:ACR_NAME).azurecr.io/<image>:<tag>" --target-port 8080 --ingress external `
  --cpu 0.5 --memory 1Gi --min-replicas 1 --max-replicas 10 `
  --user-assigned $identityId --registry-identity $identityId `
  --registry-server "$($env:ACR_NAME).azurecr.io" `
  --secrets "db-pass=keyvaultref:$($secretUri),identityref:$($identityId)" `
  --env-vars ENV=production DB_PASSWORD=secretref:db-pass

Configuration Mapping

ECS Task Definition	Container Apps CLI
`cpu: "512"` (0.5 vCPU)	`--cpu 0.5`
`memory: "1024"` (1 GB)	`--memory 1Gi`
`containerPort: 8080`	`--target-port 8080`
`desiredCount: 2`	`--min-replicas 2`
`secrets` (Secrets Manager ARN)	`--secrets name=keyvaultref:URI,identityref:ID`
`environment` (env vars)	`--env-vars KEY=value`

Phase 5: Validate

set -euo pipefail
FQDN=$(az containerapp show --name <app-name> -g "$RG" --query properties.configuration.ingress.fqdn -o tsv)
curl -f -I "https://$FQDN/health" || { echo "Health check failed"; exit 1; }
az containerapp logs show --name <app-name> -g "$RG" --tail 100

$ErrorActionPreference = 'Stop'
$fqdn = az containerapp show --name <app-name> -g $env:RG --query properties.configuration.ingress.fqdn -o tsv
Invoke-WebRequest -Uri "https://$fqdn/health" -Method Head
az containerapp logs show --name <app-name> -g $env:RG --tail 100

Troubleshooting

Issue	Solution
Image pull fails	Verify ACR role: `az role assignment list --assignee $(az identity show --ids <identity-resource-id> --query principalId -o tsv) --scope $(az acr show -n <acr-name> --query id -o tsv)`
App won't start	Check logs: `az containerapp logs show --name <app-name> -g <resource-group> --tail 100`
Secret not accessible	Verify RBAC: `az role assignment list --assignee $(az identity show --ids <identity-resource-id> --query principalId -o tsv) --scope $(az keyvault show -n <vault-name> --query id -o tsv)`

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

What our scanner noticed· Low risk

Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/azure-skills/skills/azure-cloud-migrate · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from .github/plugins/azure-skills/LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

Also distributed in

microsoft/azure-skills

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-cloud-migrate.zip

From the author

AutoGineer summary

What it does

When to use it

Advantages

Usage examples

Install

Documentation by Microsoft

Azure Cloud Migrate

Rules

Migration Scenarios

Output Directory

Steps

Files

references/services/container-apps/fargate-deployment-guide.md

Deployment: Fargate to Container Apps

Prerequisites

Phase 1: Container Registry Migration

Phase 2: Infrastructure

Basic (no VNet)

VNet-Integrated

Phase 3: Secrets & Identity

Phase 4: Deploy

Configuration Mapping

Phase 5: Validate

Troubleshooting

Requirements and compatibility

Security

Attribution and licence

Related skills

Modal

Cloud Infrastructure Network Engineer

Deployment Validation Cloud Architect

Airflow Dag Patterns

Cost Optimization

Hybrid Cloud Networking

Download ZIP