From vanguard-frontier-agentic
Reviews Azure Key Vault certificate issuer configurations for cert-manager on AKS, auditing policies, role assignments, exportability, network connectivity, CA credentials, and rotation alignment.
How this skill is triggered — by the user, by Claude, or both
Slash command
/vanguard-frontier-agentic:azure-keyvault-certificate-issuer-reviewThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Review Azure Key Vault configurations used as certificate issuers for cert-manager on AKS. Identify Managed Identity role assignment gaps (data plane vs management plane confusion), certificate policy misalignment, exportability risks, network connectivity issues, integrated CA credential over-scoping, and rotation race conditions between cert-manager and Key Vault auto-rotation. Output severit...
Review Azure Key Vault configurations used as certificate issuers for cert-manager on AKS. Identify Managed Identity role assignment gaps (data plane vs management plane confusion), certificate policy misalignment, exportability risks, network connectivity issues, integrated CA credential over-scoping, and rotation race conditions between cert-manager and Key Vault auto-rotation. Output severity-labeled findings with evidence and remediation steps.
Key Vault Certificate Officer (data plane). Flag Key Vault Contributor as HIGH — it grants management plane access including vault deletion. Flag Key Vault Administrator as HIGH (full data plane + management).enableRbacAuthorization: true). If legacy access policies are used instead of RBAC, flag as MEDIUM (harder to audit, no Azure AD Conditional Access integration).exportable in the Key Vault certificate policy. Flag exportable: true on certs used for cluster-internal mTLS as MEDIUM (private key unnecessarily extractable from Key Vault).publicNetworkAccess: Disabled, verify the AKS cluster has private endpoint access to the Key Vault and DNS resolution via private DNS zone. Flag missing private endpoint as MEDIUM.renewBefore against the Key Vault certificate's auto-rotation policy to detect overlapping rotation windows. Flag simultaneous rotation triggers as MEDIUM.Load these only when needed:
npx claudepluginhub raishin/vanguard-frontier-agentic --plugin vanguard-frontier-agenticAudits Azure Key Vault secret lifecycle posture across RBAC, soft delete, purge protection, rotation, expiration, metadata hygiene, Event Grid notifications, and recovery readiness.
Runs azqr for Azure compliance audits, resource best practices, and security posture reviews plus Key Vault checks for expiring certificates, secrets, and keys.
Expert guidance for Azure Key Vault development covering troubleshooting, best practices, security, limits, and integrations with Private Link, Event Grid, Databricks, DigiCert, RBAC, and ARM/Bicep/Terraform.