Answer: assessment of miniblue's missing features

[Copilot]

Question asked for an evaluation of which capabilities miniblue currently lacks, in the context of the terraform-production-ready-azure lab.

No code changes — analysis-only response.

Summary of the assessment

Grouped by impact on the production-ready Azure lab:

• Blocking gaps (data plane absent for security/data services)

  • No IMDS endpoint (169.254.169.254/...) → Managed Identity tokens unobtainable
  • Key Vault secrets data plane (*.vault.azure.net) likely absent → MI → KV chain undemonstrable
  • Cosmos DB Table API and App Configuration data planes absent
  • azurerm_role_assignment writes succeed but no real RBAC engine, so authz is a no-op

• Functional gaps (control plane works, runtime doesn't)

  • VMs do not actually boot (no hypervisor); cloud-init / SSH not exercisable
  • Load Balancer / NSG / lifecycle policy resources persist but no traffic plane, no filtering, no scheduler
  • v3→v4 azurerm fields are a known risk surface (we already patched ARM case-routing, blob ?comp=metadata, SharedKey bypass)

• Tooling gaps

  • azlocal covers only group, dns zone, network vnet[/subnet] — missing storage, keyvault, vm, identity, role, cosmosdb, lb
  • No Activity Log, Resource Graph, Management Lock enforcement, Diagnostic Settings / Log Analytics, Private Endpoint + Private DNS resolution, multi-subscription/tenant model
  • Single self-signed cert shared across all services

• Acceptable non-features: billing/quota, region realism, propagation delay, ARM/Bicep — irrelevant for this course.

Suggested upstream priorities

P	Gap	Why
P0	IMDS endpoint	Unblocks all MI teaching
P0	Key Vault secrets data plane	Unblocks security-layer narrative
P1	Expand azlocal subcommands	Direct UX win for every step
P1	App Configuration data plane	Standard MI-driven config pattern
P2	Cosmos DB Table API data plane	Enables real CRUD demos
P2	Private Endpoint + Private DNS link	Modern Azure networking baseline
P3	Diagnostic Settings + LAW, real Management Lock	Future observability/governance modules

Implication for the lab

Reinforces the prior B-option recommendation: miniblue's profile is "control plane ≈ complete, data plane ≈ near-zero", which is exactly the right shape for teaching IaC topology, modularization, moved, and state isolation — but forces runtime concerns (MI token retrieval, KV secret reads, real LB traffic, real RBAC enforcement) into narrative + external-link territory rather than hands-on steps.