[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-labs-tf-best-practices":3,"mdc--wkz5fv-key":40,"related-repo-aws-labs-tf-best-practices":2142,"related-org-aws-labs-tf-best-practices":2251},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":29,"repoUrl":30,"updatedAt":31,"license":32,"forks":33,"topics":34,"repo":35,"sourceUrl":38,"mdContent":39},"tf-best-practices","author and validate AWS Terraform configurations","Best-practice authoring guidance AND a read-only policy gate for AWS Terraform generated by a migration skill. Load during any phase that writes a terraform\u002F directory — first as the \"what to emit\" posture rules + security-baseline spec, then after writing as the deterministic policy verdict. Read-only: it reports whether the generated Terraform passes; it never edits .tf files, never touches .phase-status.json, and never decides phase completion. Complements (does not replace) terraform fmt\u002Finit\u002Fvalidate.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"aws-labs","AWS Labs","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws-labs.png","awslabs",[13,17,20,23,26],{"name":14,"slug":15,"type":16},"Best Practices","best-practices","tag",{"name":18,"slug":19,"type":16},"Deployment","deployment",{"name":21,"slug":22,"type":16},"Terraform","terraform",{"name":24,"slug":25,"type":16},"Infrastructure as Code","infrastructure-as-code",{"name":27,"slug":28,"type":16},"AWS","aws",14,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fstartups","2026-08-23T04:00:20.964655",null,15,[],{"repoUrl":30,"stars":29,"forks":33,"topics":36,"description":37},[],"Official AWS Startups repository that hosts plugins, skills, tools and resources to support startup builders on AWS","https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fstartups\u002Ftree\u002FHEAD\u002Fadvisor\u002Fplugins\u002Faws-startup-advisor\u002Fskills\u002Ftf-best-practices","---\nname: tf-best-practices\ndescription: >-\n  Best-practice authoring guidance AND a read-only policy gate for AWS Terraform generated by a\n  migration skill. Load during any phase that writes a terraform\u002F directory — first as the \"what to\n  emit\" posture rules + security-baseline spec, then after writing as the deterministic policy verdict.\n  Read-only: it reports whether the generated Terraform passes; it never edits .tf files, never touches\n  .phase-status.json, and never decides phase completion. Complements (does not replace) terraform\n  fmt\u002Finit\u002Fvalidate.\n---\n\n# tf-best-practices — Generated-IaC posture rules + read-only policy gate\n\nA **shared authoring guide and verdict producer**, not a workflow. It answers two\nquestions for a phase that generates AWS Terraform:\n\n1. **Before writing** — \"what security posture must the generated `terraform\u002F` follow?\"\n   (the posture rules + the `baseline.tf` account-hardening spec)\n2. **After writing** — \"does the generated `terraform\u002F` pass policy?\" (a deterministic,\n   **read-only** verdict + a machine-readable report)\n\n## Routing — load the part that matches your context\n\nThis skill is entered at two touchpoints in the caller's Generate flow, with the caller's\nown terraform-authoring work in between. **The caller states which touchpoint it is at when it\nloads this skill**, and reads the corresponding part:\n\n| Caller context                                              | Load                                                                                                      | Why                                                                                               |\n| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |\n| **About to author `terraform\u002F`** (before writing)           | Part 1 → [`references\u002Fsecurity-posture-rules.md`](references\u002Fsecurity-posture-rules.md)                   | The \"what to emit\" AWS authoring rules (gate-enforced + authoring-only + compliance-conditional). |\n| **`terraform\u002F` written, ready to validate** (after writing) | Part 2 → [`references\u002Fterraform-validation.md`](references\u002Fterraform-validation.md) + run the gate script | The `fmt → init → validate → policy` protocol and the read-only verdict.                          |\n\nEverything this skill states is **source-cloud-agnostic** (pure AWS Terraform). Any GCP\u002FHeroku\ndetection or artifact reading is the caller's job; where a rule needs a caller-known fact (e.g.\ndeclared compliance frameworks), the caller passes it as a **caller-context signal** — see\n`references\u002Fsecurity-posture-rules.md` § _Caller-context signals_.\n\n## Boundary (read this first)\n\nThis unit is a **verdict producer, never a mutator**. Its entire write surface is the\nJSON verdict it is asked to emit. Specifically it **MUST NOT**:\n\n- edit, format, or rewrite any `.tf` file (the caller owns remediation),\n- read or write `.phase-status.json` or any run-state file (interpreter-owned),\n- decide whether a phase may complete, or prompt the user (caller policy).\n\nThe caller (a migration skill's Generate phase) owns: the fix-and-retry loop that edits\nthe `.tf` it generated, `terraform fmt` auto-apply, the retry\u002Fskip\u002Fabort prompt, the\nPhase Completion gate, and every `.phase-status.json` write. See the consuming skill's\ngenerate phase for how the verdict feeds those decisions.\n\n> **Consumers (v1):** `gcp-to-aws` only. The contract is source-agnostic and designed to\n> be adopted by `heroku-to-aws` later, but that wiring is intentionally out of scope for now.\n\n## Part 1 — Authoring posture (load before writing `terraform\u002F`)\n\nEmit generated Terraform that satisfies the posture in\n[`references\u002Fsecurity-posture-rules.md`](references\u002Fsecurity-posture-rules.md).\n\nThese are the \"what good AWS Terraform looks like\" rules. Following them makes the Part 2 gate\npass by construction. This unit does not read the caller's artifacts — it consumes only\ncaller-context signals the caller passes in.\n\n> **Scope.** `security-posture-rules.md` covers, in three tiers:\n>\n> - **Gate-enforced** (Part 2 verifies statically): ALB TLS, no-public-database, RDS +\n>   ElastiCache encryption-at-rest, no-public-DB-port ingress, no-public admin\u002Fdatastore-port\n>   ingress, no-wildcard-IAM.\n> - **Authoring-only** (not gate-checkable, still required): `deletion_protection`,\n>   master-password-via-Secrets-Manager, S3 hardening, Fargate\u002FEKS\u002FECR settings, private-subnet\n>   placement, backups, baseline monitoring.\n> - **Compliance-conditional** (emitted when the caller declares `soc2`\u002F`pci`\u002F`hipaa`\u002F`fedramp`):\n>   VPC flow logs, S3 access logging, secret rotation, customer-managed KMS.\n>\n> Still the **caller's** own generation concern (candidates to migrate here later): the\n> account-hardening `baseline.tf` layer (CloudTrail, GuardDuty, Config, Security Hub).\n\n## Part 2 — Policy gate (run after writing `terraform\u002F`)\n\nRun the read-only checker against the generated directory. Resolve the script path relative to\nthe plugin root (`$PLUGIN_ROOT\u002Fskills\u002Ftf-best-practices\u002Fscripts\u002F...`), the same convention the\nplugin uses for its other scripts:\n\n```bash\npython3 \"$PLUGIN_ROOT\u002Fskills\u002Ftf-best-practices\u002Fscripts\u002Fvalidate-terraform-policy.py\" \"$TERRAFORM_DIR\" --json \"$VERDICT_PATH\"\n```\n\n- `$TERRAFORM_DIR` — **required, caller-supplied**: the generated `terraform\u002F` directory\n  (e.g. `$MIGRATION_DIR\u002Fterraform`). This skill never defaults or discovers it — the caller\n  always passes the path it wrote Terraform to.\n- `--json $VERDICT_PATH` — optional; writes a machine-readable verdict the caller can merge\n  into its own `validation-report.json`.\n\nThe policy check is one stage of a larger validation flow (`fmt → init → validate → policy`).\nThe full protocol — including offline-fallback behavior and how the policy verdict maps into a\n`validation-report.json` — is documented in\n[`references\u002Fterraform-validation.md`](references\u002Fterraform-validation.md). That protocol is\ndescriptive: the **caller** owns the fmt\u002Finit\u002Fvalidate execution, the fix-and-retry loop, and\nthe report write; this unit contributes only the read-only policy stage + verdict shape.\n\n### Exit codes → caller action\n\n| Exit | stdout        | Meaning            | Caller does                                                                     |\n| ---- | ------------- | ------------------ | ------------------------------------------------------------------------------- |\n| `0`  | `POLICY_OK`   | posture satisfied  | proceed                                                                         |\n| `1`  | `POLICY_FAIL` | violations present | read `violations[]`, edit the named `.tf` sites, re-run (caller's retry budget) |\n| `2`  | (usage error) | bad path \u002F IO      | surface to user; do not treat as pass                                           |\n\n### Verdict shape (`--json`)\n\n```json\n{\n  \"check\": \"policy\",\n  \"policy_status\": \"POLICY_OK | POLICY_FAIL\",\n  \"violations\": [\n    {\n      \"check\": \"policy\",\n      \"rule\": \"alb_https_listener | alb_http_redirect | no_tf_files\",\n      \"file\": \"compute.tf\",\n      \"line\": 7,\n      \"severity\": \"error\",\n      \"summary\": \"human-readable violation\",\n      \"fix_hint\": \"concrete remediation the caller can apply\"\n    }\n  ]\n}\n```\n\nEach `violations[]` entry is **actionable evidence** — `file` + `line` + `fix_hint` tell the\ncaller exactly what to edit. The caller applies the edit; this unit only reports.\n\n## Policy rules enforced today\n\nEvery rule is **fail-open on ambiguity** — it fires only on unambiguous, in-block literal\nevidence, so a valid stack is never falsely blocked (a `POLICY_FAIL` is a hard completion gate\nfor the caller, so a false positive would block a real migration).\n\n**Internet-facing ALB TLS posture** (an ALB is internet-facing when `internal` is absent,\n`false`, or variable-driven — fail-safe):\n\n- **`alb_https_listener`** — must have an HTTPS listener on `443` with `certificate_arn` and a\n  `forward` action.\n- **`alb_http_redirect`** — an HTTP `:80` listener must `redirect` to HTTPS, never `forward`\n  to targets. Internal ALBs (`internal = true`) are exempt.\n\n**Managed database exposure & encryption** (`aws_db_instance`, `aws_rds_cluster`):\n\n- **`rds_not_public`** — must not set `publicly_accessible = true` (absent\u002Fvariable → fail-open).\n- **`rds_encryption_at_rest`** — must set `storage_encrypted = true`; missing or literal `false`\n  fires (RDS defaults to unencrypted), variable-driven fails open. S3 is not checked (default\n  SSE-S3 since Jan 2023).\n\n**ElastiCache encryption** (`aws_elasticache_replication_group`):\n\n- **`elasticache_encryption_at_rest`** — must set `at_rest_encryption_enabled = true`; missing\n  or literal `false` fires, variable-driven fails open. `aws_elasticache_cluster` (Memcached)\n  not checked.\n\n**Security group ingress:**\n\n- **`db_sg_no_public_ingress`** — an inline `aws_security_group` ingress covering `5432`\u002F`3306`\n  must not allow `0.0.0.0\u002F0` or `::\u002F0`.\n- **`sg_no_public_admin_ingress`** — an inline ingress must not open a curated never-public\n  admin\u002Fdatastore port (`22`, `3389`, `6379`, `11211`, `27017`, `9200`\u002F`9300`, `5601`) to\n  `0.0.0.0\u002F0` or `::\u002F0`. Web (`80`\u002F`443`) and app\u002Fgame ports are not flagged; DB ports are\n  handled by the rule above. Both check `cidr_blocks` and `ipv6_cidr_blocks` independently, so a\n  benign IPv4 list does not mask an open IPv6 one. Both: separate `aws_security_group_rule` \u002F\n  `aws_vpc_security_group_ingress_rule` resources fail open (not correlated).\n\n**IAM least-privilege** (`aws_iam_policy`, `aws_iam_role_policy`, `aws_iam_group_policy`,\n`aws_iam_user_policy`):\n\n- **`no_wildcard_iam`** — an `Allow` statement must not use `Action`\u002F`Resource` `\"*\"`.\n  `aws_iam_policy_document` data sources and assume-role trust policies fail open.\n\n> The checker is a zero-dependency static HCL reader (no `terraform init`, no provider\n> download) — it runs even when the registry is unreachable. It uses brace-depth matching\n> for nested blocks, so a valid HTTPS listener written with a nested `forward { ... }`\n> block is **not** a false failure.\n\n## Fixtures (also the checker's regression suite)\n\n`fixtures\u002Fterraform-policy\u002F` holds **intentionally-shaped** Terraform used by\n`scripts\u002Ftest_validate_terraform_policy.py`:\n\n- `bad-http-forward\u002F` — internet-facing ALB that forwards plaintext HTTP → MUST `POLICY_FAIL`.\n- `internal-alb-only\u002F` — internal ALB on HTTP → MUST `POLICY_OK` (HTTP allowed internally).\n- `good-https-redirect\u002F` — the correct pattern → `POLICY_OK`.\n\nThese are deliberately non-compliant test data (never deployed). They are excluded from the\nrepo-wide `checkov` scan via `.checkov.yaml` `skip-path`; do **not** \"harden\" them — doing so\nbreaks the tests that assert the failure paths.\n\n## Verification\n\n```bash\n# from skills\u002Ftf-best-practices\u002F\nuv run --python 3.12 --with pytest python -m pytest scripts\u002Ftest_validate_terraform_policy.py -q\n```\n",{"data":41,"body":42},{"name":4,"description":6},{"type":43,"children":44},"root",[45,54,68,124,131,143,261,295,301,320,355,382,412,425,439,444,554,566,579,657,710,746,753,889,902,1311,1349,1355,1374,1400,1486,1512,1566,1582,1621,1629,1814,1851,1906,1937,1943,1968,2023,2057,2063,2136],{"type":46,"tag":47,"props":48,"children":50},"element","h1",{"id":49},"tf-best-practices-generated-iac-posture-rules-read-only-policy-gate",[51],{"type":52,"value":53},"text","tf-best-practices — Generated-IaC posture rules + read-only policy gate",{"type":46,"tag":55,"props":56,"children":57},"p",{},[58,60,66],{"type":52,"value":59},"A ",{"type":46,"tag":61,"props":62,"children":63},"strong",{},[64],{"type":52,"value":65},"shared authoring guide and verdict producer",{"type":52,"value":67},", not a workflow. It answers two\nquestions for a phase that generates AWS Terraform:",{"type":46,"tag":69,"props":70,"children":71},"ol",{},[72,100],{"type":46,"tag":73,"props":74,"children":75},"li",{},[76,81,83,90,92,98],{"type":46,"tag":61,"props":77,"children":78},{},[79],{"type":52,"value":80},"Before writing",{"type":52,"value":82}," — \"what security posture must the generated ",{"type":46,"tag":84,"props":85,"children":87},"code",{"className":86},[],[88],{"type":52,"value":89},"terraform\u002F",{"type":52,"value":91}," follow?\"\n(the posture rules + the ",{"type":46,"tag":84,"props":93,"children":95},{"className":94},[],[96],{"type":52,"value":97},"baseline.tf",{"type":52,"value":99}," account-hardening spec)",{"type":46,"tag":73,"props":101,"children":102},{},[103,108,110,115,117,122],{"type":46,"tag":61,"props":104,"children":105},{},[106],{"type":52,"value":107},"After writing",{"type":52,"value":109}," — \"does the generated ",{"type":46,"tag":84,"props":111,"children":113},{"className":112},[],[114],{"type":52,"value":89},{"type":52,"value":116}," pass policy?\" (a deterministic,\n",{"type":46,"tag":61,"props":118,"children":119},{},[120],{"type":52,"value":121},"read-only",{"type":52,"value":123}," verdict + a machine-readable report)",{"type":46,"tag":125,"props":126,"children":128},"h2",{"id":127},"routing-load-the-part-that-matches-your-context",[129],{"type":52,"value":130},"Routing — load the part that matches your context",{"type":46,"tag":55,"props":132,"children":133},{},[134,136,141],{"type":52,"value":135},"This skill is entered at two touchpoints in the caller's Generate flow, with the caller's\nown terraform-authoring work in between. ",{"type":46,"tag":61,"props":137,"children":138},{},[139],{"type":52,"value":140},"The caller states which touchpoint it is at when it\nloads this skill",{"type":52,"value":142},", and reads the corresponding part:",{"type":46,"tag":144,"props":145,"children":146},"table",{},[147,171],{"type":46,"tag":148,"props":149,"children":150},"thead",{},[151],{"type":46,"tag":152,"props":153,"children":154},"tr",{},[155,161,166],{"type":46,"tag":156,"props":157,"children":158},"th",{},[159],{"type":52,"value":160},"Caller context",{"type":46,"tag":156,"props":162,"children":163},{},[164],{"type":52,"value":165},"Load",{"type":46,"tag":156,"props":167,"children":168},{},[169],{"type":52,"value":170},"Why",{"type":46,"tag":172,"props":173,"children":174},"tbody",{},[175,214],{"type":46,"tag":152,"props":176,"children":177},{},[178,194,209],{"type":46,"tag":179,"props":180,"children":181},"td",{},[182,192],{"type":46,"tag":61,"props":183,"children":184},{},[185,187],{"type":52,"value":186},"About to author ",{"type":46,"tag":84,"props":188,"children":190},{"className":189},[],[191],{"type":52,"value":89},{"type":52,"value":193}," (before writing)",{"type":46,"tag":179,"props":195,"children":196},{},[197,199],{"type":52,"value":198},"Part 1 → ",{"type":46,"tag":200,"props":201,"children":203},"a",{"href":202},"references\u002Fsecurity-posture-rules.md",[204],{"type":46,"tag":84,"props":205,"children":207},{"className":206},[],[208],{"type":52,"value":202},{"type":46,"tag":179,"props":210,"children":211},{},[212],{"type":52,"value":213},"The \"what to emit\" AWS authoring rules (gate-enforced + authoring-only + compliance-conditional).",{"type":46,"tag":152,"props":215,"children":216},{},[217,232,248],{"type":46,"tag":179,"props":218,"children":219},{},[220,230],{"type":46,"tag":61,"props":221,"children":222},{},[223,228],{"type":46,"tag":84,"props":224,"children":226},{"className":225},[],[227],{"type":52,"value":89},{"type":52,"value":229}," written, ready to validate",{"type":52,"value":231}," (after writing)",{"type":46,"tag":179,"props":233,"children":234},{},[235,237,246],{"type":52,"value":236},"Part 2 → ",{"type":46,"tag":200,"props":238,"children":240},{"href":239},"references\u002Fterraform-validation.md",[241],{"type":46,"tag":84,"props":242,"children":244},{"className":243},[],[245],{"type":52,"value":239},{"type":52,"value":247}," + run the gate script",{"type":46,"tag":179,"props":249,"children":250},{},[251,253,259],{"type":52,"value":252},"The ",{"type":46,"tag":84,"props":254,"children":256},{"className":255},[],[257],{"type":52,"value":258},"fmt → init → validate → policy",{"type":52,"value":260}," protocol and the read-only verdict.",{"type":46,"tag":55,"props":262,"children":263},{},[264,266,271,273,278,280,285,287,293],{"type":52,"value":265},"Everything this skill states is ",{"type":46,"tag":61,"props":267,"children":268},{},[269],{"type":52,"value":270},"source-cloud-agnostic",{"type":52,"value":272}," (pure AWS Terraform). Any GCP\u002FHeroku\ndetection or artifact reading is the caller's job; where a rule needs a caller-known fact (e.g.\ndeclared compliance frameworks), the caller passes it as a ",{"type":46,"tag":61,"props":274,"children":275},{},[276],{"type":52,"value":277},"caller-context signal",{"type":52,"value":279}," — see\n",{"type":46,"tag":84,"props":281,"children":283},{"className":282},[],[284],{"type":52,"value":202},{"type":52,"value":286}," § ",{"type":46,"tag":288,"props":289,"children":290},"em",{},[291],{"type":52,"value":292},"Caller-context signals",{"type":52,"value":294},".",{"type":46,"tag":125,"props":296,"children":298},{"id":297},"boundary-read-this-first",[299],{"type":52,"value":300},"Boundary (read this first)",{"type":46,"tag":55,"props":302,"children":303},{},[304,306,311,313,318],{"type":52,"value":305},"This unit is a ",{"type":46,"tag":61,"props":307,"children":308},{},[309],{"type":52,"value":310},"verdict producer, never a mutator",{"type":52,"value":312},". Its entire write surface is the\nJSON verdict it is asked to emit. Specifically it ",{"type":46,"tag":61,"props":314,"children":315},{},[316],{"type":52,"value":317},"MUST NOT",{"type":52,"value":319},":",{"type":46,"tag":321,"props":322,"children":323},"ul",{},[324,337,350],{"type":46,"tag":73,"props":325,"children":326},{},[327,329,335],{"type":52,"value":328},"edit, format, or rewrite any ",{"type":46,"tag":84,"props":330,"children":332},{"className":331},[],[333],{"type":52,"value":334},".tf",{"type":52,"value":336}," file (the caller owns remediation),",{"type":46,"tag":73,"props":338,"children":339},{},[340,342,348],{"type":52,"value":341},"read or write ",{"type":46,"tag":84,"props":343,"children":345},{"className":344},[],[346],{"type":52,"value":347},".phase-status.json",{"type":52,"value":349}," or any run-state file (interpreter-owned),",{"type":46,"tag":73,"props":351,"children":352},{},[353],{"type":52,"value":354},"decide whether a phase may complete, or prompt the user (caller policy).",{"type":46,"tag":55,"props":356,"children":357},{},[358,360,365,367,373,375,380],{"type":52,"value":359},"The caller (a migration skill's Generate phase) owns: the fix-and-retry loop that edits\nthe ",{"type":46,"tag":84,"props":361,"children":363},{"className":362},[],[364],{"type":52,"value":334},{"type":52,"value":366}," it generated, ",{"type":46,"tag":84,"props":368,"children":370},{"className":369},[],[371],{"type":52,"value":372},"terraform fmt",{"type":52,"value":374}," auto-apply, the retry\u002Fskip\u002Fabort prompt, the\nPhase Completion gate, and every ",{"type":46,"tag":84,"props":376,"children":378},{"className":377},[],[379],{"type":52,"value":347},{"type":52,"value":381}," write. See the consuming skill's\ngenerate phase for how the verdict feeds those decisions.",{"type":46,"tag":383,"props":384,"children":385},"blockquote",{},[386],{"type":46,"tag":55,"props":387,"children":388},{},[389,394,396,402,404,410],{"type":46,"tag":61,"props":390,"children":391},{},[392],{"type":52,"value":393},"Consumers (v1):",{"type":52,"value":395}," ",{"type":46,"tag":84,"props":397,"children":399},{"className":398},[],[400],{"type":52,"value":401},"gcp-to-aws",{"type":52,"value":403}," only. The contract is source-agnostic and designed to\nbe adopted by ",{"type":46,"tag":84,"props":405,"children":407},{"className":406},[],[408],{"type":52,"value":409},"heroku-to-aws",{"type":52,"value":411}," later, but that wiring is intentionally out of scope for now.",{"type":46,"tag":125,"props":413,"children":415},{"id":414},"part-1-authoring-posture-load-before-writing-terraform",[416,418,423],{"type":52,"value":417},"Part 1 — Authoring posture (load before writing ",{"type":46,"tag":84,"props":419,"children":421},{"className":420},[],[422],{"type":52,"value":89},{"type":52,"value":424},")",{"type":46,"tag":55,"props":426,"children":427},{},[428,430,438],{"type":52,"value":429},"Emit generated Terraform that satisfies the posture in\n",{"type":46,"tag":200,"props":431,"children":432},{"href":202},[433],{"type":46,"tag":84,"props":434,"children":436},{"className":435},[],[437],{"type":52,"value":202},{"type":52,"value":294},{"type":46,"tag":55,"props":440,"children":441},{},[442],{"type":52,"value":443},"These are the \"what good AWS Terraform looks like\" rules. Following them makes the Part 2 gate\npass by construction. This unit does not read the caller's artifacts — it consumes only\ncaller-context signals the caller passes in.",{"type":46,"tag":383,"props":445,"children":446},{},[447,464,535],{"type":46,"tag":55,"props":448,"children":449},{},[450,455,456,462],{"type":46,"tag":61,"props":451,"children":452},{},[453],{"type":52,"value":454},"Scope.",{"type":52,"value":395},{"type":46,"tag":84,"props":457,"children":459},{"className":458},[],[460],{"type":52,"value":461},"security-posture-rules.md",{"type":52,"value":463}," covers, in three tiers:",{"type":46,"tag":321,"props":465,"children":466},{},[467,477,495],{"type":46,"tag":73,"props":468,"children":469},{},[470,475],{"type":46,"tag":61,"props":471,"children":472},{},[473],{"type":52,"value":474},"Gate-enforced",{"type":52,"value":476}," (Part 2 verifies statically): ALB TLS, no-public-database, RDS +\nElastiCache encryption-at-rest, no-public-DB-port ingress, no-public admin\u002Fdatastore-port\ningress, no-wildcard-IAM.",{"type":46,"tag":73,"props":478,"children":479},{},[480,485,487,493],{"type":46,"tag":61,"props":481,"children":482},{},[483],{"type":52,"value":484},"Authoring-only",{"type":52,"value":486}," (not gate-checkable, still required): ",{"type":46,"tag":84,"props":488,"children":490},{"className":489},[],[491],{"type":52,"value":492},"deletion_protection",{"type":52,"value":494},",\nmaster-password-via-Secrets-Manager, S3 hardening, Fargate\u002FEKS\u002FECR settings, private-subnet\nplacement, backups, baseline monitoring.",{"type":46,"tag":73,"props":496,"children":497},{},[498,503,505,511,513,519,520,526,527,533],{"type":46,"tag":61,"props":499,"children":500},{},[501],{"type":52,"value":502},"Compliance-conditional",{"type":52,"value":504}," (emitted when the caller declares ",{"type":46,"tag":84,"props":506,"children":508},{"className":507},[],[509],{"type":52,"value":510},"soc2",{"type":52,"value":512},"\u002F",{"type":46,"tag":84,"props":514,"children":516},{"className":515},[],[517],{"type":52,"value":518},"pci",{"type":52,"value":512},{"type":46,"tag":84,"props":521,"children":523},{"className":522},[],[524],{"type":52,"value":525},"hipaa",{"type":52,"value":512},{"type":46,"tag":84,"props":528,"children":530},{"className":529},[],[531],{"type":52,"value":532},"fedramp",{"type":52,"value":534},"):\nVPC flow logs, S3 access logging, secret rotation, customer-managed KMS.",{"type":46,"tag":55,"props":536,"children":537},{},[538,540,545,547,552],{"type":52,"value":539},"Still the ",{"type":46,"tag":61,"props":541,"children":542},{},[543],{"type":52,"value":544},"caller's",{"type":52,"value":546}," own generation concern (candidates to migrate here later): the\naccount-hardening ",{"type":46,"tag":84,"props":548,"children":550},{"className":549},[],[551],{"type":52,"value":97},{"type":52,"value":553}," layer (CloudTrail, GuardDuty, Config, Security Hub).",{"type":46,"tag":125,"props":555,"children":557},{"id":556},"part-2-policy-gate-run-after-writing-terraform",[558,560,565],{"type":52,"value":559},"Part 2 — Policy gate (run after writing ",{"type":46,"tag":84,"props":561,"children":563},{"className":562},[],[564],{"type":52,"value":89},{"type":52,"value":424},{"type":46,"tag":55,"props":567,"children":568},{},[569,571,577],{"type":52,"value":570},"Run the read-only checker against the generated directory. Resolve the script path relative to\nthe plugin root (",{"type":46,"tag":84,"props":572,"children":574},{"className":573},[],[575],{"type":52,"value":576},"$PLUGIN_ROOT\u002Fskills\u002Ftf-best-practices\u002Fscripts\u002F...",{"type":52,"value":578},"), the same convention the\nplugin uses for its other scripts:",{"type":46,"tag":580,"props":581,"children":586},"pre",{"className":582,"code":583,"language":584,"meta":585,"style":585},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","python3 \"$PLUGIN_ROOT\u002Fskills\u002Ftf-best-practices\u002Fscripts\u002Fvalidate-terraform-policy.py\" \"$TERRAFORM_DIR\" --json \"$VERDICT_PATH\"\n","bash","",[587],{"type":46,"tag":84,"props":588,"children":589},{"__ignoreMap":585},[590],{"type":46,"tag":591,"props":592,"children":595},"span",{"class":593,"line":594},"line",1,[596,602,608,614,620,625,629,634,638,643,647,652],{"type":46,"tag":591,"props":597,"children":599},{"style":598},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[600],{"type":52,"value":601},"python3",{"type":46,"tag":591,"props":603,"children":605},{"style":604},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[606],{"type":52,"value":607}," \"",{"type":46,"tag":591,"props":609,"children":611},{"style":610},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[612],{"type":52,"value":613},"$PLUGIN_ROOT",{"type":46,"tag":591,"props":615,"children":617},{"style":616},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[618],{"type":52,"value":619},"\u002Fskills\u002Ftf-best-practices\u002Fscripts\u002Fvalidate-terraform-policy.py",{"type":46,"tag":591,"props":621,"children":622},{"style":604},[623],{"type":52,"value":624},"\"",{"type":46,"tag":591,"props":626,"children":627},{"style":604},[628],{"type":52,"value":607},{"type":46,"tag":591,"props":630,"children":631},{"style":610},[632],{"type":52,"value":633},"$TERRAFORM_DIR",{"type":46,"tag":591,"props":635,"children":636},{"style":604},[637],{"type":52,"value":624},{"type":46,"tag":591,"props":639,"children":640},{"style":616},[641],{"type":52,"value":642}," --json",{"type":46,"tag":591,"props":644,"children":645},{"style":604},[646],{"type":52,"value":607},{"type":46,"tag":591,"props":648,"children":649},{"style":610},[650],{"type":52,"value":651},"$VERDICT_PATH",{"type":46,"tag":591,"props":653,"children":654},{"style":604},[655],{"type":52,"value":656},"\"\n",{"type":46,"tag":321,"props":658,"children":659},{},[660,692],{"type":46,"tag":73,"props":661,"children":662},{},[663,668,670,675,677,682,684,690],{"type":46,"tag":84,"props":664,"children":666},{"className":665},[],[667],{"type":52,"value":633},{"type":52,"value":669}," — ",{"type":46,"tag":61,"props":671,"children":672},{},[673],{"type":52,"value":674},"required, caller-supplied",{"type":52,"value":676},": the generated ",{"type":46,"tag":84,"props":678,"children":680},{"className":679},[],[681],{"type":52,"value":89},{"type":52,"value":683}," directory\n(e.g. ",{"type":46,"tag":84,"props":685,"children":687},{"className":686},[],[688],{"type":52,"value":689},"$MIGRATION_DIR\u002Fterraform",{"type":52,"value":691},"). This skill never defaults or discovers it — the caller\nalways passes the path it wrote Terraform to.",{"type":46,"tag":73,"props":693,"children":694},{},[695,701,703,709],{"type":46,"tag":84,"props":696,"children":698},{"className":697},[],[699],{"type":52,"value":700},"--json $VERDICT_PATH",{"type":52,"value":702}," — optional; writes a machine-readable verdict the caller can merge\ninto its own ",{"type":46,"tag":84,"props":704,"children":706},{"className":705},[],[707],{"type":52,"value":708},"validation-report.json",{"type":52,"value":294},{"type":46,"tag":55,"props":711,"children":712},{},[713,715,720,722,727,729,737,739,744],{"type":52,"value":714},"The policy check is one stage of a larger validation flow (",{"type":46,"tag":84,"props":716,"children":718},{"className":717},[],[719],{"type":52,"value":258},{"type":52,"value":721},").\nThe full protocol — including offline-fallback behavior and how the policy verdict maps into a\n",{"type":46,"tag":84,"props":723,"children":725},{"className":724},[],[726],{"type":52,"value":708},{"type":52,"value":728}," — is documented in\n",{"type":46,"tag":200,"props":730,"children":731},{"href":239},[732],{"type":46,"tag":84,"props":733,"children":735},{"className":734},[],[736],{"type":52,"value":239},{"type":52,"value":738},". That protocol is\ndescriptive: the ",{"type":46,"tag":61,"props":740,"children":741},{},[742],{"type":52,"value":743},"caller",{"type":52,"value":745}," owns the fmt\u002Finit\u002Fvalidate execution, the fix-and-retry loop, and\nthe report write; this unit contributes only the read-only policy stage + verdict shape.",{"type":46,"tag":747,"props":748,"children":750},"h3",{"id":749},"exit-codes-caller-action",[751],{"type":52,"value":752},"Exit codes → caller action",{"type":46,"tag":144,"props":754,"children":755},{},[756,782],{"type":46,"tag":148,"props":757,"children":758},{},[759],{"type":46,"tag":152,"props":760,"children":761},{},[762,767,772,777],{"type":46,"tag":156,"props":763,"children":764},{},[765],{"type":52,"value":766},"Exit",{"type":46,"tag":156,"props":768,"children":769},{},[770],{"type":52,"value":771},"stdout",{"type":46,"tag":156,"props":773,"children":774},{},[775],{"type":52,"value":776},"Meaning",{"type":46,"tag":156,"props":778,"children":779},{},[780],{"type":52,"value":781},"Caller does",{"type":46,"tag":172,"props":783,"children":784},{},[785,816,862],{"type":46,"tag":152,"props":786,"children":787},{},[788,797,806,811],{"type":46,"tag":179,"props":789,"children":790},{},[791],{"type":46,"tag":84,"props":792,"children":794},{"className":793},[],[795],{"type":52,"value":796},"0",{"type":46,"tag":179,"props":798,"children":799},{},[800],{"type":46,"tag":84,"props":801,"children":803},{"className":802},[],[804],{"type":52,"value":805},"POLICY_OK",{"type":46,"tag":179,"props":807,"children":808},{},[809],{"type":52,"value":810},"posture satisfied",{"type":46,"tag":179,"props":812,"children":813},{},[814],{"type":52,"value":815},"proceed",{"type":46,"tag":152,"props":817,"children":818},{},[819,828,837,842],{"type":46,"tag":179,"props":820,"children":821},{},[822],{"type":46,"tag":84,"props":823,"children":825},{"className":824},[],[826],{"type":52,"value":827},"1",{"type":46,"tag":179,"props":829,"children":830},{},[831],{"type":46,"tag":84,"props":832,"children":834},{"className":833},[],[835],{"type":52,"value":836},"POLICY_FAIL",{"type":46,"tag":179,"props":838,"children":839},{},[840],{"type":52,"value":841},"violations present",{"type":46,"tag":179,"props":843,"children":844},{},[845,847,853,855,860],{"type":52,"value":846},"read ",{"type":46,"tag":84,"props":848,"children":850},{"className":849},[],[851],{"type":52,"value":852},"violations[]",{"type":52,"value":854},", edit the named ",{"type":46,"tag":84,"props":856,"children":858},{"className":857},[],[859],{"type":52,"value":334},{"type":52,"value":861}," sites, re-run (caller's retry budget)",{"type":46,"tag":152,"props":863,"children":864},{},[865,874,879,884],{"type":46,"tag":179,"props":866,"children":867},{},[868],{"type":46,"tag":84,"props":869,"children":871},{"className":870},[],[872],{"type":52,"value":873},"2",{"type":46,"tag":179,"props":875,"children":876},{},[877],{"type":52,"value":878},"(usage error)",{"type":46,"tag":179,"props":880,"children":881},{},[882],{"type":52,"value":883},"bad path \u002F IO",{"type":46,"tag":179,"props":885,"children":886},{},[887],{"type":52,"value":888},"surface to user; do not treat as pass",{"type":46,"tag":747,"props":890,"children":892},{"id":891},"verdict-shape-json",[893,895,901],{"type":52,"value":894},"Verdict shape (",{"type":46,"tag":84,"props":896,"children":898},{"className":897},[],[899],{"type":52,"value":900},"--json",{"type":52,"value":424},{"type":46,"tag":580,"props":903,"children":907},{"className":904,"code":905,"language":906,"meta":585,"style":585},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"check\": \"policy\",\n  \"policy_status\": \"POLICY_OK | POLICY_FAIL\",\n  \"violations\": [\n    {\n      \"check\": \"policy\",\n      \"rule\": \"alb_https_listener | alb_http_redirect | no_tf_files\",\n      \"file\": \"compute.tf\",\n      \"line\": 7,\n      \"severity\": \"error\",\n      \"summary\": \"human-readable violation\",\n      \"fix_hint\": \"concrete remediation the caller can apply\"\n    }\n  ]\n}\n","json",[908],{"type":46,"tag":84,"props":909,"children":910},{"__ignoreMap":585},[911,919,960,998,1024,1033,1070,1108,1146,1176,1214,1252,1286,1295,1303],{"type":46,"tag":591,"props":912,"children":913},{"class":593,"line":594},[914],{"type":46,"tag":591,"props":915,"children":916},{"style":604},[917],{"type":52,"value":918},"{\n",{"type":46,"tag":591,"props":920,"children":922},{"class":593,"line":921},2,[923,928,934,938,942,946,951,955],{"type":46,"tag":591,"props":924,"children":925},{"style":604},[926],{"type":52,"value":927},"  \"",{"type":46,"tag":591,"props":929,"children":931},{"style":930},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[932],{"type":52,"value":933},"check",{"type":46,"tag":591,"props":935,"children":936},{"style":604},[937],{"type":52,"value":624},{"type":46,"tag":591,"props":939,"children":940},{"style":604},[941],{"type":52,"value":319},{"type":46,"tag":591,"props":943,"children":944},{"style":604},[945],{"type":52,"value":607},{"type":46,"tag":591,"props":947,"children":948},{"style":616},[949],{"type":52,"value":950},"policy",{"type":46,"tag":591,"props":952,"children":953},{"style":604},[954],{"type":52,"value":624},{"type":46,"tag":591,"props":956,"children":957},{"style":604},[958],{"type":52,"value":959},",\n",{"type":46,"tag":591,"props":961,"children":963},{"class":593,"line":962},3,[964,968,973,977,981,985,990,994],{"type":46,"tag":591,"props":965,"children":966},{"style":604},[967],{"type":52,"value":927},{"type":46,"tag":591,"props":969,"children":970},{"style":930},[971],{"type":52,"value":972},"policy_status",{"type":46,"tag":591,"props":974,"children":975},{"style":604},[976],{"type":52,"value":624},{"type":46,"tag":591,"props":978,"children":979},{"style":604},[980],{"type":52,"value":319},{"type":46,"tag":591,"props":982,"children":983},{"style":604},[984],{"type":52,"value":607},{"type":46,"tag":591,"props":986,"children":987},{"style":616},[988],{"type":52,"value":989},"POLICY_OK | POLICY_FAIL",{"type":46,"tag":591,"props":991,"children":992},{"style":604},[993],{"type":52,"value":624},{"type":46,"tag":591,"props":995,"children":996},{"style":604},[997],{"type":52,"value":959},{"type":46,"tag":591,"props":999,"children":1001},{"class":593,"line":1000},4,[1002,1006,1011,1015,1019],{"type":46,"tag":591,"props":1003,"children":1004},{"style":604},[1005],{"type":52,"value":927},{"type":46,"tag":591,"props":1007,"children":1008},{"style":930},[1009],{"type":52,"value":1010},"violations",{"type":46,"tag":591,"props":1012,"children":1013},{"style":604},[1014],{"type":52,"value":624},{"type":46,"tag":591,"props":1016,"children":1017},{"style":604},[1018],{"type":52,"value":319},{"type":46,"tag":591,"props":1020,"children":1021},{"style":604},[1022],{"type":52,"value":1023}," [\n",{"type":46,"tag":591,"props":1025,"children":1027},{"class":593,"line":1026},5,[1028],{"type":46,"tag":591,"props":1029,"children":1030},{"style":604},[1031],{"type":52,"value":1032},"    {\n",{"type":46,"tag":591,"props":1034,"children":1036},{"class":593,"line":1035},6,[1037,1042,1046,1050,1054,1058,1062,1066],{"type":46,"tag":591,"props":1038,"children":1039},{"style":604},[1040],{"type":52,"value":1041},"      \"",{"type":46,"tag":591,"props":1043,"children":1044},{"style":598},[1045],{"type":52,"value":933},{"type":46,"tag":591,"props":1047,"children":1048},{"style":604},[1049],{"type":52,"value":624},{"type":46,"tag":591,"props":1051,"children":1052},{"style":604},[1053],{"type":52,"value":319},{"type":46,"tag":591,"props":1055,"children":1056},{"style":604},[1057],{"type":52,"value":607},{"type":46,"tag":591,"props":1059,"children":1060},{"style":616},[1061],{"type":52,"value":950},{"type":46,"tag":591,"props":1063,"children":1064},{"style":604},[1065],{"type":52,"value":624},{"type":46,"tag":591,"props":1067,"children":1068},{"style":604},[1069],{"type":52,"value":959},{"type":46,"tag":591,"props":1071,"children":1073},{"class":593,"line":1072},7,[1074,1078,1083,1087,1091,1095,1100,1104],{"type":46,"tag":591,"props":1075,"children":1076},{"style":604},[1077],{"type":52,"value":1041},{"type":46,"tag":591,"props":1079,"children":1080},{"style":598},[1081],{"type":52,"value":1082},"rule",{"type":46,"tag":591,"props":1084,"children":1085},{"style":604},[1086],{"type":52,"value":624},{"type":46,"tag":591,"props":1088,"children":1089},{"style":604},[1090],{"type":52,"value":319},{"type":46,"tag":591,"props":1092,"children":1093},{"style":604},[1094],{"type":52,"value":607},{"type":46,"tag":591,"props":1096,"children":1097},{"style":616},[1098],{"type":52,"value":1099},"alb_https_listener | alb_http_redirect | no_tf_files",{"type":46,"tag":591,"props":1101,"children":1102},{"style":604},[1103],{"type":52,"value":624},{"type":46,"tag":591,"props":1105,"children":1106},{"style":604},[1107],{"type":52,"value":959},{"type":46,"tag":591,"props":1109,"children":1111},{"class":593,"line":1110},8,[1112,1116,1121,1125,1129,1133,1138,1142],{"type":46,"tag":591,"props":1113,"children":1114},{"style":604},[1115],{"type":52,"value":1041},{"type":46,"tag":591,"props":1117,"children":1118},{"style":598},[1119],{"type":52,"value":1120},"file",{"type":46,"tag":591,"props":1122,"children":1123},{"style":604},[1124],{"type":52,"value":624},{"type":46,"tag":591,"props":1126,"children":1127},{"style":604},[1128],{"type":52,"value":319},{"type":46,"tag":591,"props":1130,"children":1131},{"style":604},[1132],{"type":52,"value":607},{"type":46,"tag":591,"props":1134,"children":1135},{"style":616},[1136],{"type":52,"value":1137},"compute.tf",{"type":46,"tag":591,"props":1139,"children":1140},{"style":604},[1141],{"type":52,"value":624},{"type":46,"tag":591,"props":1143,"children":1144},{"style":604},[1145],{"type":52,"value":959},{"type":46,"tag":591,"props":1147,"children":1149},{"class":593,"line":1148},9,[1150,1154,1158,1162,1166,1172],{"type":46,"tag":591,"props":1151,"children":1152},{"style":604},[1153],{"type":52,"value":1041},{"type":46,"tag":591,"props":1155,"children":1156},{"style":598},[1157],{"type":52,"value":593},{"type":46,"tag":591,"props":1159,"children":1160},{"style":604},[1161],{"type":52,"value":624},{"type":46,"tag":591,"props":1163,"children":1164},{"style":604},[1165],{"type":52,"value":319},{"type":46,"tag":591,"props":1167,"children":1169},{"style":1168},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[1170],{"type":52,"value":1171}," 7",{"type":46,"tag":591,"props":1173,"children":1174},{"style":604},[1175],{"type":52,"value":959},{"type":46,"tag":591,"props":1177,"children":1179},{"class":593,"line":1178},10,[1180,1184,1189,1193,1197,1201,1206,1210],{"type":46,"tag":591,"props":1181,"children":1182},{"style":604},[1183],{"type":52,"value":1041},{"type":46,"tag":591,"props":1185,"children":1186},{"style":598},[1187],{"type":52,"value":1188},"severity",{"type":46,"tag":591,"props":1190,"children":1191},{"style":604},[1192],{"type":52,"value":624},{"type":46,"tag":591,"props":1194,"children":1195},{"style":604},[1196],{"type":52,"value":319},{"type":46,"tag":591,"props":1198,"children":1199},{"style":604},[1200],{"type":52,"value":607},{"type":46,"tag":591,"props":1202,"children":1203},{"style":616},[1204],{"type":52,"value":1205},"error",{"type":46,"tag":591,"props":1207,"children":1208},{"style":604},[1209],{"type":52,"value":624},{"type":46,"tag":591,"props":1211,"children":1212},{"style":604},[1213],{"type":52,"value":959},{"type":46,"tag":591,"props":1215,"children":1217},{"class":593,"line":1216},11,[1218,1222,1227,1231,1235,1239,1244,1248],{"type":46,"tag":591,"props":1219,"children":1220},{"style":604},[1221],{"type":52,"value":1041},{"type":46,"tag":591,"props":1223,"children":1224},{"style":598},[1225],{"type":52,"value":1226},"summary",{"type":46,"tag":591,"props":1228,"children":1229},{"style":604},[1230],{"type":52,"value":624},{"type":46,"tag":591,"props":1232,"children":1233},{"style":604},[1234],{"type":52,"value":319},{"type":46,"tag":591,"props":1236,"children":1237},{"style":604},[1238],{"type":52,"value":607},{"type":46,"tag":591,"props":1240,"children":1241},{"style":616},[1242],{"type":52,"value":1243},"human-readable violation",{"type":46,"tag":591,"props":1245,"children":1246},{"style":604},[1247],{"type":52,"value":624},{"type":46,"tag":591,"props":1249,"children":1250},{"style":604},[1251],{"type":52,"value":959},{"type":46,"tag":591,"props":1253,"children":1255},{"class":593,"line":1254},12,[1256,1260,1265,1269,1273,1277,1282],{"type":46,"tag":591,"props":1257,"children":1258},{"style":604},[1259],{"type":52,"value":1041},{"type":46,"tag":591,"props":1261,"children":1262},{"style":598},[1263],{"type":52,"value":1264},"fix_hint",{"type":46,"tag":591,"props":1266,"children":1267},{"style":604},[1268],{"type":52,"value":624},{"type":46,"tag":591,"props":1270,"children":1271},{"style":604},[1272],{"type":52,"value":319},{"type":46,"tag":591,"props":1274,"children":1275},{"style":604},[1276],{"type":52,"value":607},{"type":46,"tag":591,"props":1278,"children":1279},{"style":616},[1280],{"type":52,"value":1281},"concrete remediation the caller can apply",{"type":46,"tag":591,"props":1283,"children":1284},{"style":604},[1285],{"type":52,"value":656},{"type":46,"tag":591,"props":1287,"children":1289},{"class":593,"line":1288},13,[1290],{"type":46,"tag":591,"props":1291,"children":1292},{"style":604},[1293],{"type":52,"value":1294},"    }\n",{"type":46,"tag":591,"props":1296,"children":1297},{"class":593,"line":29},[1298],{"type":46,"tag":591,"props":1299,"children":1300},{"style":604},[1301],{"type":52,"value":1302},"  ]\n",{"type":46,"tag":591,"props":1304,"children":1305},{"class":593,"line":33},[1306],{"type":46,"tag":591,"props":1307,"children":1308},{"style":604},[1309],{"type":52,"value":1310},"}\n",{"type":46,"tag":55,"props":1312,"children":1313},{},[1314,1316,1321,1323,1328,1329,1334,1336,1341,1342,1347],{"type":52,"value":1315},"Each ",{"type":46,"tag":84,"props":1317,"children":1319},{"className":1318},[],[1320],{"type":52,"value":852},{"type":52,"value":1322}," entry is ",{"type":46,"tag":61,"props":1324,"children":1325},{},[1326],{"type":52,"value":1327},"actionable evidence",{"type":52,"value":669},{"type":46,"tag":84,"props":1330,"children":1332},{"className":1331},[],[1333],{"type":52,"value":1120},{"type":52,"value":1335}," + ",{"type":46,"tag":84,"props":1337,"children":1339},{"className":1338},[],[1340],{"type":52,"value":593},{"type":52,"value":1335},{"type":46,"tag":84,"props":1343,"children":1345},{"className":1344},[],[1346],{"type":52,"value":1264},{"type":52,"value":1348}," tell the\ncaller exactly what to edit. The caller applies the edit; this unit only reports.",{"type":46,"tag":125,"props":1350,"children":1352},{"id":1351},"policy-rules-enforced-today",[1353],{"type":52,"value":1354},"Policy rules enforced today",{"type":46,"tag":55,"props":1356,"children":1357},{},[1358,1360,1365,1367,1372],{"type":52,"value":1359},"Every rule is ",{"type":46,"tag":61,"props":1361,"children":1362},{},[1363],{"type":52,"value":1364},"fail-open on ambiguity",{"type":52,"value":1366}," — it fires only on unambiguous, in-block literal\nevidence, so a valid stack is never falsely blocked (a ",{"type":46,"tag":84,"props":1368,"children":1370},{"className":1369},[],[1371],{"type":52,"value":836},{"type":52,"value":1373}," is a hard completion gate\nfor the caller, so a false positive would block a real migration).",{"type":46,"tag":55,"props":1375,"children":1376},{},[1377,1382,1384,1390,1392,1398],{"type":46,"tag":61,"props":1378,"children":1379},{},[1380],{"type":52,"value":1381},"Internet-facing ALB TLS posture",{"type":52,"value":1383}," (an ALB is internet-facing when ",{"type":46,"tag":84,"props":1385,"children":1387},{"className":1386},[],[1388],{"type":52,"value":1389},"internal",{"type":52,"value":1391}," is absent,\n",{"type":46,"tag":84,"props":1393,"children":1395},{"className":1394},[],[1396],{"type":52,"value":1397},"false",{"type":52,"value":1399},", or variable-driven — fail-safe):",{"type":46,"tag":321,"props":1401,"children":1402},{},[1403,1441],{"type":46,"tag":73,"props":1404,"children":1405},{},[1406,1415,1417,1423,1425,1431,1433,1439],{"type":46,"tag":61,"props":1407,"children":1408},{},[1409],{"type":46,"tag":84,"props":1410,"children":1412},{"className":1411},[],[1413],{"type":52,"value":1414},"alb_https_listener",{"type":52,"value":1416}," — must have an HTTPS listener on ",{"type":46,"tag":84,"props":1418,"children":1420},{"className":1419},[],[1421],{"type":52,"value":1422},"443",{"type":52,"value":1424}," with ",{"type":46,"tag":84,"props":1426,"children":1428},{"className":1427},[],[1429],{"type":52,"value":1430},"certificate_arn",{"type":52,"value":1432}," and a\n",{"type":46,"tag":84,"props":1434,"children":1436},{"className":1435},[],[1437],{"type":52,"value":1438},"forward",{"type":52,"value":1440}," action.",{"type":46,"tag":73,"props":1442,"children":1443},{},[1444,1453,1455,1461,1463,1469,1471,1476,1478,1484],{"type":46,"tag":61,"props":1445,"children":1446},{},[1447],{"type":46,"tag":84,"props":1448,"children":1450},{"className":1449},[],[1451],{"type":52,"value":1452},"alb_http_redirect",{"type":52,"value":1454}," — an HTTP ",{"type":46,"tag":84,"props":1456,"children":1458},{"className":1457},[],[1459],{"type":52,"value":1460},":80",{"type":52,"value":1462}," listener must ",{"type":46,"tag":84,"props":1464,"children":1466},{"className":1465},[],[1467],{"type":52,"value":1468},"redirect",{"type":52,"value":1470}," to HTTPS, never ",{"type":46,"tag":84,"props":1472,"children":1474},{"className":1473},[],[1475],{"type":52,"value":1438},{"type":52,"value":1477},"\nto targets. Internal ALBs (",{"type":46,"tag":84,"props":1479,"children":1481},{"className":1480},[],[1482],{"type":52,"value":1483},"internal = true",{"type":52,"value":1485},") are exempt.",{"type":46,"tag":55,"props":1487,"children":1488},{},[1489,1494,1496,1502,1504,1510],{"type":46,"tag":61,"props":1490,"children":1491},{},[1492],{"type":52,"value":1493},"Managed database exposure & encryption",{"type":52,"value":1495}," (",{"type":46,"tag":84,"props":1497,"children":1499},{"className":1498},[],[1500],{"type":52,"value":1501},"aws_db_instance",{"type":52,"value":1503},", ",{"type":46,"tag":84,"props":1505,"children":1507},{"className":1506},[],[1508],{"type":52,"value":1509},"aws_rds_cluster",{"type":52,"value":1511},"):",{"type":46,"tag":321,"props":1513,"children":1514},{},[1515,1537],{"type":46,"tag":73,"props":1516,"children":1517},{},[1518,1527,1529,1535],{"type":46,"tag":61,"props":1519,"children":1520},{},[1521],{"type":46,"tag":84,"props":1522,"children":1524},{"className":1523},[],[1525],{"type":52,"value":1526},"rds_not_public",{"type":52,"value":1528}," — must not set ",{"type":46,"tag":84,"props":1530,"children":1532},{"className":1531},[],[1533],{"type":52,"value":1534},"publicly_accessible = true",{"type":52,"value":1536}," (absent\u002Fvariable → fail-open).",{"type":46,"tag":73,"props":1538,"children":1539},{},[1540,1549,1551,1557,1559,1564],{"type":46,"tag":61,"props":1541,"children":1542},{},[1543],{"type":46,"tag":84,"props":1544,"children":1546},{"className":1545},[],[1547],{"type":52,"value":1548},"rds_encryption_at_rest",{"type":52,"value":1550}," — must set ",{"type":46,"tag":84,"props":1552,"children":1554},{"className":1553},[],[1555],{"type":52,"value":1556},"storage_encrypted = true",{"type":52,"value":1558},"; missing or literal ",{"type":46,"tag":84,"props":1560,"children":1562},{"className":1561},[],[1563],{"type":52,"value":1397},{"type":52,"value":1565},"\nfires (RDS defaults to unencrypted), variable-driven fails open. S3 is not checked (default\nSSE-S3 since Jan 2023).",{"type":46,"tag":55,"props":1567,"children":1568},{},[1569,1574,1575,1581],{"type":46,"tag":61,"props":1570,"children":1571},{},[1572],{"type":52,"value":1573},"ElastiCache encryption",{"type":52,"value":1495},{"type":46,"tag":84,"props":1576,"children":1578},{"className":1577},[],[1579],{"type":52,"value":1580},"aws_elasticache_replication_group",{"type":52,"value":1511},{"type":46,"tag":321,"props":1583,"children":1584},{},[1585],{"type":46,"tag":73,"props":1586,"children":1587},{},[1588,1597,1598,1604,1606,1611,1613,1619],{"type":46,"tag":61,"props":1589,"children":1590},{},[1591],{"type":46,"tag":84,"props":1592,"children":1594},{"className":1593},[],[1595],{"type":52,"value":1596},"elasticache_encryption_at_rest",{"type":52,"value":1550},{"type":46,"tag":84,"props":1599,"children":1601},{"className":1600},[],[1602],{"type":52,"value":1603},"at_rest_encryption_enabled = true",{"type":52,"value":1605},"; missing\nor literal ",{"type":46,"tag":84,"props":1607,"children":1609},{"className":1608},[],[1610],{"type":52,"value":1397},{"type":52,"value":1612}," fires, variable-driven fails open. ",{"type":46,"tag":84,"props":1614,"children":1616},{"className":1615},[],[1617],{"type":52,"value":1618},"aws_elasticache_cluster",{"type":52,"value":1620}," (Memcached)\nnot checked.",{"type":46,"tag":55,"props":1622,"children":1623},{},[1624],{"type":46,"tag":61,"props":1625,"children":1626},{},[1627],{"type":52,"value":1628},"Security group ingress:",{"type":46,"tag":321,"props":1630,"children":1631},{},[1632,1684],{"type":46,"tag":73,"props":1633,"children":1634},{},[1635,1644,1646,1652,1654,1660,1661,1667,1669,1675,1677,1683],{"type":46,"tag":61,"props":1636,"children":1637},{},[1638],{"type":46,"tag":84,"props":1639,"children":1641},{"className":1640},[],[1642],{"type":52,"value":1643},"db_sg_no_public_ingress",{"type":52,"value":1645}," — an inline ",{"type":46,"tag":84,"props":1647,"children":1649},{"className":1648},[],[1650],{"type":52,"value":1651},"aws_security_group",{"type":52,"value":1653}," ingress covering ",{"type":46,"tag":84,"props":1655,"children":1657},{"className":1656},[],[1658],{"type":52,"value":1659},"5432",{"type":52,"value":512},{"type":46,"tag":84,"props":1662,"children":1664},{"className":1663},[],[1665],{"type":52,"value":1666},"3306",{"type":52,"value":1668},"\nmust not allow ",{"type":46,"tag":84,"props":1670,"children":1672},{"className":1671},[],[1673],{"type":52,"value":1674},"0.0.0.0\u002F0",{"type":52,"value":1676}," or ",{"type":46,"tag":84,"props":1678,"children":1680},{"className":1679},[],[1681],{"type":52,"value":1682},"::\u002F0",{"type":52,"value":294},{"type":46,"tag":73,"props":1685,"children":1686},{},[1687,1696,1698,1704,1705,1711,1712,1718,1719,1725,1726,1732,1733,1739,1740,1746,1747,1753,1755,1760,1761,1766,1768,1774,1775,1780,1782,1788,1790,1796,1798,1804,1806,1812],{"type":46,"tag":61,"props":1688,"children":1689},{},[1690],{"type":46,"tag":84,"props":1691,"children":1693},{"className":1692},[],[1694],{"type":52,"value":1695},"sg_no_public_admin_ingress",{"type":52,"value":1697}," — an inline ingress must not open a curated never-public\nadmin\u002Fdatastore port (",{"type":46,"tag":84,"props":1699,"children":1701},{"className":1700},[],[1702],{"type":52,"value":1703},"22",{"type":52,"value":1503},{"type":46,"tag":84,"props":1706,"children":1708},{"className":1707},[],[1709],{"type":52,"value":1710},"3389",{"type":52,"value":1503},{"type":46,"tag":84,"props":1713,"children":1715},{"className":1714},[],[1716],{"type":52,"value":1717},"6379",{"type":52,"value":1503},{"type":46,"tag":84,"props":1720,"children":1722},{"className":1721},[],[1723],{"type":52,"value":1724},"11211",{"type":52,"value":1503},{"type":46,"tag":84,"props":1727,"children":1729},{"className":1728},[],[1730],{"type":52,"value":1731},"27017",{"type":52,"value":1503},{"type":46,"tag":84,"props":1734,"children":1736},{"className":1735},[],[1737],{"type":52,"value":1738},"9200",{"type":52,"value":512},{"type":46,"tag":84,"props":1741,"children":1743},{"className":1742},[],[1744],{"type":52,"value":1745},"9300",{"type":52,"value":1503},{"type":46,"tag":84,"props":1748,"children":1750},{"className":1749},[],[1751],{"type":52,"value":1752},"5601",{"type":52,"value":1754},") to\n",{"type":46,"tag":84,"props":1756,"children":1758},{"className":1757},[],[1759],{"type":52,"value":1674},{"type":52,"value":1676},{"type":46,"tag":84,"props":1762,"children":1764},{"className":1763},[],[1765],{"type":52,"value":1682},{"type":52,"value":1767},". Web (",{"type":46,"tag":84,"props":1769,"children":1771},{"className":1770},[],[1772],{"type":52,"value":1773},"80",{"type":52,"value":512},{"type":46,"tag":84,"props":1776,"children":1778},{"className":1777},[],[1779],{"type":52,"value":1422},{"type":52,"value":1781},") and app\u002Fgame ports are not flagged; DB ports are\nhandled by the rule above. Both check ",{"type":46,"tag":84,"props":1783,"children":1785},{"className":1784},[],[1786],{"type":52,"value":1787},"cidr_blocks",{"type":52,"value":1789}," and ",{"type":46,"tag":84,"props":1791,"children":1793},{"className":1792},[],[1794],{"type":52,"value":1795},"ipv6_cidr_blocks",{"type":52,"value":1797}," independently, so a\nbenign IPv4 list does not mask an open IPv6 one. Both: separate ",{"type":46,"tag":84,"props":1799,"children":1801},{"className":1800},[],[1802],{"type":52,"value":1803},"aws_security_group_rule",{"type":52,"value":1805}," \u002F\n",{"type":46,"tag":84,"props":1807,"children":1809},{"className":1808},[],[1810],{"type":52,"value":1811},"aws_vpc_security_group_ingress_rule",{"type":52,"value":1813}," resources fail open (not correlated).",{"type":46,"tag":55,"props":1815,"children":1816},{},[1817,1822,1823,1829,1830,1836,1837,1843,1844,1850],{"type":46,"tag":61,"props":1818,"children":1819},{},[1820],{"type":52,"value":1821},"IAM least-privilege",{"type":52,"value":1495},{"type":46,"tag":84,"props":1824,"children":1826},{"className":1825},[],[1827],{"type":52,"value":1828},"aws_iam_policy",{"type":52,"value":1503},{"type":46,"tag":84,"props":1831,"children":1833},{"className":1832},[],[1834],{"type":52,"value":1835},"aws_iam_role_policy",{"type":52,"value":1503},{"type":46,"tag":84,"props":1838,"children":1840},{"className":1839},[],[1841],{"type":52,"value":1842},"aws_iam_group_policy",{"type":52,"value":959},{"type":46,"tag":84,"props":1845,"children":1847},{"className":1846},[],[1848],{"type":52,"value":1849},"aws_iam_user_policy",{"type":52,"value":1511},{"type":46,"tag":321,"props":1852,"children":1853},{},[1854],{"type":46,"tag":73,"props":1855,"children":1856},{},[1857,1866,1868,1874,1876,1882,1883,1889,1890,1896,1898,1904],{"type":46,"tag":61,"props":1858,"children":1859},{},[1860],{"type":46,"tag":84,"props":1861,"children":1863},{"className":1862},[],[1864],{"type":52,"value":1865},"no_wildcard_iam",{"type":52,"value":1867}," — an ",{"type":46,"tag":84,"props":1869,"children":1871},{"className":1870},[],[1872],{"type":52,"value":1873},"Allow",{"type":52,"value":1875}," statement must not use ",{"type":46,"tag":84,"props":1877,"children":1879},{"className":1878},[],[1880],{"type":52,"value":1881},"Action",{"type":52,"value":512},{"type":46,"tag":84,"props":1884,"children":1886},{"className":1885},[],[1887],{"type":52,"value":1888},"Resource",{"type":52,"value":395},{"type":46,"tag":84,"props":1891,"children":1893},{"className":1892},[],[1894],{"type":52,"value":1895},"\"*\"",{"type":52,"value":1897},".\n",{"type":46,"tag":84,"props":1899,"children":1901},{"className":1900},[],[1902],{"type":52,"value":1903},"aws_iam_policy_document",{"type":52,"value":1905}," data sources and assume-role trust policies fail open.",{"type":46,"tag":383,"props":1907,"children":1908},{},[1909],{"type":46,"tag":55,"props":1910,"children":1911},{},[1912,1914,1920,1922,1928,1930,1935],{"type":52,"value":1913},"The checker is a zero-dependency static HCL reader (no ",{"type":46,"tag":84,"props":1915,"children":1917},{"className":1916},[],[1918],{"type":52,"value":1919},"terraform init",{"type":52,"value":1921},", no provider\ndownload) — it runs even when the registry is unreachable. It uses brace-depth matching\nfor nested blocks, so a valid HTTPS listener written with a nested ",{"type":46,"tag":84,"props":1923,"children":1925},{"className":1924},[],[1926],{"type":52,"value":1927},"forward { ... }",{"type":52,"value":1929},"\nblock is ",{"type":46,"tag":61,"props":1931,"children":1932},{},[1933],{"type":52,"value":1934},"not",{"type":52,"value":1936}," a false failure.",{"type":46,"tag":125,"props":1938,"children":1940},{"id":1939},"fixtures-also-the-checkers-regression-suite",[1941],{"type":52,"value":1942},"Fixtures (also the checker's regression suite)",{"type":46,"tag":55,"props":1944,"children":1945},{},[1946,1952,1954,1959,1961,1967],{"type":46,"tag":84,"props":1947,"children":1949},{"className":1948},[],[1950],{"type":52,"value":1951},"fixtures\u002Fterraform-policy\u002F",{"type":52,"value":1953}," holds ",{"type":46,"tag":61,"props":1955,"children":1956},{},[1957],{"type":52,"value":1958},"intentionally-shaped",{"type":52,"value":1960}," Terraform used by\n",{"type":46,"tag":84,"props":1962,"children":1964},{"className":1963},[],[1965],{"type":52,"value":1966},"scripts\u002Ftest_validate_terraform_policy.py",{"type":52,"value":319},{"type":46,"tag":321,"props":1969,"children":1970},{},[1971,1988,2006],{"type":46,"tag":73,"props":1972,"children":1973},{},[1974,1980,1982,1987],{"type":46,"tag":84,"props":1975,"children":1977},{"className":1976},[],[1978],{"type":52,"value":1979},"bad-http-forward\u002F",{"type":52,"value":1981}," — internet-facing ALB that forwards plaintext HTTP → MUST ",{"type":46,"tag":84,"props":1983,"children":1985},{"className":1984},[],[1986],{"type":52,"value":836},{"type":52,"value":294},{"type":46,"tag":73,"props":1989,"children":1990},{},[1991,1997,1999,2004],{"type":46,"tag":84,"props":1992,"children":1994},{"className":1993},[],[1995],{"type":52,"value":1996},"internal-alb-only\u002F",{"type":52,"value":1998}," — internal ALB on HTTP → MUST ",{"type":46,"tag":84,"props":2000,"children":2002},{"className":2001},[],[2003],{"type":52,"value":805},{"type":52,"value":2005}," (HTTP allowed internally).",{"type":46,"tag":73,"props":2007,"children":2008},{},[2009,2015,2017,2022],{"type":46,"tag":84,"props":2010,"children":2012},{"className":2011},[],[2013],{"type":52,"value":2014},"good-https-redirect\u002F",{"type":52,"value":2016}," — the correct pattern → ",{"type":46,"tag":84,"props":2018,"children":2020},{"className":2019},[],[2021],{"type":52,"value":805},{"type":52,"value":294},{"type":46,"tag":55,"props":2024,"children":2025},{},[2026,2028,2034,2036,2042,2043,2049,2051,2055],{"type":52,"value":2027},"These are deliberately non-compliant test data (never deployed). They are excluded from the\nrepo-wide ",{"type":46,"tag":84,"props":2029,"children":2031},{"className":2030},[],[2032],{"type":52,"value":2033},"checkov",{"type":52,"value":2035}," scan via ",{"type":46,"tag":84,"props":2037,"children":2039},{"className":2038},[],[2040],{"type":52,"value":2041},".checkov.yaml",{"type":52,"value":395},{"type":46,"tag":84,"props":2044,"children":2046},{"className":2045},[],[2047],{"type":52,"value":2048},"skip-path",{"type":52,"value":2050},"; do ",{"type":46,"tag":61,"props":2052,"children":2053},{},[2054],{"type":52,"value":1934},{"type":52,"value":2056}," \"harden\" them — doing so\nbreaks the tests that assert the failure paths.",{"type":46,"tag":125,"props":2058,"children":2060},{"id":2059},"verification",[2061],{"type":52,"value":2062},"Verification",{"type":46,"tag":580,"props":2064,"children":2066},{"className":582,"code":2065,"language":584,"meta":585,"style":585},"# from skills\u002Ftf-best-practices\u002F\nuv run --python 3.12 --with pytest python -m pytest scripts\u002Ftest_validate_terraform_policy.py -q\n",[2067],{"type":46,"tag":84,"props":2068,"children":2069},{"__ignoreMap":585},[2070,2079],{"type":46,"tag":591,"props":2071,"children":2072},{"class":593,"line":594},[2073],{"type":46,"tag":591,"props":2074,"children":2076},{"style":2075},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[2077],{"type":52,"value":2078},"# from skills\u002Ftf-best-practices\u002F\n",{"type":46,"tag":591,"props":2080,"children":2081},{"class":593,"line":921},[2082,2087,2092,2097,2102,2107,2112,2117,2122,2126,2131],{"type":46,"tag":591,"props":2083,"children":2084},{"style":598},[2085],{"type":52,"value":2086},"uv",{"type":46,"tag":591,"props":2088,"children":2089},{"style":616},[2090],{"type":52,"value":2091}," run",{"type":46,"tag":591,"props":2093,"children":2094},{"style":616},[2095],{"type":52,"value":2096}," --python",{"type":46,"tag":591,"props":2098,"children":2099},{"style":1168},[2100],{"type":52,"value":2101}," 3.12",{"type":46,"tag":591,"props":2103,"children":2104},{"style":616},[2105],{"type":52,"value":2106}," --with",{"type":46,"tag":591,"props":2108,"children":2109},{"style":616},[2110],{"type":52,"value":2111}," pytest",{"type":46,"tag":591,"props":2113,"children":2114},{"style":616},[2115],{"type":52,"value":2116}," python",{"type":46,"tag":591,"props":2118,"children":2119},{"style":616},[2120],{"type":52,"value":2121}," -m",{"type":46,"tag":591,"props":2123,"children":2124},{"style":616},[2125],{"type":52,"value":2111},{"type":46,"tag":591,"props":2127,"children":2128},{"style":616},[2129],{"type":52,"value":2130}," scripts\u002Ftest_validate_terraform_policy.py",{"type":46,"tag":591,"props":2132,"children":2133},{"style":616},[2134],{"type":52,"value":2135}," -q\n",{"type":46,"tag":2137,"props":2138,"children":2139},"style",{},[2140],{"type":52,"value":2141},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2143,"total":1148},[2144,2161,2175,2191,2203,2220,2238],{"slug":2145,"name":2145,"fn":2146,"description":2147,"org":2148,"tags":2149,"stars":29,"repoUrl":30,"updatedAt":2160},"agent-advisor","plan and build AWS AI agents","Unified entry point for AI-agent work on AWS: evaluate and pick a runtime, generate a full migration plan (for existing workloads), and build an executable POC — all in one flow. Triggers on: which runtime for my agent, AgentCore vs ECS vs EKS vs Lambda, AgentCore vs Lambda MicroVMs, deploy an AI agent on AWS, agent architecture on AWS, I have an agent idea what do I build, move my agents to AWS, migrate my agents to AWS with a plan, agent migration plan, add AgentCore services, add memory\u002Fgateway\u002Fidentity\u002Fpolicy to my agent, enable AgentCore Memory, add observability to my agent, I'm already on AWS and want to add agent capabilities, migrate Temporal workers to AWS, Temporal to AWS, run Temporal on AWS, Temporal workers on AWS, we use Temporal and want to move to AWS, our service is orchestrated by Temporal, what do I build on AWS for my Temporal workers, move a Temporal-based service to AWS, Temporal Cloud or self-hosted on AWS. Runs a phased flow: Intake (entry point + technical background), Discover (lightweight code detection), Clarify (adaptive questions), deterministic scoring, Design (runtime + deployment model + services + model), Estimate (coarse cost), Generate (layered recommendation doc + scaffolding), then optional gated stages: Migration Plan (full plan generated in-skill by reusing this plugin's gcp-to-aws engine, with the advisor's decisions carried over) and POC (deployment plan + deployable proof-of-concept on the recommended runtime — AgentCore, ECS, EKS, or Lambda; generated deliverables by default, or assisted build in your account on explicit opt-in). Systems with several workloads (interacting or independent agents, batch jobs, services) are decomposed into workload units, each getting its own verdict with a consolidation option. An add-capabilities branch (for teams already running agents on AWS) recommends which AgentCore services to enable on any runtime — no runtime scoring. Temporal systems dissolve into the same unit flow — worker polling tiers and Activity execution classes become units (rules in the Temporal decision reference); Workflow orchestration code is never rewritten — never a Step Functions translation. Requires at least one agentic component: a purely non-agent system (only plain services \u002F batch jobs \u002F HTTP endpoints, or a Temporal worker whose Activities are all non-agent) is out of scope — Clarify halts it (scope gate) and points to gcp-to-aws \u002F heroku-to-aws \u002F llm-to-bedrock. Not for: pure compute\u002Fdata migration with no AI agent; pure LLM SDK rewrite without agent architecture (use llm-to-bedrock); or detailed per-model pricing.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2150,2153,2156,2157],{"name":2151,"slug":2152,"type":16},"Agents","agents",{"name":2154,"slug":2155,"type":16},"AI Infrastructure","ai-infrastructure",{"name":27,"slug":28,"type":16},{"name":2158,"slug":2159,"type":16},"Engineering","engineering","2026-08-23T03:33:24.455574",{"slug":2162,"name":2162,"fn":2163,"description":2164,"org":2165,"tags":2166,"stars":29,"repoUrl":30,"updatedAt":2174},"architect-for-startups","advise on AWS architecture for startups","Startup-tailored AWS architecture advice that adjusts recommendations to the company's stage (pre-revenue through Series B+), team size, runway, and available credits. Use when a founder wants guidance or a recommendation rather than code changes: which services to choose, how to plan or review an architecture, how to stretch credits and control cost, or how to prepare architecture for a fundraise or technical diligence. For an interactive discovery flow that scaffolds and writes the architecture into the codebase, use start-building-for-startups. For AI-agent runtime selection or agentic architecture recommendations specifically, use agent-advisor. Do not use for: writing or scaffolding code, factual AWS Activate \u002F programs \u002F credits lookups (see knowledge-base-for-startups), a single copy-paste prompt (see prompt-library-for-startups), or migration intent such as GCP-to-AWS or Heroku-to-AWS (see the migration skills: `gcp-to-aws`, `heroku-to-aws`, `llm-to-bedrock`).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2167,2170,2171],{"name":2168,"slug":2169,"type":16},"Architecture","architecture",{"name":27,"slug":28,"type":16},{"name":2172,"slug":2173,"type":16},"Strategy","strategy","2026-08-20T03:27:01.975773",{"slug":401,"name":401,"fn":2176,"description":2177,"org":2178,"tags":2179,"stars":29,"repoUrl":30,"updatedAt":2190},"migrate workloads from GCP to AWS","Migrate workloads from Google Cloud Platform to AWS — including AI and agentic workloads regardless of cloud provider. Triggers on: migrate from GCP, GCP to AWS, move off Google Cloud, migrate Terraform to AWS, migrate Cloud SQL to RDS, migrate GKE to EKS, migrate Cloud Run to Fargate, migrate App Engine to Elastic Beanstalk, Google Cloud migration, migrate from OpenAI to Bedrock, move off OpenAI, switch from ChatGPT API to AWS, migrate from Gemini to Bedrock, migrate LangChain to Bedrock, migrate LangGraph to AWS, migrate agentic workloads to AWS, move AI workloads to AWS, migrate my AI app to AWS. Runs a 6-phase process: discover GCP resources from Terraform files, app code, or billing exports, clarify migration requirements, design AWS architecture, estimate costs, generate migration artifacts, and collect optional feedback. Clarify must finish before Design, Estimate, or Generate. Includes AI provider migration guidance (for example, OpenAI to Amazon Bedrock) by selecting closest-fit Bedrock model families for required modality, latency\u002Fquality targets, context windows, and cost constraints. Model mapping is compatibility-guided, not 1:1 parity; validate prompts, tool-calling behavior, and eval metrics before cutover. Do not use for: Azure or on-premises migrations to AWS, AWS-to-GCP reverse migration, general AWS architecture advice without migration intent, GCP-to-GCP refactoring, or multi-cloud deployments that do not involve migrating off GCP.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2180,2181,2184,2187],{"name":27,"slug":28,"type":16},{"name":2182,"slug":2183,"type":16},"Google Cloud","google-cloud",{"name":2185,"slug":2186,"type":16},"Infrastructure","infrastructure",{"name":2188,"slug":2189,"type":16},"Migration","migration","2026-08-20T03:27:03.999087",{"slug":409,"name":409,"fn":2192,"description":2193,"org":2194,"tags":2195,"stars":29,"repoUrl":30,"updatedAt":2202},"migrate workloads from Heroku to AWS","Migrate workloads from Heroku to AWS. Triggers on: migrate from Heroku, Heroku to AWS, move off Heroku, migrate Heroku app, migrate Heroku Postgres to RDS, migrate Heroku Redis to ElastiCache, migrate Heroku Kafka to MSK, migrate dynos to Elastic Beanstalk, migrate dynos to Fargate, Heroku migration, move from Heroku to AWS, migrate Heroku Private Space, Heroku to Elastic Beanstalk, Heroku to ECS, Heroku to Fargate, leave Heroku, migrate off Heroku platform, what-if workshop, reprice Heroku migration, compare migration scenarios, workshop mode. Runs a 6-phase process: discover Heroku resources live via the authenticated Heroku CLI (read-only, consent-gated) and\u002For from Terraform files, Procfile\u002Fapp.json, and optional billing exports, clarify migration requirements, design AWS architecture, estimate costs, generate migration artifacts, and collect optional feedback. After Estimate, an optional what-if workshop can reprice region\u002FHA\u002Fcompute\u002FGraviton scenarios without re-discovery. Clarify must finish before Design, Estimate, or Generate. Uses a flat resource model (no clustering or dependency graphs) with deterministic mapping tables for core services (Dynos → Elastic Beanstalk by default, Postgres → RDS\u002FAurora, Redis → ElastiCache, Kafka → MSK) and a fast-path table for 13+ common add-ons. Cedar\u002FFir generation detection is detect-only in v1. Pipeline\u002FReview Apps are detect-only. Do not use for: GCP or Azure migrations to AWS, AWS-to-Heroku reverse migration, general AWS architecture advice without migration intent, Heroku-to-Heroku refactoring, or multi-cloud deployments that do not involve migrating off Heroku.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2196,2197,2200,2201],{"name":27,"slug":28,"type":16},{"name":2198,"slug":2199,"type":16},"Heroku","heroku",{"name":2185,"slug":2186,"type":16},{"name":2188,"slug":2189,"type":16},"2026-08-14T04:52:09.216805",{"slug":2204,"name":2204,"fn":2205,"description":2206,"org":2207,"tags":2208,"stars":29,"repoUrl":30,"updatedAt":2219},"knowledge-base-for-startups","retrieve AWS startup reference content","AWS Startups reference content — Activate FAQ, credits guide, programs, partner offers, sample architectures, and hundreds of learn articles spanning generative AI, cloud architecture, cost optimization, security, fundraising, go-to-market, and real-world startup case studies. Use when the user asks factual questions about AWS Activate (eligibility, credits, programs, providers), wants a sample architecture or solution guide, or needs an AWS-curated learn article on a specific startup topic. For copy-paste AI prompts (RAG chatbot, MVP scaffold, security baseline, GPU quota, etc.), see the prompt-library-for-startups skill. Do not use for: account-specific lookups (credits balance, Activate membership status, application status), real-time event listings beyond the events stub, or content not present in the bundled `references\u002F` tree.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2209,2210,2213,2216],{"name":27,"slug":28,"type":16},{"name":2211,"slug":2212,"type":16},"Cloud","cloud",{"name":2214,"slug":2215,"type":16},"Documentation","documentation",{"name":2217,"slug":2218,"type":16},"Research","research","2026-08-23T03:33:23.478898",{"slug":2221,"name":2221,"fn":2222,"description":2223,"org":2224,"tags":2225,"stars":29,"repoUrl":30,"updatedAt":2237},"llm-to-bedrock","migrate LLM calls to Amazon Bedrock","Use when the user wants to migrate code that calls OpenAI, Gemini\u002FGoogle AI, or the Anthropic API to Amazon Bedrock — a pure model\u002FSDK rewrite. End-to-end: assesses the codebase, then rewrites SDK calls, evaluates output quality against Bedrock, and delivers a ready-to-merge git branch. Not for: agent runtime selection, agentic architecture decisions, or agent migration planning — use agent-advisor for those. Not for standalone Bedrock cost estimates or infrastructure-only migration. The Assess phase is handled by this plugin's own gcp-to-aws skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2226,2227,2230,2233,2234],{"name":27,"slug":28,"type":16},{"name":2228,"slug":2229,"type":16},"Gemini","gemini",{"name":2231,"slug":2232,"type":16},"LLM","llm",{"name":2188,"slug":2189,"type":16},{"name":2235,"slug":2236,"type":16},"OpenAI","openai","2026-08-14T04:51:58.393797",{"slug":2239,"name":2239,"fn":2240,"description":2241,"org":2242,"tags":2243,"stars":29,"repoUrl":30,"updatedAt":2250},"prompt-library-for-startups","provide AI coding prompts for startups","AWS-curated copy-paste prompts for AI coding agents (MVP scaffolding, RAG chatbot with Claude on Bedrock, security baseline evaluation, cost anomaly detection, GPU quota requests, EKS deployment, Well-Architected review, etc.) plus downloadable installable agents (Multi-Account Transition Advisor, Bill Shock Preventer, Service Quota Agent, Bedrock Model Availability Agent, AWS DB Advisor). Use when the user asks for a prompt to do X on AWS, wants an installable agent for multi-account \u002F cost monitoring \u002F quota management \u002F Bedrock model availability \u002F database selection, or asks how to use AWS prompts. For migration intent (GCP to AWS, OpenAI\u002FGemini to Bedrock), route to the migration skills in this plugin (`gcp-to-aws`, `heroku-to-aws`, `llm-to-bedrock`). Do not use for: factual AWS Activate \u002F programs \u002F credits questions, learn articles, sample architectures, or for prompts that are not in the bundled `references\u002Fprompt-library\u002F` tree.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2244,2245,2248,2249],{"name":27,"slug":28,"type":16},{"name":2246,"slug":2247,"type":16},"Coding","coding",{"name":2158,"slug":2159,"type":16},{"name":2231,"slug":2232,"type":16},"2026-08-14T04:27:16.118669",{"items":2252,"total":2428},[2253,2272,2293,2303,2314,2327,2337,2347,2368,2383,2398,2413],{"slug":2254,"name":2254,"fn":2255,"description":2256,"org":2257,"tags":2258,"stars":2269,"repoUrl":2270,"updatedAt":2271},"agentcore-investigation","investigate Bedrock AgentCore runtime sessions","Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session\u002Ftrace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2259,2260,2263,2266],{"name":27,"slug":28,"type":16},{"name":2261,"slug":2262,"type":16},"Debugging","debugging",{"name":2264,"slug":2265,"type":16},"Logs","logs",{"name":2267,"slug":2268,"type":16},"Observability","observability",9427,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fmcp","2026-07-12T08:37:22.601527",{"slug":2273,"name":2274,"fn":2275,"description":2276,"org":2277,"tags":2278,"stars":2269,"repoUrl":2270,"updatedAt":2292},"amazon-aurora-dsql","amazon aurora dsql","build applications with Aurora DSQL","Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK replacement code generation, OCC retry patterns, ORM migration (Django\u002FHibernate\u002FRails), DDL operations, query plan explainability, SQL compatibility validation, and bulk data loading. Triggers on phrases like: DSQL, Aurora DSQL, create DSQL table, DSQL schema, migrate to DSQL, distributed SQL database, serverless PostgreSQL-compatible database, DSQL query plan, DSQL EXPLAIN ANALYZE, why is my DSQL query slow, DSQL foreign key, DSQL OCC retry, DSQL multi-region, load into DSQL, load CSV into DSQL, bulk load DSQL, aurora-dsql-loader.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2279,2282,2283,2286,2289],{"name":2280,"slug":2281,"type":16},"Aurora","aurora",{"name":27,"slug":28,"type":16},{"name":2284,"slug":2285,"type":16},"Database","database",{"name":2287,"slug":2288,"type":16},"Serverless","serverless",{"name":2290,"slug":2291,"type":16},"SQL","sql","2026-08-04T05:35:10.770847",{"slug":2294,"name":2295,"fn":2275,"description":2276,"org":2296,"tags":2297,"stars":2269,"repoUrl":2270,"updatedAt":2302},"aurora-dsql","aurora dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2298,2299,2300,2301],{"name":27,"slug":28,"type":16},{"name":2284,"slug":2285,"type":16},{"name":2287,"slug":2288,"type":16},{"name":2290,"slug":2291,"type":16},"2026-08-04T05:35:05.694395",{"slug":2304,"name":2305,"fn":2275,"description":2276,"org":2306,"tags":2307,"stars":2269,"repoUrl":2270,"updatedAt":2313},"aws-dsql","aws dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2308,2309,2310,2311,2312],{"name":27,"slug":28,"type":16},{"name":2284,"slug":2285,"type":16},{"name":2188,"slug":2189,"type":16},{"name":2287,"slug":2288,"type":16},{"name":2290,"slug":2291,"type":16},"2026-08-04T05:35:08.749669",{"slug":2315,"name":2316,"fn":2275,"description":2276,"org":2317,"tags":2318,"stars":2269,"repoUrl":2270,"updatedAt":2326},"distributed-postgres","distributed postgres",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2319,2320,2321,2324,2325],{"name":27,"slug":28,"type":16},{"name":2284,"slug":2285,"type":16},{"name":2322,"slug":2323,"type":16},"PostgreSQL","postgresql",{"name":2287,"slug":2288,"type":16},{"name":2290,"slug":2291,"type":16},"2026-08-04T05:35:06.713102",{"slug":2328,"name":2329,"fn":2275,"description":2276,"org":2330,"tags":2331,"stars":2269,"repoUrl":2270,"updatedAt":2336},"distributed-sql","distributed sql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2332,2333,2334,2335],{"name":27,"slug":28,"type":16},{"name":2284,"slug":2285,"type":16},{"name":2287,"slug":2288,"type":16},{"name":2290,"slug":2291,"type":16},"2026-08-04T05:35:10.086942",{"slug":2338,"name":2338,"fn":2275,"description":2276,"org":2339,"tags":2340,"stars":2269,"repoUrl":2270,"updatedAt":2346},"dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2341,2342,2343,2344,2345],{"name":27,"slug":28,"type":16},{"name":2284,"slug":2285,"type":16},{"name":2188,"slug":2189,"type":16},{"name":2287,"slug":2288,"type":16},{"name":2290,"slug":2291,"type":16},"2026-08-04T05:35:07.751779",{"slug":2348,"name":2348,"fn":2349,"description":2350,"org":2351,"tags":2352,"stars":2365,"repoUrl":2366,"updatedAt":2367},"cost-efficiency-analyzer","analyze cost efficiency and expenses","Analyzes cost structure, cost efficiency, and expense management from P&L data. Use when the user asks about costs, expenses, COGS, operating expenses, cost ratios, cost control, spending efficiency, margin compression from cost side, or wants to understand where money is going. Also use for \"are we spending too much\", \"cost breakdown\", \"expense analysis\", or \"how efficient are our operations\". NOT for revenue or top-line analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2353,2356,2359,2362],{"name":2354,"slug":2355,"type":16},"Accounting","accounting",{"name":2357,"slug":2358,"type":16},"Analytics","analytics",{"name":2360,"slug":2361,"type":16},"Cost Optimization","cost-optimization",{"name":2363,"slug":2364,"type":16},"Finance","finance",3176,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentcore-samples","2026-07-12T08:40:03.29555",{"slug":2369,"name":2369,"fn":2370,"description":2371,"org":2372,"tags":2373,"stars":2365,"repoUrl":2366,"updatedAt":2382},"executive-financial-briefing","generate executive financial briefings","Generates a concise executive-level financial briefing or summary suitable for a CEO, CFO, or board presentation. Use when the user asks for a summary, briefing, executive summary, board update, financial overview, financial health check, or \"how is the business doing\". Covers the full P&L picture in one page. Also use for \"give me the highlights\", \"what do I need to know\", or \"quick financial update\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2374,2375,2376,2379],{"name":27,"slug":28,"type":16},{"name":2363,"slug":2364,"type":16},{"name":2377,"slug":2378,"type":16},"Management","management",{"name":2380,"slug":2381,"type":16},"Reporting","reporting","2026-07-12T08:40:02.066471",{"slug":2384,"name":2384,"fn":2385,"description":2386,"org":2387,"tags":2388,"stars":2365,"repoUrl":2366,"updatedAt":2397},"multi-quarter-trend-analysis","analyze multi-quarter financial trends","Analyzes financial trends across multiple quarters by comparing P&L metrics over time. Use when the user wants to see trends, patterns, trajectories, or directional movement across 3 or more quarters. Also use for \"how are we trending\", \"show me the trend\", \"track performance over time\", \"quarter over quarter comparison across all quarters\", or any multi-period longitudinal analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2389,2390,2391,2394],{"name":2357,"slug":2358,"type":16},{"name":2363,"slug":2364,"type":16},{"name":2392,"slug":2393,"type":16},"Financial Statements","financial-statements",{"name":2395,"slug":2396,"type":16},"Variance Analysis","variance-analysis","2026-07-12T08:40:00.79141",{"slug":2399,"name":2399,"fn":2400,"description":2401,"org":2402,"tags":2403,"stars":2365,"repoUrl":2366,"updatedAt":2412},"pdf","process and manipulate PDF documents","Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text\u002Ftables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting\u002Fdecrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2404,2407,2410],{"name":2405,"slug":2406,"type":16},"Automation","automation",{"name":2408,"slug":2409,"type":16},"Documents","documents",{"name":2411,"slug":2399,"type":16},"PDF","2026-07-12T08:41:44.135656",{"slug":2414,"name":2414,"fn":2415,"description":2416,"org":2417,"tags":2418,"stars":2365,"repoUrl":2366,"updatedAt":2427},"quarterly-kpi-calculator","calculate quarterly financial KPIs","Calculates quarterly financial KPIs from P&L data. P&L figures can be provided directly by the user or fetched from the financial data MCP server. Use when the user wants KPI calculations such as Gross Margin %, EBITDA Margin %, Operating Expense Ratio, or Revenue Growth % QoQ. Also use for quarterly performance review, P&L analysis, or interpreting financial ratios against benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2419,2420,2423,2424],{"name":2354,"slug":2355,"type":16},{"name":2421,"slug":2422,"type":16},"Data Analysis","data-analysis",{"name":2363,"slug":2364,"type":16},{"name":2425,"slug":2426,"type":16},"KPI","kpi","2026-07-12T08:39:59.54971",128]