Cloud Platforms Agent Skills

Automate credential rotation for service accounts across Active Directory, cloud platforms, and application databases to eliminate stale secrets and reduce compromise risk.

Establish SAML 2.0 identity federation between on-premises Active Directory and Azure AD (Microsoft Entra ID) for cross-domain authentication and SSO to cloud applications.

Implement Google's BeyondCorp zero trust access model to eliminate implicit trust from the network perimeter, enforce identity-aware access controls using IAP, Access Context Manager, and Chrome Enterprise Premium for VPN-less secure application access.

Audit Google Cloud Platform environments for security misconfigurations using Forseti, Security Command Center, and gcloud CLI to evaluate IAM policies, firewall rules, storage permissions, and CIS compliance.

Configure Google Cloud Identity-Aware Proxy (IAP) to enforce per-request identity verification for Compute Engine, App Engine, Cloud Run, and GKE services using access levels, context-aware policies, and programmatic access with service accounts.

Enforce security guardrails across GCP resource hierarchy by configuring organization policy constraints to restrict risky configurations and ensure compliance at organization, folder, and project levels.

Execute cloud-native incident containment across AWS, Azure, and GCP by isolating compromised resources, revoking credentials, preserving forensic evidence, and applying security group restrictions to prevent lateral movement.

Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions using the azure-mgmt-storage Python SDK.

Configure Microsoft Entra ID (Azure AD) Conditional Access policies for zero trust access control, covering signal-based policy design, device compliance, risk-based authentication, named locations, session controls, and NIST SP 1800-35 integration.

Map cloud infrastructure assets and relationships into a Neo4j graph using Cartography to discover attack paths, IAM permission chains, and security gaps across AWS, GCP, and Azure.

Deploy CyberArk Secure Cloud Access to eliminate standing privileges in hybrid and multi-cloud environments using just-in-time access with time, entitlement, and approval controls.

Continuously monitor cloud infrastructure for misconfigurations, compliance violations, and security risks using AWS Security Hub, Azure Defender for Cloud, and open-source tools like Prowler and ScoutSuite.

Enumerate AWS resources and identify misconfigurations using ScoutSuite to generate interactive security reports.

Enumerate and audit GCP storage buckets and IAM policies using GCPBucketBrute and gcloud CLI to identify privilege escalation paths and overly permissive access.

Design scalable distributed systems using structured approaches for load balancing, caching, database scaling, and message queues.

Scaffolds an isolated cloud development box per agent using Crabbox and Daytona, with its own database, dev server, and in-box browser for parallel testing without port or state collisions.

Designs cloud architectures, creates migration plans, generates cost optimization recommendations, and produces disaster recovery strategies across AWS, Azure, and GCP.

Run ML workloads on Modal's serverless GPU cloud platform with auto-scaling, pay-per-second pricing, and Python-native infrastructure.

Manage and use Lambda Labs GPU cloud instances for ML training and inference with SSH access, persistent filesystems, and multi-node clusters.

Provides guidance on enabling and optimizing GKE Cluster Autoscaler, including Node Auto Provisioning, troubleshooting scale-up/down issues, and best practices for capacity management.

Sets up an isolated Python environment for SageMaker and AWS work, pinning Python version and installing current boto3/awscli to avoid dependency conflicts and stale SDKs.

Reads the local AWS configuration to determine the active profile, region, account ID, and caller identity before any AWS task, avoiding guesswork and preventing common deployment errors.

Plans and coordinates the deployment of a model to Amazon SageMaker AI, selecting the appropriate pathway (real-time, serverless, async, batch, or Bedrock CMI) based on model type, traffic, latency, and cost constraints.

Creates SageMaker endpoints (real-time or async) with autoscaling, CloudWatch alarms, and tagging enabled by default, then smoke-tests them before declaring success.

Provides a comprehensive reference and usage guide for the rclone command-line cloud storage manager, covering configuration, core commands, filtering, and safety practices.

Authorized security assessment for cloud, container, and Kubernetes environments covering metadata SSRF, IAM misconfigurations, container escape paths, and cluster RBAC review.

Guides users through installing dbt Core or the dbt Cloud CLI and points to official dbt documentation and community resources.

Sets up an AWS S3 MCP server using the AWS SDK for JavaScript, with installation and documentation links.

Guides setting up a Node.js project that uses the AWS SDK for JavaScript (v3) to interact with DynamoDB, including installation and basic usage.

Install the rpk CLI on macOS, Linux, or Docker, and configure profiles, connection settings, SASL/TLS credentials, and Enterprise licenses for Redpanda clusters.

Manage Redpanda topics and produce or consume records from the CLI using the `rpk topic` command group. Use when creating or deleting topics with custom partitions, replication, or configs; altering topic configs or retention; adding partitions; trimming or deleting records; or using `rpk topic produce`/`consume` with.

Operate Redpanda through its Kafka-compatible API: produce and consume records, manage topics and consumer groups, run transactions, and configure tiered storage using rpk and Kafka clients.

Manage schemas, subjects, compatibility levels, modes, and contexts in the Redpanda Schema Registry via the rpk registry CLI. Register or fetch Avro, Protobuf, and JSON schemas, set compatibility levels, change registry mode, and work with schema contexts.

Manage Redpanda authentication and authorization from the CLI using the `rpk security` command group, covering SASL/SCRAM users, Kafka ACLs, RBAC roles, and Cloud secrets.

Provisions and manages Redpanda Cloud Dedicated clusters via the Control Plane API, covering network and cluster creation, polling operations, and connectivity configuration.

Provisions and manages Redpanda Cloud Serverless clusters via the public Control Plane API, including authentication, cluster lifecycle, and data-plane operations.