Infrastructure as Code Agent Skills

Provides technical leadership frameworks for architecture decisions, engineering team scaling, technology strategy, and technical debt assessment.

Generates CI/CD pipelines, Terraform modules, and Kubernetes deployment manifests with health-check gates and rollback support for AWS, GCP, and Azure.

Finds the least-privilege Azure RBAC role for an identity, generates CLI commands and Bicep code to assign it, and provides guidance on permissions needed to grant roles.

Generate infrastructure code (Bicep/Terraform), azure.yaml, and Dockerfiles for Azure deployment, with a mandatory planning workflow.

Architect and provision enterprise Azure infrastructure from workload descriptions, generating Bicep or Terraform for networking, identity, security, and multi-resource topologies aligned with the Well-Architected Framework.

Manage AWS infrastructure as code with CloudFormation templates, stacks, change sets, and nested stacks.

Design, build, and manage AWS Step Functions state machines for serverless workflow orchestration, including error handling, parallel execution, and integration with AWS services.

Enable, disable, or change the role of USB2/USB3 SS ports on Jetson custom carriers by generating kernel-DT overlays that flip lane, port, and host xHCI phys in lockstep.

Generates kernel device-tree overlay fragments to enable or disable individual PCIe controllers and configure lane count and link speed on Jetson Thor/Orin custom carriers.

Checks and installs NVIDIA driver, CUDA Toolkit, and NVIDIA Container Toolkit for GPU-accelerated Docker and Kubernetes hosts. Supports multiple Linux distributions with automated install and read-only check modes.

Review Cisco IOS and IOS-XE configurations, choose read-only show commands, check ACL wildcard masks and interface direction, and build safe change-window verification checklists.

Provides guidance and patterns for AWS development, infrastructure automation, and cloud architecture.

Deploys a secure, enterprise-grade Google Cloud landing zone foundation with organization policies, resource hierarchy, billing association, and centralized logging and monitoring.

Build and manage applications on the Cloudflare platform, including Workers, Pages, storage, AI, networking, security, and infrastructure-as-code.

Guides users through a structured, conversational process to generate a production-ready Terraform stack and OCI Resource Manager schema for OKE clusters on Oracle Cloud Infrastructure.

Create, modify, review, and harden configuration for the Adobe Dispatcher Apache HTTP Server module and Apache HTTPD in AEM 6.5 LTS environments only.

Provides advisory guidance for the Adobe Dispatcher Apache HTTP Server module and related HTTPD configuration in AEM 6.5 / AMS workflows, with public-doc citations and AMS-specific MCP verification plans.

Detects outbound HTTP clients constructed without explicit timeouts in AEM Cloud Service code and applies mechanical fixes with CSO-aligned defaults to prevent request-thread pool saturation.

Analyze Azure resources and IaC files to identify cost optimization opportunities, calculate savings, and create GitHub issues for tracking.

Reviews AWS infrastructure as code and deployed resources against the Well-Architected Framework, generating findings and GitHub issues for remediation.

Update Azure Verified Modules (AVM) to their latest versions in Bicep files, with support for non-breaking changes and manual review for breaking changes.

Import existing Azure resources into Terraform using Azure CLI discovery and Azure Verified Modules (AVM).

Guides scaling decisions for Qdrant vector databases when data volume exceeds single-node capacity, covering tenant scaling, time window rotation, vertical scaling, and horizontal sharding.

Analyze Terraform plan JSON output for AzureRM Provider to distinguish between false-positive diffs (order-only changes in Set-type attributes) and actual resource changes.

Guides the configuration of pfSense firewall rules, NAT policies, VPN tunnels, and traffic shaping to enforce network segmentation and protect network zones.

Enforces identity-based network access with 802.1X, RADIUS authentication, dynamic VLAN assignment, and endpoint posture assessment using PacketFence.

Deploy and configure Tofino industrial firewalls to protect SCADA systems and PLCs using deep packet inspection for OT protocols including Modbus, EtherNet/IP, OPC, and S7comm, enforcing granular access control between ICS security zones.

Deploy and configure Tailscale as a WireGuard-based zero trust mesh VPN with identity-aware access controls, ACLs, and exit nodes for secure peer-to-peer connectivity.

Deliberately disables or degrades security controls to verify detection and response capabilities, including WAF bypass, firewall rule removal, log pipeline disruption, and EDR disablement scenarios using boto3 and subprocess.

Design and implement network segmentation in Operational Technology environments using VLANs, industrial firewalls, data diodes, and software-defined networking, following the Purdue Model and IEC 62443 standards.

Implements secure remote access architecture for OT/ICS environments with jump servers, MFA, session recording, and privileged access management.

Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration.

Configure IAM permission boundaries in AWS to delegate role creation to developers while enforcing maximum privilege limits set by the security team.

Design and implement Privileged Access Workstations (PAWs) with device hardening, just-in-time access, and integration with CyberArk or BeyondTrust for secure administrative operations.

Harden Kubernetes Role-Based Access Control by implementing least-privilege policies, auditing role bindings, eliminating cluster-admin sprawl, and integrating external identity providers.

Centralize secrets management with HashiCorp Vault, including dynamic secret generation, transit encryption, PKI certificate management, and Kubernetes integration.