.Agent

Reusable Terraform modules and CDK constructs for VPC, EKS, RDS, and IAM

Foundation → Platform → Workloads separation with cross-stack references and state isolation

Enforce infrastructure policies with OPA/Conftest, Checkov, and SCPs

Implement budget alerts, instance restrictions, and tag-based cost allocation

PR-driven infrastructure changes with plan previews, approval gates, and OIDC authentication

Implement automated secrets rotation with AWS Secrets Manager, Lambda rotators, and SSM Parameter Store

Multi-region DR patterns with automated failover, backup strategies, and RTO/RPO targets

Implement mandatory tagging for cost allocation, security ownership, and compliance with enforceable policies

Same code for dev/staging/prod with configuration-only differences

Keyless authentication for CI/CD pipelines and Kubernetes pod identity with IRSA

Implement least privilege IAM policies with scoped permissions, permission boundaries, and IRSA for Kubernetes

Implement VPC segmentation with IPAM integration, dual-stack IPv4/IPv6, and multi-tenant isolation patterns

State isolation patterns by environment, account, and domain to reduce blast radius

Store secrets in AWS Secrets Manager or Parameter Store, never hardcode credentials in code or IaC

Replace infrastructure instead of modifying it in place for predictable, reliable deployments