How do I install the Maintain AWS skill?

Run npx skillmds@latest add devantler-tech/maintain-aws in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Maintain AWS safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Maintain AWS?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Maintain AWS free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Maintain AWS?

devantler-tech (@devantler-tech) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Maintain AWS by devantler-tech — Agent Skill

Name: Maintain AWS
Author: devantler-tech

Maintain AWS

Product card for devantler-tech/aws, the AWS config tenant — desired AWS state as Crossplane managed resources, published as a cosign-signed OCI artifact that the platform's aws tenant reconciles. Use when the Agentic Engineer selects aws.

File contents

Maintain: AWS config tenant

The canonical maintenance procedure lives in the ## Maintenance section of applications/aws/AGENTS.md on the submodule's latest main: https://github.com/devantler-tech/aws/blob/main/AGENTS.md.

Shared cross-repository rules are in the monorepo AGENTS.md. This card is a thin pointer by design so the product contract remains authoritative for every engineering tool.

Validate before every PR: kubectl kustomize deploy/ > /dev/null — what CI runs. Crossplane CRD semantics are validated on-cluster, never here. No credential or provider config belongs in this repository: authentication is provisioned platform-side, so anything credential-shaped in a manifest is a bug to remove, never a value to rotate.

Two halves, two repositories. This repo holds only the desired AWS state under deploy/, namespace-agnostic because the platform-side tenant injects the namespace. The platform holds the tenant wiring — namespace, SecretStore, bootstrap-credential ExternalSecret, ProviderConfig, and the Flux OCIRepository + Kustomization that verifies the cosign signature. A change that needs both lands as two PRs, the platform half first whenever the tenant must be able to consume the new artifact. The signing identity the platform verifies is the shared publish-manifests.yaml workflow path in devantler-tech/actions, so relocating that workflow is a platform verifier change as well.

Roadmap & enhancement

The roadmap lives in GitHub Issues on devantler-tech/aws. Advance it with product-engineering: the AWS resources the platform actually depends on, validation depth, and release hygiene. The site lists this repository as platform infrastructure (infra in the Active Projects submodule marker), not as a public project.

---name: maintain-awsdescription: Product card for devantler-tech/aws, the AWS config tenant — desired AWS state as Crossplane managed resources, published as a cosign-signed OCI artifact that the platform's aws tenant reconciles. Use when the Agentic Engineer selects aws.---# Maintain: AWS config tenantThe canonical maintenance procedure lives in the **`## Maintenance`** section of`applications/aws/AGENTS.md` on the submodule's latest `main`:<https://github.com/devantler-tech/aws/blob/main/AGENTS.md>.Shared cross-repository rules are in the monorepo [`AGENTS.md`](../../../../AGENTS.md). This card is athin pointer by design so the product contract remains authoritative for every engineering tool.**Validate before every PR:** `kubectl kustomize deploy/ > /dev/null` — what CI runs. Crossplane CRDsemantics are validated on-cluster, never here. **No credential or provider config belongs in thisrepository**: authentication is provisioned platform-side, so anything credential-shaped in a manifestis a bug to remove, never a value to rotate.**Two halves, two repositories.** This repo holds only the desired AWS state under `deploy/`,namespace-agnostic because the platform-side tenant injects the namespace. The[platform](../platform/SKILL.md) holds the tenant wiring — namespace, `SecretStore`,bootstrap-credential `ExternalSecret`, `ProviderConfig`, and the Flux `OCIRepository` +`Kustomization` that verifies the cosign signature. A change that needs both lands as two PRs, theplatform half first whenever the tenant must be able to consume the new artifact. The signingidentity the platform verifies is the shared `publish-manifests.yaml` workflow path in`devantler-tech/actions`, so relocating that workflow is a platform verifier change as well.## Roadmap & enhancementThe roadmap lives in **GitHub Issues** on `devantler-tech/aws`. Advance it with[`product-engineering`](../../product-engineering/SKILL.md): the AWS resources the platform actuallydepends on, validation depth, and release hygiene. The site lists this repository as platforminfrastructure (`infra` in the Active Projects submodule marker), not as a public project.

Frequently asked questions