AWS Specialist
Structured investigation for AWS workloads. Five phases: gather context,
diagnose, design, recommend, verify.
Arguments
$0 — account context, service scope, or problem description. Required.
Phase 1: Context Gathering
- Identify the account(s), region(s), and services in scope.
- Glob for IaC in the working directory:
**/*.tf, **/*.yaml (SAM/CloudFormation), **/cdk.json, **/template.yaml.
- If AWS CLI access is available:
aws sts get-caller-identity
aws configure list
- Note the service scope (e.g. "EKS cluster + VPC + IAM" vs "Lambda + API Gateway + DynamoDB"). Scope commands to the relevant resource types.
Phase 2: Diagnosis
Compute / containers:
aws ec2 describe-instances --filters Name=instance-state-name,Values=running
aws ecs list-services --cluster <name>
aws eks describe-cluster --name <name>
IAM / identity:
aws iam list-policies --scope Local
aws iam get-role --role-name <role>
aws iam simulate-principal-policy --policy-source-arn <arn> --action-names <action>
Networking:
aws ec2 describe-vpcs
aws ec2 describe-route-tables
aws ec2 describe-security-groups
Serverless / events:
aws lambda list-functions
aws lambda get-function-configuration --function-name <name>
aws apigateway get-rest-apis
Cost / quotas:
aws service-quotas list-service-quotas --service-code ec2
aws ce get-cost-and-usage --time-period Start=<>,End=<> --granularity DAILY --metrics UnblendedCost
Phase 3: Design / Root-Cause Analysis
Map symptoms to causes:
| Symptom |
Common Causes |
Check |
| 5xx from ALB |
Unhealthy targets, timeout mismatch, HTTP/S misrouting |
Target group health, ALB access logs |
| Lambda throttled |
Reserved concurrency, account-wide limit |
aws lambda get-function-concurrency |
| EKS pod IAM fails |
Missing IRSA, ServiceAccount annotation |
OIDC provider + trust policy on role |
| S3 AccessDenied |
Bucket policy, SCP, VPC endpoint policy |
Use aws s3api get-bucket-policy + IAM simulator |
| RDS CPU spike |
Missing indexes, connection storm, runaway query |
Performance Insights, slow query log |
| CloudFront caching miss |
Incorrect cache key, missing Cache-Control |
Check behaviors + origin headers |
Cite resource ARN or file:line for every finding.
Phase 4: Recommendations
Output findings in priority order:
[CRITICAL] <title>
Resource: <ARN or file:line>
Issue: <one sentence>
Evidence: <CLI output or code snippet>
Fix: <specific change, with IaC diff if applicable>
Trade-off: <alternative and its downside, if meaningful>
- Order: CRITICAL → WARNING → INFO.
- For IaC fixes, show the exact Terraform/CDK/CloudFormation diff.
- Reference relevant docs in
references/ where applicable.
Phase 5: Verification
After fixes are applied:
- Re-run the diagnostic command that surfaced the issue.
- For IAM changes:
aws iam simulate-principal-policy with the exact action and resource.
- For networking changes:
aws ec2 describe-route-tables or VPC Reachability Analyzer.
- For serverless changes: invoke a test event via
aws lambda invoke or API Gateway test console.
- Check CloudWatch metrics and alarms — no new alarms should be triggering.
Reference Docs
Consult references/ for decision guides:
| File |
When to use |
compute.md |
EC2, ECS, EKS selection and sizing |
serverless.md |
Lambda, API Gateway, EventBridge, SQS, SNS |
storage.md |
S3, EBS, EFS, RDS, DynamoDB |
networking.md |
VPC, ALB/NLB, Route53, CloudFront, PrivateLink |
iam.md |
Policies, roles, SCPs, permission boundaries |
observability.md |
CloudWatch, X-Ray, Container Insights |
iac-patterns.md |
CloudFormation, CDK, SAM patterns |
1---2name: aws-specialist3description: Deep-dive AWS architecture review, debugging, and service design. Use for structured investigations of AWS-specific issues, cost or IAM audits, and multi-service design reviews. Triggers on: "AWS audit", "AWS design review", "IAM review", "cost audit AWS", "review my VPC", "AWS troubleshooting", "Lambda deep-dive".4---56# AWS Specialist78Structured investigation for AWS workloads. Five phases: gather context,9diagnose, design, recommend, verify.1011## Arguments1213- `$0` — account context, service scope, or problem description. Required.1415---1617## Phase 1: Context Gathering18191. Identify the account(s), region(s), and services in scope.202. Glob for IaC in the working directory: `**/*.tf`, `**/*.yaml` (SAM/CloudFormation), `**/cdk.json`, `**/template.yaml`.213. If AWS CLI access is available:22 ```bash23 aws sts get-caller-identity24 aws configure list25 ```264. Note the service scope (e.g. "EKS cluster + VPC + IAM" vs "Lambda + API Gateway + DynamoDB"). Scope commands to the relevant resource types.2728---2930## Phase 2: Diagnosis3132**Compute / containers:**3334```bash35aws ec2 describe-instances --filters Name=instance-state-name,Values=running36aws ecs list-services --cluster <name>37aws eks describe-cluster --name <name>38```3940**IAM / identity:**4142```bash43aws iam list-policies --scope Local44aws iam get-role --role-name <role>45aws iam simulate-principal-policy --policy-source-arn <arn> --action-names <action>46```4748**Networking:**4950```bash51aws ec2 describe-vpcs52aws ec2 describe-route-tables53aws ec2 describe-security-groups54```5556**Serverless / events:**5758```bash59aws lambda list-functions60aws lambda get-function-configuration --function-name <name>61aws apigateway get-rest-apis62```6364**Cost / quotas:**6566```bash67aws service-quotas list-service-quotas --service-code ec268aws ce get-cost-and-usage --time-period Start=<>,End=<> --granularity DAILY --metrics UnblendedCost69```7071---7273## Phase 3: Design / Root-Cause Analysis7475Map symptoms to causes:7677| Symptom | Common Causes | Check |78| ----------------------- | ------------------------------------------------------ | ------------------------------------------------- |79| 5xx from ALB | Unhealthy targets, timeout mismatch, HTTP/S misrouting | Target group health, ALB access logs |80| Lambda throttled | Reserved concurrency, account-wide limit | `aws lambda get-function-concurrency` |81| EKS pod IAM fails | Missing IRSA, ServiceAccount annotation | OIDC provider + trust policy on role |82| S3 AccessDenied | Bucket policy, SCP, VPC endpoint policy | Use `aws s3api get-bucket-policy` + IAM simulator |83| RDS CPU spike | Missing indexes, connection storm, runaway query | Performance Insights, slow query log |84| CloudFront caching miss | Incorrect cache key, missing `Cache-Control` | Check behaviors + origin headers |8586Cite resource ARN or `file:line` for every finding.8788---8990## Phase 4: Recommendations9192Output findings in priority order:9394```95[CRITICAL] <title>96Resource: <ARN or file:line>97Issue: <one sentence>98Evidence: <CLI output or code snippet>99Fix: <specific change, with IaC diff if applicable>100Trade-off: <alternative and its downside, if meaningful>101```102103- Order: CRITICAL → WARNING → INFO.104- For IaC fixes, show the exact Terraform/CDK/CloudFormation diff.105- Reference relevant docs in `references/` where applicable.106107---108109## Phase 5: Verification110111After fixes are applied:1121131. Re-run the diagnostic command that surfaced the issue.1142. For IAM changes: `aws iam simulate-principal-policy` with the exact action and resource.1153. For networking changes: `aws ec2 describe-route-tables` or VPC Reachability Analyzer.1164. For serverless changes: invoke a test event via `aws lambda invoke` or API Gateway test console.1175. Check CloudWatch metrics and alarms — no new alarms should be triggering.118119---120121## Reference Docs122123Consult `references/` for decision guides:124125| File | When to use |126| ------------------ | ---------------------------------------------- |127| `compute.md` | EC2, ECS, EKS selection and sizing |128| `serverless.md` | Lambda, API Gateway, EventBridge, SQS, SNS |129| `storage.md` | S3, EBS, EFS, RDS, DynamoDB |130| `networking.md` | VPC, ALB/NLB, Route53, CloudFront, PrivateLink |131| `iam.md` | Policies, roles, SCPs, permission boundaries |132| `observability.md` | CloudWatch, X-Ray, Container Insights |133| `iac-patterns.md` | CloudFormation, CDK, SAM patterns |
kaiohenricunha