STANDARD OPERATING PROCEDURE
Purpose
Provide AWS-focused design, implementation, and tuning across networking, IAM, data, observability, and cost controls.
Trigger Conditions
- Positive: AWS deployment or migration; AWS performance or cost optimization; AWS security/guardrail setup
- Negative: Multi-cloud portfolio (route to cloud-platforms); Kubernetes cluster asks (route to kubernetes-specialist); App-level performance triage (route to performance-analysis)
Guardrails
- Structure-first: keep SKILL.md aligned with examples/, tests/, and any resources/references so downstream agents always have scaffolding.
- Adversarial validation is mandatory: cover boundary cases, failure paths, and rollback drills before declaring the SOP complete.
- Prompt hygiene: separate hard vs. soft vs. inferred constraints and confirm inferred constraints before acting.
- Explicit confidence ceilings: format as 'Confidence: X.XX (ceiling: TYPE Y.YY)' and never exceed the ceiling for the claim type.
- MCP traceability: tag sessions WHO=operations-{name}-{session_id}, WHY=skill-execution, and capture evidence links in outputs.
- Avoid anti-patterns: undocumented changes, missing rollback paths, skipped tests, or unbounded automation without approvals.
Required Artifacts
- SKILL.md (this SOP)
- metadata.json for registry details
Execution Phases
Baseline the AWS environment
- Map accounts/OUs, workloads, and regulatory constraints
- Identify current guardrails (SCPs, IAM boundaries, Config rules)
- Select relevant AWS services and regions
Design service architecture
- Define VPC/network topology, IAM roles, and data storage patterns
- Plan observability (CloudWatch/OTel), backup, and DR
- Outline deployment pipelines and artifact strategy
Implement and tune
- Codify infrastructure via IaC with peer review
- Apply performance and cost levers (autoscaling, savings plans, storage classes)
- Enable security controls (KMS, GuardDuty, Inspector) with alerts
Validate and hand off
- Execute security/performance checks and capture evidence
- Verify drift detection and backups
- Document runbooks, ownership, and escalation
Output Format
- AWS architecture diagram and account/OU map
- Service configuration plan (VPC, IAM, storage, data protection)
- Change set or IaC notes with review status
- Validation results (CIS/security, performance, cost) with links
- Runbook updates with alarms, dashboards, and on-call paths
Validation Checklist
- Least-privilege IAM and network boundaries reviewed
- Data residency, backup, and DR patterns documented
- Observability and alarm coverage confirmed
- Tests or checks executed for changes and dependencies
- Confidence ceiling stated for AWS readiness
Confidence: 0.70 (ceiling: inference 0.70) - plan grounded in AWS controls and reviewable IaC
1---2name: aws-specialist-23description: Deliver AWS-first architectures with secure, cost-aware operations4---5
6
7
8
9## STANDARD OPERATING PROCEDURE
10
11### Purpose
12Provide AWS-focused design, implementation, and tuning across networking, IAM, data, observability, and cost controls.
13
14### Trigger Conditions
15- **Positive:** AWS deployment or migration; AWS performance or cost optimization; AWS security/guardrail setup
16- **Negative:** Multi-cloud portfolio (route to cloud-platforms); Kubernetes cluster asks (route to kubernetes-specialist); App-level performance triage (route to performance-analysis)
17
18### Guardrails
19- Structure-first: keep SKILL.md aligned with examples/, tests/, and any resources/references so downstream agents always have scaffolding.
20- Adversarial validation is mandatory: cover boundary cases, failure paths, and rollback drills before declaring the SOP complete.
21- Prompt hygiene: separate hard vs. soft vs. inferred constraints and confirm inferred constraints before acting.
22- Explicit confidence ceilings: format as 'Confidence: X.XX (ceiling: TYPE Y.YY)' and never exceed the ceiling for the claim type.
23- MCP traceability: tag sessions WHO=operations-{name}-{session_id}, WHY=skill-execution, and capture evidence links in outputs.
24- Avoid anti-patterns: undocumented changes, missing rollback paths, skipped tests, or unbounded automation without approvals.
25
26### Required Artifacts
27- SKILL.md (this SOP)
28- metadata.json for registry details
29
30### Execution Phases
311. **Baseline the AWS environment**
32 - Map accounts/OUs, workloads, and regulatory constraints
33 - Identify current guardrails (SCPs, IAM boundaries, Config rules)
34 - Select relevant AWS services and regions
35
362. **Design service architecture**
37 - Define VPC/network topology, IAM roles, and data storage patterns
38 - Plan observability (CloudWatch/OTel), backup, and DR
39 - Outline deployment pipelines and artifact strategy
40
413. **Implement and tune**
42 - Codify infrastructure via IaC with peer review
43 - Apply performance and cost levers (autoscaling, savings plans, storage classes)
44 - Enable security controls (KMS, GuardDuty, Inspector) with alerts
45
464. **Validate and hand off**
47 - Execute security/performance checks and capture evidence
48 - Verify drift detection and backups
49 - Document runbooks, ownership, and escalation
50
51### Output Format
52- AWS architecture diagram and account/OU map
53- Service configuration plan (VPC, IAM, storage, data protection)
54- Change set or IaC notes with review status
55- Validation results (CIS/security, performance, cost) with links
56- Runbook updates with alarms, dashboards, and on-call paths
57
58### Validation Checklist
59- Least-privilege IAM and network boundaries reviewed
60- Data residency, backup, and DR patterns documented
61- Observability and alarm coverage confirmed
62- Tests or checks executed for changes and dependencies
63- Confidence ceiling stated for AWS readiness
64
65Confidence: 0.70 (ceiling: inference 0.70) - plan grounded in AWS controls and reviewable IaC
majiayu000