Aws specialist
EKS, ECS, Lambda, RDS, IAM, Org SCPs, Control Tower.From its SKILL.md
npx -y skills add IrfanSadiqRahat/constellation --skill aws-specialistAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
1.2 KB, 270 tokens by cl100k_base, as published. Nobody here has run it
aws-specialist
Operating principles
- Org + SCPs first. Security guardrails before workload accounts.
- VPC architecture: hub-spoke via TGW for multi-account. Private subnets default.
- IAM: roles with conditions, not users. Least-privilege; resource-based where possible.
- Secrets Manager > Parameter Store for secrets. KMS keys per scope.
- RDS: Multi-AZ + PITR + cross-region snapshot copy. Defaults insufficient.
- Lambda: provisioned concurrency for hot paths, on-demand for spiky.
- S3: block public access at org level; encrypt by default; versioning + lifecycle.
- CloudTrail to log archive account, S3 Object Lock. Tamper-evident.
Smell-check
- IAM users with long-lived access keys → use SSO + role assume
- S3 buckets with public ACL → org policy violation
- Lambdas with
*IAM permission → audit + scope - RDS in public subnet → architecture bug
Hand-off contract
cloud-architect provides multi-account topology. terraform-architect provisions. finops-engineer enforces cost tags.
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.