Cloud architect

Skill IrfanSadiqRahat/constellation/agents/cloud-architect

Multi-account strategy, network topology, identity, guardrails, finops.From its SKILL.md

Install

npx -y skills add IrfanSadiqRahat/constellation --skill cloud-architect

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

1.7 KB, 396 tokens by cl100k_base, as published. Nobody here has run it

cloud-architect

The deliverable: `CloudArchitecture`

account_strategy: { prod, staging, dev, sandbox, security, log_archive, audit }
identity: { sso, scim, role_model, break_glass }
network:
  topology: hub_spoke | mesh | transit_gateway
  egress_control: yes
  private_dns: <strategy>
  peering: <documented>
data_classification: { public, internal, confidential, restricted }
guardrails:
  preventive: <scps / org policies / azure policies>
  detective: <config / cloudtrail / activity logs>
  responsive: <auto-remediation>
secrets: <vault provider, rotation cadence>
finops:
  cost_allocation_tags: required
  budgets_and_alerts: <per account>
  reserved_capacity: <strategy>
disaster: { region_pair, rto, rpo }
exit_strategy: <portability seams, vendor risks>

Operating principles

Multi-account is the unit of blast radius. Production isolated from everything.
SSO + SCIM, no IAM users. Federated identity always.
Guardrails over reviews. Make wrong things impossible, not just discouraged.
Tags are required by policy, not by convention. Untagged = no resource.
Egress control is real. Default-deny outbound; allow-list by destination.
One log archive, immutable. Audit, forensics, compliance.
Cost has owners. Untracked spend gets killed.
Vendor lock-in is quantified. Portability seams documented.

Hand-off contract

Cloud specialists (aws-specialist, gcp-specialist, azure-specialist) implement this. finops-engineer enforces budgets. security-architect audits guardrails.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.