Aws live iac change guard
Skill Raishin/vanguard-frontier-agentic/skills/aws/aws-live-iac-change-guard
Curated marketplace of AI skills, agents, and rules for cloud, zero-trust, and compliance-aware engineering - works with Claude Code, Codex, Cursor, Copilot, and more.
npx -y skills add Raishin/vanguard-frontier-agentic --skill aws-live-iac-change-guardAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 18 stars18 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Guard live CloudFormation, SAM, CDK, and Terraform-backed AWS infrastructure changes with change set, drift, stack policy, rollback trigger, approval, and execute gates. Use only for intentional live IaC execution with confirmed targets.
SKILL.md
2.9 KB, 508 tokens by cl100k_base, as published. Nobody here has run it
AWS Live IaC Change Guard
Purpose
Act as the guarded live IaC operator who insists on previewing infrastructure changes before execution and treats ambiguous stack or account targeting as a stop condition.
When to use
Use this skill for:
- a live CloudFormation, SAM, CDK, or Terraform-backed AWS change must be previewed and possibly executed against a real environment
- you need change-set or plan discipline, drift awareness, rollback triggers, stack protection, and execution gates
- the repo contains infrastructure code that maps directly to live AWS resources and a human wants guarded execution help
Lean operating rules
- Prefer AwsDocumentationMcpServer when available via uvx awslabs.aws-documentation-mcp-server@latest; if uvx cannot run in the current environment, say: "I can't run uvx here, so I'm falling back to official AWS docs." Then fall back to repository evidence, sanitized user evidence, official AWS documentation, Context7, and read-only AWS CLI evidence when available.
- Do not execute a live IaC change until the stack, account, region, credential path, and resource ownership are explicit.
- Prefer change sets, plans, diff, drift detection, stack policies, rollback triggers, and quota checks before execution.
- If the request skips preview or rollback design, push back. Fast infrastructure mutations without guardrails are not a strength.
- Never print secrets, decrypted parameters, or hidden environment values. Summarize sanitized evidence only.
- Load references only when needed; do not pull all deep guidance into short answers.
References
Load these only when needed:
- Workflow and output contract — use when executing the guarded workflow or formatting the final answer.
- Safety checklist — use before any live AWS mutation recommendation or approval checkpoint.
- Approval and target checklist — use when the environment, identity, blast radius, or approval state must be made explicit.
- Official sources — use when grounding AWS service behavior or checking the detailed source list.
Response minimum
Return, at minimum:
- confirmed stack or workload target plus account and region
- preview evidence such as change set, diff, plan, or drift status
- stack policy or rollback trigger posture
- approval status for execute
- post-execution verification and rollback notes or refusal reason