cloud-architect

Files (6)

• SKILL.md
• aws.md · references/
• azure.md · references/
• cost.md · references/
• gcp.md · references/
• multi-cloud.md · references/

SKILL.md (first lines)

# Cloud Architect

## Core Workflow

1. **Discovery** — Assess current state, requirements, constraints, compliance needs
2. **Design** — Select services, design topology, plan data architecture
3. **Security** — Implement zero-trust, identity federation, encryption
4. **Cost Model** — Right-size resources, reserved capacity, auto-scaling
5. **Migration** — Apply 6Rs framework, define waves, validate connectivity before cutover
6. **Operate** — Set up monitoring, automation, continuous optimization

### Workflow Validation Checkpoints

**After Design:** Confirm every component has a redundancy strategy and no single points of failure exist in the topology.

**Before Migration cutover:** Validate VPC peering or connectivity is fully established:
```bash
# AWS: confirm peering connection is Active before proceeding
aws ec2 describe-vpc-peering-connections \
  --filters "Name=status-code,Values=active"

# Azure: confirm VNet peering state
az network vnet peering list \
  --resource-group myRG --vnet-name myVNet \
  --query "[].{Name:name,State:peeringState}"
```

**After Migration:** Verify application health and routing:
```bash
# AWS: check target group health in ALB
aws elbv2 describe-target-health \
  --target-group-arn arn:aws:elasticloadbalancing:...
```

**After DR test:** Confirm RTO/RPO targets were met; document actual recovery times.

## Reference Guide

Load detailed guidance based on context:

| Topic | Reference | Load When |
|-------|-----------|-----------|
| AWS Services | `references/aws.md` | EC2, S3, Lambda, RDS, Well-Architected Framework |
| Azure Services | `references/azure.md` | VMs, Storage, Functions, SQL, Cloud Adoption Framework |
| GCP Services | `references/gcp.md` | Compute Engine, Cloud Storage, Cloud Functions, BigQuery |
| Multi-Cloud | `references/multi-cloud.md` | Abstraction layers, portability, vendor lock-in mitigation |
| Cost Optimization | `references/cost.md` | Reserved instances, spot, right-sizing, FinOps practices |

## Constraints

### MUST DO
- Design for high availability (99.9%+)
- Implement security by design (zero-trust)
- Use infrastructure as code (Terraform, CloudFormation)
- Enable cost allocation tags and monitoring
- Plan disaster recovery with defined RTO/RPO
- Implement multi-region for critical workloads
- Use managed services when possible
- Document architectural decisions

### MUST NOT DO
- Store credentials in code or public repos
- Skip encryption (at rest and in transit)
- Create single points of failure
- Ignore cost optimization opportunities
- Deploy without proper monitoring
- Use overly complex architectures
- Ignore compliance requirements
- Skip disaster recovery testing

## Common Patterns with Examples

### Least-Privilege IAM (Zero-Trust)

Rather than broad policies, scope permissions to specific resources and actions:

```bash
# AWS: create a scoped role for an application
aws iam create-role \
  --role-name AppRole \
  --assume-role-policy-document file://trust-policy.json

aws iam put-role-policy \
  --role-name AppRole \
  --policy-name AppInlinePolicy \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::my-app-bucket/*"
    }]
  }'
```

```hcl
# Terraform equivalent
resource "aws_iam_role" "app_role" {
  name               = "AppRole"
  assume_role_policy = data.aws_iam_policy_document.trust.json
}

resource "aws_iam_role_policy" "app_policy" {
  role = aws_iam_role.app_role.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:GetObject", "s3:PutObject"]
      Resource = "${aws_s3_bucket.app.arn}/*"
    }]
  })
}
```

### VPC with Public/Private Subnets (Terraform)

```hcl
resource "aws_vpc" "main" {

From liu-ran-1/pregnancy-nutrition-platform, MIT.

More from liu-ran-1/pregnancy-nutrition-platform