Skip to content

feat: Add database-rds-resilience and database-rds-security skills - #54

Open
kiranmam wants to merge 2 commits into
aws:mainfrom
kiranmam:feature/database-rds-resilience-security
Open

feat: Add database-rds-resilience and database-rds-security skills#54
kiranmam wants to merge 2 commits into
aws:mainfrom
kiranmam:feature/database-rds-resilience-security

Conversation

@kiranmam

Copy link
Copy Markdown
Contributor

Two new standalone skills (SKILL.md only, no MCP):

  • database-rds-resilience: 66 hidden resilience blockers across 7 categories. Topology-aware RTO/RPO calculation with scoring 0-100.
  • database-rds-security: 58 security gaps across 8 categories. Posture scoring with remediation playbooks.

Both use only AWS CLI read-only APIs — no MCP, no Data API, no database connections.

… PR aws#54 review

Two read-only, topology-aware assessment skills for RDS/Aurora
(Aurora MySQL + Aurora PostgreSQL):

- database-rds-resilience: 66-blocker catalog across 7 categories,
  quota-aware RTO/RPO calculation, 4-dimension scoring
- database-rds-security: 58-gap catalog across 8 categories,
  4-dimension security posture scoring

Review fixes (chetannk@):
- Add README.md, CHANGELOG.md, and evals/ per skill
- Frontmatter: metadata block with author: kiranmam, matching the merged
  database-rds-devops skill
- Close the unclosed yaml fence in the detection-rules block that
  collapsed later sections into one code block on GitHub render
- Move blocker/gap catalogs and remediation playbooks to references/
  to keep SKILL.md under the ~500-line guideline
- resilience: correct QT-07 to the documented default of 5 concurrent
  cross-region snapshot copies; dedupe the duplicated
  DETECT_CROSS_REGION_COPY_BOTTLENECK detection rule; relabel the
  Multi-AZ remediation from "Zero Downtime" to a deferred
  maintenance-window change with an --apply-immediately warning
- security: document the Secrets Manager rotation prerequisite
  (rotate-secret --rotation-rules requires an existing rotation Lambda)

Skill Eval audit: both skills 98/100 (Grade A), passed.
@kiranmam

Copy link
Copy Markdown
Contributor Author

Thanks for the review, @chetannk. Pushed 170a768 addressing all items:

  • README.md, CHANGELOG.md, and evals/ added per skill
  • Frontmatter reworked to a metadata: block with author: kiranmam, matching the merged database-rds-devops skill
  • Fixed the unclosed ```yaml fence that was collapsing later sections into one code block on GitHub render
  • Moved the blocker/gap catalogs and remediation playbooks into references/ so each SKILL.md is under the ~500-line guideline
  • resilience: QT-07 corrected to the documented default of 5 concurrent cross-region snapshot copies; deduped the duplicate DETECT_CROSS_REGION_COPY_BOTTLENECK rule; relabeled the Multi-AZ remediation from "Zero Downtime" to a deferred maintenance-window change with an --apply-immediately warning
  • security: documented the Secrets Manager rotation prerequisite (rotate-secret --rotation-rules needs an existing rotation Lambda)

Skill Eval audit: both skills 98/100 (Grade A), passed: true, committed at evals/report.json. Functional/trigger eval suites are committed and load-validated via --dry-run, but weren't executed in this environment since that requires an authenticated agent runner; this matches the audit-only evidence approach used by the merged database-rds-devops skill.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant