platform-compliance

Files (3)

• COMPLIANCE_EXAMPLE.md
• COST_EXAMPLE.md
• SKILL.md

SKILL.md (first lines)

# Platform Compliance Skill

## Overview

Design and architect cloud infrastructure that is secure, production-ready, and
compliant with organization standards. 

Provide a security code review, compliance evaluation, and cost assessment of the cloud infrastructure deployed by Terraform.

Output the plan for deploying and implementing infrastructure in a proposal document called `COMPLIANCE_REVIEW.md`.

---

## Phase 1: Security Review

**ALWAYS use the security findings window for security code review. DO NOT write security findings to COMPLIANCE_REVIEW.md.**

Perform a security code review on the Terraform configuration using the security findings window.

Consider:

- Encryption at rest and in transit
- IAM roles and policies (principle of least privilege)
- Network security (security groups, NACLs)
- Secrets management (AWS Secrets Manager usage)
- Public exposure of resources
- Logging and monitoring configuration

The security findings window will automatically track and display security issues.

Before proceeding to Phase 2, verify:
- [ ] User has acknowledged security findings from the security findings window

## Phase 2: Compliance Evaluation

Evaluate the Terraform configuration for compliance according to
the organization's policies.

Write compliance findings to `COMPLIANCE_REVIEW.md`:

- [ ] All resources have required tags (ManagedBy, Environment, OwnedBy, BusinessUnit, Project, Purpose)
- [ ] Secrets stored in AWS Secrets Manager (not hardcoded)
- [ ] No public modules used (only private vetted modules)
- [ ] Kubernetes resources use Helm charts unless otherwise noted

## Phase 3: Cost Estimation

Use Infracost CLI to provide cost estimates for the deployed infrastructure.

```bash
infracost breakdown --path . --format table
```

If Infracost CLI provides a $0.00 cost estimate, verify with AWS pricing.

Write cost findings to `COST_REVIEW.md`:

- Include monthly cost estimates in the review
- Highlight any resources with significant costs (>$100/month)
- Note any resources with variable costs based on usage
- If Infracost cannot estimate a resource, note "Cost unknown - manual review required"
- Provide cost optimization recommendations from Infracost output

### Checklist

- [ ] User has corrected high-priority issues based on security findings window
- [ ] User has justified high-priority violations with inline comment
      ```
      ## Justification: The Helm chart does not contain overrides for an Ingress configuration.
      ```

### Example

Refer to `COMPLIANCE_EXAMPLE.md` for a full example of how to structure the compliance review (excluding security findings which go in the security findings window).


Refer to `COST_EXAMPLE.md` for a full example of how to structure the cost review (excluding security findings which go in the security findings window).

## Recovery

If the user does not remediate as per security findings window or `COMPLIANCE_REVIEW.md`, prompt the user for feedback and suggest
escalation to the security team.

From joatmon08/platform-infrastructure-skills, MIT.

More from joatmon08/platform-infrastructure-skills