dsg-infrastructure-deployer

Files (4)

• README.md
• SKILL.md
• package.json
• skill.ts

SKILL.md (first lines)

# DSG Infrastructure Deployer

Automated deployment and lifecycle management of **DSG ONE / ProofGate Control Plane** infrastructure on AWS.

***

## When to invoke this skill

| Intent                                           | Use this skill                              |
| ------------------------------------------------ | ------------------------------------------- |
| "Deploy DSG to AWS dev/staging/production"       | ✅ Yes — full CDK deployment pipeline        |
| "Verify AWS infrastructure is healthy"           | ✅ Yes — health checks and diagnostics       |
| "Check deployment status and resource count"     | ✅ Yes — CloudFormation status monitoring    |
| "Document AWS resource outputs"                  | ✅ Yes — automated capture and templating    |
| "Troubleshoot CloudFormation deployment failure" | ✅ Yes — error diagnosis and recovery        |
| "Update infrastructure configuration"            | ✅ Yes — CDK synth and targeted updates      |
| "Set up production AWS accounts"                 | ✅ Yes — account setup and IAM configuration |
| "Build a generic AWS app (not DSG)"              | ❌ Out of scope — use AWS CDK docs directly  |

***

## Core deployment workflow

### Phase 1: Pre-deployment validation

```
1. CHECK ENVIRONMENT
   ✓ AWS credentials available (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)
   ✓ AWS region configured (AWS_REGION, default: us-east-1)
   ✓ AWS account ID known (AWS_ACCOUNT_ID)
   ✓ CDK CLI available (npm exec cdk)
   ✓ Node.js and npm installed

2. VALIDATE CONFIGURATION
   ✓ Environment type specified (dev, staging, prod)
   ✓ Stack name follows convention: dsg-one-{env}-v2
   ✓ No conflicting CloudFormation stacks
   ✓ Supabase connection configured (if database required)
   ✓ Docker registry configured (if ECR push needed)

3. REVIEW CONSTRUCTS
   ✓ Networking (VPC, subnets, NAT, security groups)
   ✓ ECS (cluster, Fargate task definition, service)
   ✓ ALB (load balancer, listeners, target groups)
   ✓ Database (DynamoDB tables)
   ✓ Storage (S3 buckets for evidence, CloudTrail logs)
   ✓ Security (KMS encryption keys, Secrets Manager)
   ✓ Monitoring (CloudWatch logs, X-Ray)
   ✓ Audit (CloudTrail, VPC Flow Logs)
```

### Phase 2: Synth and dry-run

```bash
cd infra/cdk
npx cdk synth --require-approval=never
# Review generated CloudFormation template
# Expected output: DSGOneStack-{env}.template.json (~80KB)
```

### Phase 3: Deploy infrastructure

```bash
cd infra/cdk
npx cdk deploy --require-approval=never
# Expected duration: 15-45 minutes for first deployment
# CloudFormation creates ~75 resources
# Outputs: ALB DNS, ECS cluster ARN, RDS endpoint (if applicable)
```

### Phase 4: Post-deployment verification

```
1. VERIFY CLOUDFORMATION
   ✓ Stack status: CREATE_COMPLETE or UPDATE_COMPLETE
   ✓ Resource count: 75 resources created
   ✓ No DELETE_FAILED or CREATE_FAILED resources
   ✓ Stack outputs available (ALB DNS, RDS endpoint, etc.)

2. HEALTH CHECKS
   ✓ curl GET /api/health → 200 OK
   ✓ curl GET /api/readiness → ready: true
   ✓ curl GET /api/agent/status → deployment info
   ✓ AWS ECS service running desired task count
   ✓ ALB health checks passing (target group healthy)
   ✓ RDS database accepting connections
   ✓ Secrets Manager secrets accessible

3. RESOURCE VALIDATION
   ✓ VPC CIDR: 10.0.0.0/16 (configurable)
   ✓ Subnets: 2 public + 2 private (multi-AZ)
   ✓ NAT Gateway: 1 per AZ (for private egress)
   ✓ ECS cluster: Running tasks = desired count
   ✓ ALB: Listening on :80 and :443
   ✓ DynamoDB tables: 3 tables (policies, audit, replay-proofs)
   ✓ S3 buckets: Evidence bucket + CloudTrail bucket + CDK bucket
   ✓ KMS keys: Master key + data key, rotation enabled
   ✓ Secrets: api-secrets, database-secrets, oauth-secrets

4. SECURITY VERIFICATION
   ✓ All data encrypted at rest (KMS)
   ✓ All data encrypted in transit (TLS)
   ✓ IAM roles follow least-privilege principle
   ✓ RLS policies on Supabase tables (if using)
   ✓ VPC endpoints for private service access
   ✓ Security groups restrict traffic to required ports
   ✓ CloudTrail logging enabled
   ✓ CloudWatch Logs retention configured

5. COMPLIANCE READINESS
   ✓ Audit trail tables created (DynamoDB)
   ✓ Evidence bucket configured (S3)
   ✓ Compliance matrix seeded
   ✓ CCVS pipeline ready for evidence collection
```

***

## Configuration by environment

From tdealer01-crypto/tdealer01-crypto-dsg-control-plane, MIT.

More from tdealer01-crypto/tdealer01-crypto-dsg-control-plane