aws-devops-agent-external-mcp

End-to-end deployment knowledge for wiring AWS DevOps Agent to a self-hosted MCP Server bridge into AWS China region accounts. Use this skill whenever the user wants to "部署", "deploy", "配置", "set up", "接入", "onboard", "加账号", "add account", "rotate cert", "轮换证书", or troubleshoot the MCP bridge (ECS Fargate + internal ALB + VPC Lattice Private Connection + IAM Roles Anywhere). It covers the full lifecycle: network, certificates, Hub/Spoke Roles Anywhere, ECS deploy, Agent Space registration, and day-2 ops. The skill encodes the exact commands, decision points, and known pitfalls (RequestExpired credential refresh, Private-Connection-blocks-SG-delete, ECR token expiry, DNS resolution = Public). It does NOT itself run commands — it is the knowledge the deploy agent follows.

Proactive prevention and pre-alarm health checks across the two China region accounts (aws-cn and aws-cn-2). Use this skill when the user asks about prevention, 防护, 预防, proactive, 体检, health check, risk assessment, 潜在风险, 隐患, or "what might break soon", and when the Evaluation agent runs scheduled recommendation workflows. Looks for conditions that predict future incidents — single points of failure, service quotas nearing limits, stale AMIs, aging credentials, certificates expiring within 30 days, deprecated Lambda runtimes. This skill is distinct from cross-account-security-posture-check, which reports current-state security risk. Prevention predicts future failure; security posture describes current exposure.

First-response triage for an incoming alarm, ticket, or failure report originating from either China account (aws-cn or aws-cn-2). Use this skill when the trigger is an alarm name, CloudWatch alarm payload, SIM ticket body, error log snippet, or a user phrase such as 告警, 出事了, 服务挂了, incident, triage, 分类, 初步判断, 看一下这个告警, what happened. Determines which of the two accounts is affected, classifies the incident into one of six classes (compute / network / identity-credentials / data / cost / unknown), estimates severity from the signal, and checks whether a similar incident fired recently so duplicates are marked. Output is a short triage card that hands off to RCA or mitigation depending on severity. This skill is the entry point of the incident response pipeline.

Routing and disambiguation guidance for the two AWS China region MCP servers exposed by this Agent Space. Use this skill whenever the user's request mentions "中国区", "China", "cn-north-1", "cn-northwest-1", "Beijing", "Ningxia", or any AWS resource that must resolve to a specific China partition account. The skill explains which MCP endpoint maps to which account, how to pick when the user does not specify, and how to label cross-account results so the user can tell them apart.

Use when any task involves inspecting EKS pod status, pod events,

Draft step-by-step mitigation CLI commands for a root-caused incident in either China account (aws-cn or aws-cn-2). Use this skill after RCA has identified the root cause, when the user asks for mitigation, remediation, 缓解, 修复, 回滚, rollback, restore service, 怎么修, fix it, 怎么办. Covers common mitigation patterns such as credential rotation, Kubernetes pod rollout-restart, ALB target group reattach, security group rule revoke, IAM policy rollback, and safe CloudFormation stack rollback. Output always includes the exact CLI command, a one-line explanation of what it changes, a rollback/undo command, and an explicit human approval prompt. CRITICAL — this skill NEVER executes commands autonomously; every mitigation step requires explicit user approval before running.

Root cause analysis for a triaged incident in either China account (aws-cn or aws-cn-2). Use this skill after triage has produced a Triage Card, or when the user directly asks RCA, 根本原因, 根因, 为什么挂, why did X fail, deep dive, deep investigation, 深入分析, dig into, 调查. Correlates the CloudTrail API log window around the incident, recent deploy events (CloudFormation stack events, CodeDeploy, ECR pushes, Lambda updates), metric anomalies against prior-week baseline, and cross-account blast radius — specifically, whether the same failure pattern also hit the other China account around the same time, which would suggest a shared upstream cause (IAM partition-wide, AWS region event, or common dependency). Produces a single root-cause hypothesis plus the evidence chain. Does NOT execute remediation.

Retrieve, compare, and attribute AWS spend across the two China region accounts (aws-cn in cn-northwest-1 and aws-cn-2 in cn-north-1). Use this skill when the user asks about cost, spend, billing, 花费, 成本, 账单, 多少钱, expensive, 贵, top services, cost breakdown, month-over-month, budget, or wants to know which China account spends more and on what. Covers month-to-date, last month, last 90 days, and custom time ranges. Also use when the user wants to correlate cost with specific resources or services (e.g. "哪个账号的 EC2 花费高"). Report totals per account, top services per account, and deltas vs previous period when available.

Query the same AWS resource type (EC2, RDS, VPC, subnets, security groups, S3 buckets, Lambda functions, IAM roles, CloudFormation stacks, etc.) across both China region MCPs (aws-cn and aws-cn-2) and present a side-by-side comparison. Use this skill when the user asks to compare, diff, list across both, find differences, find matching resources by name or tag, or detect drift/inconsistency between the two China accounts. Triggers on phrases like "对比两个账号", "两边", "两个中国区", "aws-cn vs aws-cn-2", "宁夏和北京", "compare the two China accounts", "diff", "drift", "同名资源", "一致吗". Also use when the user wants an inventory that must cover both accounts regardless of which.

Run a security and compliance posture audit across both China region accounts (aws-cn in cn-northwest-1 and aws-cn-2 in cn-north-1), checking for common misconfigurations and unsafe defaults. Use this skill when the user asks about security, 安全, 合规, compliance, audit, 审计, posture, hardening, baseline, or wants to know if the two China accounts are "safe", "following best practices", or "have risks". The audit checks public S3 buckets, IAM users missing MFA, root account API activity, CloudTrail status, overly-permissive security groups opening sensitive ports to 0.0.0.0/0, unused/aged IAM access keys, and KMS key rotation. Report findings grouped by severity (critical / high / medium / low) and by account.

Diagnose and explain AWS partition ARN mismatches in China region accounts. Use this skill whenever an investigation in `cn-north-1` or `cn-northwest-1` involves ARNs starting with `arn:aws:` instead of `arn:aws-cn:`, or whenever symptoms include AccessDenied, AuthFailure, MalformedPolicyDocument, NoSuchEntity, or "principal cannot be assumed" errors against IAM roles, SNS topics, KMS keys, S3 buckets, or any other ARN-bearing resource. Triggers also include the user mentioning "partition", "aws-cn vs aws", "cross-partition", "中国区 ARN 不对", "global partition ARN in China account", "trust policy 写错了", or pasting any ARN that looks like `arn:aws:iam::*` while the account context is China. Importantly, use this skill BEFORE concluding that an IAM trust policy or resource policy is "missing permissions" — the more common root cause in China region accounts is a partition string mismatch that the agent and generic LLM debuggers consistently get wrong.