Menú
Deep CloudFormation risk intelligence covering resource replacement detection, deletion policies, drift patterns, stack dependencies, IAM resource risks, and service quota awareness.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Deep Ansible operational knowledge covering dangerous module classification, idempotency violations, inventory targeting risks, privilege escalation patterns, and handler ordering pitfalls.
ArgoCD sync and application-set guidance for GitOps delivery changes across shared clusters.
AWS CDK guidance for logical IDs, removal policies, and synth-time environment drift.
Azure Bicep guidance for deployment modes, secret exposure, and subscription-target drift.
Cert-Manager issuance and renewal guidance for issuer, solver, and secret-rotation changes.
Crossplane composition guidance for control-plane fan-out, provider config, and managed resource safety.
| name | cloudformation |
| version | 1.0.0 |
| author | DeployWhisper |
| license | MIT |
| triggers | [".yaml",".yml",".json",".template"] |
| token_budget | 1500 |
| tags | ["cloudformation","aws","iac"] |
| description | Deep CloudFormation risk intelligence covering resource replacement detection, deletion policies, drift patterns, stack dependencies, IAM resource risks, and service quota awareness. |
| test_suite_path | tests/skill-tests/cloudformation |
| trigger_content_patterns | ["AWSTemplateFormatVersion","Resources","AWS::","CloudFormation"] |
Replacement instead of Update = CRITICAL — CloudFormation destroys the old resource and creates a new one; for stateful resources (RDS, DynamoDB, ElastiCache) this means DATA LOSS unless DeletionPolicy is Retain or SnapshotEngine, DBInstanceIdentifier, MasterUsername, AvailabilityZone, StorageEncrypted changes all force replacementTableName, KeySchema (partition/sort key), BillingMode change from PAY_PER_REQUEST to PROVISIONED (on some versions)InstanceType change on instances without stop/start support, ImageId change, AvailabilityZone changeEngine, CacheNodeType on some cluster modes, NumCacheClusters reductionFunctionName change forces replacement; Runtime, Handler, Code are in-place updatesBucketName change = REPLACEMENT — and S3 bucket names are globally unique; the old name may not be reclaimableMultiAZ change = triggers brief failover (60-120 seconds downtime)AllocatedStorage increase = online for most engines; DECREASE is not supported and failsInstanceType change = requires stop/start; brief downtime during transitionLaunchTemplate version change = triggers rolling replacement of instances based on update policyTaskDefinition revision change = triggers new deployment; old tasks drain based on DeregistrationDelayDisplayName change = no operational impactDeletionPolicy: Snapshot or DeletionPolicy: Retain = CRITICAL — stack deletion or resource removal destroys the database with no backup; DEFAULT behavior is DeleteDeletionPolicy: Retain = CRITICAL — table and all data destroyed on removalDeletionPolicy: Retain = HIGH — bucket must be empty before CloudFormation can delete it; if not empty, stack deletion fails and leaves the stack in DELETE_FAILED stateDeletionPolicy: Snapshot = HIGH — data volumes destroyed without backupDeletionPolicy: Snapshot = MEDIUM — cache data lost; acceptable if cache is rebuilt from persistent data sourceDeletionPolicy changed from Retain to Delete = CRITICAL — previously protected resource is now vulnerable to stack deletionDeletionPolicy removed entirely = CRITICAL — reverts to default behavior which is Delete for most resourcesUpdateReplacePolicy missing when DeletionPolicy is set = MEDIUM — DeletionPolicy protects against stack deletion, but UpdateReplacePolicy protects against in-stack replacement; they serve different purposes and both should be set on stateful resourcesMetadata section that doesn't match actual metadata = drift indicatorDesiredCapacity — stack update resets to template valueDefault values that operators override via console — the override is not captured in the template; stack recreation uses the default, not the overridden valueConditions that reference parameters — changing a parameter default can flip conditions, enabling or disabling entire resource branchesMappings used with AWS::Region — ensure all required regions have entries; deploying to a new region with a missing mapping entry causes creation failureFn::ImportValue referencing another stack's Export = HIGH — creates an implicit dependency; the exporting stack cannot be updated to change or remove the export while any stack imports it; this creates stack lock-inExport name change = CRITICAL — all importing stacks immediately break; CloudFormation prevents this but nested reference chains can be complexDeletionPolicy: Retain on resources inside = the nested stack itself may be deleted but retained resources persist as orphans outside CloudFormation managementAWS::IAM::Policy with Action: "*" = CRITICAL — administrative access to every AWS serviceAWS::IAM::Policy with Resource: "*" on sensitive actions = CRITICAL — action applies to every resource in the accountAWS::IAM::Role with trust policy allowing Principal: "*" = CRITICAL — any AWS account can assume the roleAWS::IAM::Role trust policy without Condition restricting sts:ExternalId for cross-account roles = HIGH — susceptible to confused deputy attackAWS::IAM::ManagedPolicy with Path: "/" attached to multiple roles = MEDIUM — broad attachment scope; change affects all attached rolesPermissionsBoundary on IAM roles created by the stack = MEDIUM — roles have no upper bound on permissions; a policy change can escalate beyond intended scopeAWS::IAM::InstanceProfile change = HIGH — requires instance stop/start or replacement to take effectUPDATE_ROLLBACK_FAILED state = CRITICAL — stack is stuck; requires manual intervention via ContinueUpdateRollback with resources to skip, or potentially stack recreationDependsOn chains that form a cycle prevent stack creation; CloudFormation detects this at validation timeDependsOn specifies ordering; missing DependsOn on dependent resources causes race conditions--no-rollback flag = CRITICAL — if update fails, stack remains in UPDATE_FAILED state with partial changes applied; no automatic recovery--on-failure DO_NOTHING = HIGH — failed stack persists with partial resources; useful for debugging but dangerous in automationReplacement: True on multiple resources = HIGH — if any replacement fails mid-update, rollback must recreate the ORIGINAL resources which may fail (name conflicts, quota limits)