website-preflight

name	website-preflight
description	Validates AWS readiness for website deployment. Checks CLI tools, credentials, SES, Route 53, and ACM. Produces a report with pass/fail and action items.
allowed-tools	Bash, Read, Write, Edit, Glob

Website Preflight Skill

You are running the /grc-portfolio:preflight skill. Your job is to validate that all prerequisites are met for deploying a website to AWS, and guide the user through any human tasks required.

Step 1: Locate Config

Find site-config.json:

• Check $ARGUMENTS for a project directory path
• Check the current working directory
• Ask the user if not found

Read it to understand what features are enabled and what AWS configuration is needed.

Step 2: Automated Checks

Run each check and record the result as PASS or FAIL:

Required Checks (all deployments)

1. AWS CLI installed

   aws --version
   

   If missing: suggest running $TOOLKIT_DIR/scripts/bootstrap.sh

2. Node.js installed (v18+)

   node --version
   

3. npm installed

   npm --version
   

4. AWS credentials configured

   aws sts get-caller-identity --profile <aws.profile>
   

   Record the account ID and ARN for the report.

5. AWS region set to us-east-1 Verify aws.region in config is us-east-1 (required for CloudFront + ACM).

6. CloudFormation templates valid Run $TOOLKIT_DIR/scripts/validate-stack.sh against the appropriate template:

   • If features.customDomain: validate $TOOLKIT_DIR/cloudformation/website-infrastructure.yaml
   • Otherwise: validate $TOOLKIT_DIR/cloudformation/website-infrastructure-no-domain.yaml

Conditional Checks

7. SES email verified (if features.contactForm)

   aws ses get-identity-verification-attributes --identities <client.email> --profile <aws.profile> --region us-east-1
   

   Check that the status is "Success".

8. Route 53 hosted zone exists (if features.customDomain)

   aws route53 list-hosted-zones-by-name --dns-name <aws.domain> --profile <aws.profile>
   

   If found, save the hosted zone ID to aws.hostedZoneId in config.

9. ACM certificate exists in us-east-1 (if features.customDomain)

   aws acm list-certificates --region us-east-1 --profile <aws.profile> --query "CertificateSummaryList[?DomainName=='<aws.domain>']"
   

   If found and status is "ISSUED", save the ARN to aws.certArn in config.

10. gh CLI installed (for future /grc-portfolio:repo and /grc-portfolio:cicd steps)

    gh --version
    

Step 3: Produce Report

Output a formatted report with three sections:

PASS

List all checks that passed with a checkmark.

ACTION REQUIRED (Automated)

Things that can be fixed automatically -- offer to run the fix:

• Missing tools (run bootstrap.sh)
• Template validation (fix template issues)

ACTION REQUIRED (Human)

Things the user must do manually. For each, provide:

• What to do (clear instructions)
• AWS Console URL (direct link where possible)
• Expected time (rough estimate)
• Verification command (how to check it's done)

Common human tasks:

• Create AWS account: https://aws.amazon.com/ -- sign up, create IAM user with AdministratorAccess
• Buy/transfer domain to Route 53: https://console.aws.amazon.com/route53/home#/DomainRegistration
• Request ACM certificate: https://console.aws.amazon.com/acm/home?region=us-east-1#/certificates/request -- request for the domain + *.domain, use DNS validation
• Verify email in SES: https://console.aws.amazon.com/ses/home?region=us-east-1#/verified-identities -- add email, click verification link
• Install gh CLI: brew install gh && gh auth login

Step 4: Wait for Human Tasks

If there are human action items, tell the user to complete them and then say "ready" or "done" to re-run the checks.

When they indicate completion, re-run only the previously-failed checks.

Step 5: Update Config

Once all checks pass:

• Update aws.hostedZoneId if discovered
• Update aws.certArn if discovered
• Set status.preflightComplete = true
• Write the updated site-config.json

Step 6: Summary

Tell the user:

• All preflight checks passed
• Suggest running /grc-portfolio:build next (if not done) or /grc-portfolio:infra to deploy infrastructure

Variables

• $TOOLKIT_DIR = read from site-config.json toolkitDir field
• $ARGUMENTS = arguments passed after /grc-portfolio:preflight (expected: project directory path)