platform-compliance

name	platform-compliance
description	Skill for reviewing architecture of cloud infrastructure like AWS EC2, VPC, load balancers, RDS, S3, OpenSearch, and EKS with infrastructure as code and Terraform. Use when the user asks about the security, cost, and compliance of cloud infrastructure according to an organization's standards.

Platform Compliance Skill

Overview

Design and architect cloud infrastructure that is secure, production-ready, and compliant with organization standards.

Provide a security code review, compliance evaluation, and cost assessment of the cloud infrastructure deployed by Terraform.

Output the plan for deploying and implementing infrastructure in a proposal document called COMPLIANCE_REVIEW.md.

---

Phase 1: Security Review

ALWAYS use the security findings window for security code review. DO NOT write security findings to COMPLIANCE_REVIEW.md.

Perform a security code review on the Terraform configuration using the security findings window.

Consider:

• Encryption at rest and in transit
• IAM roles and policies (principle of least privilege)
• Network security (security groups, NACLs)
• Secrets management (AWS Secrets Manager usage)
• Public exposure of resources
• Logging and monitoring configuration

The security findings window will automatically track and display security issues.

Before proceeding to Phase 2, verify:

• User has acknowledged security findings from the security findings window

Phase 2: Compliance Evaluation

Evaluate the Terraform configuration for compliance according to the organization's policies.

Write compliance findings to COMPLIANCE_REVIEW.md:

• All resources have required tags (ManagedBy, Environment, OwnedBy, BusinessUnit, Project, Purpose)