用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/aws-samples/sample-innovation-patterns --skill ipa-stack-logs命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Stand up the four Diátaxis mode directories, each seeded with an index page, in a project that has no documentation tree. Invoke ONLY via the /ai-diataxis-scaffold slash command. Do not activate from intent, keywords, or near-synonyms — slash incantation is required.
Create, assess, or survey documentation against the Diátaxis compass. Invoke ONLY via the /ai-diataxis slash command. Do not activate from intent, keywords, or near-synonyms — slash incantation is required.
Initialize or refine unified project context (.context/README.md). Invoke ONLY via the /ai-init slash command. Do not activate from intent, keywords, or near-synonyms — slash incantation is required.
基于 SOC 职业分类
正在显示 SKILL.md
| name | ipa-stack-logs |
| description | Deploy a centralized S3 log bucket for CloudFront, S3 access, and VPC flow logs. |
Deploy a centralized S3 log bucket. Provides bucket name and ARN outputs for downstream stacks that need log destinations (frontend CloudFront/S3 access logs).
| Property | Value |
|---|---|
| Stack name | {APP_NAMESPACE}-{APP_ENV}-logs |
| Template | infra/cfn/logs/logs.yml |
| Capabilities | none |
| Lifecycle | prepare (prerequisite stack) |
| Tier | logs |
| Parameter | Type | Default | Validation | Error Message |
|---|---|---|---|---|
| Namespace | String | — | /^[a-z][a-z0-9-]{0,11}$/ | "Invalid namespace" |
| Environment | String | — | /^[a-z][a-z0-9-]{0,11}$/ | "Must be 1-12 chars" |
| AccountId | String | — | /^\d{12}$/ | "Must be 12-digit AWS account ID" |
| Region | String | — | /^[a-z]{2}-[a-z]+-\d$/ | "Must be valid AWS region" |
| KmsKeyArn | String | (empty) | /^(arn:aws:kms:[a-z0-9-]+:\d{12}:key\/[a-f0-9-]+)?$/ | "Invalid KMS key ARN" |
All parameters are Configuration type — sourced from .env or defaults.
No wirable parameters — all parameters are configuration type.
No Compose Config prompts — all values come from .env.
| Output | Description | Export Convention | Used By |
|---|---|---|---|
| LogBucketName | S3 bucket name for log destinations | {StackName}-LogBucketName | ipa-stack-frontend (LogBucketDomainName) |
| LogBucketArn | S3 bucket ARN for IAM policy scoping | {StackName}-LogBucketArn | Security policy scoping |
None.
CloudFormation cannot delete non-empty S3 buckets. If teardown fails, manually
empty the bucket first: aws s3 rm s3://{bucket-name} --recursive then re-run
make -f scripts/prepare.mk teardown-logs.
Required IAM actions: s3:CreateBucket, DeleteBucket, PutBucketPolicy,
PutBucketVersioning, PutEncryptionConfiguration, PutLifecycleConfiguration,
PutBucketPublicAccessBlock, PutBucketOwnershipControls — scoped to
arn:aws:s3:::{ns}-{env}-logs-*
Security controls: Public access blocked, SSE-S3 (AES-256) encryption,
versioning enabled, 90-day lifecycle expiration, TLS-only access (DenyNonSSL),
bucket policy scoped to specific AWS service principals with SourceAccount condition
Full advisory: See SECURITY.md
| Property | Value |
|---|---|
| Module path | infra/tf/logs/ |
| State key | {namespace}-{env}/logs/terraform.tfstate |
| Required version | >= 1.5.0 |
| Providers | hashicorp/aws >= 5.0 |
| Variable | Type | Default | Maps to CFN |
|---|---|---|---|
| namespace | string | — | Namespace |
| environment | string | — | Environment |
| region | string | — | (implicit) |
| state_bucket | string | — | (TF infrastructure) |
| account_id | string | — | AccountId |
| Output | Maps to CFN |
|---|---|
| log_bucket_name | LogBucketName |
| log_bucket_arn | LogBucketArn |
