用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/aws-samples/sample-innovation-patterns --skill ipa-stack-tfstate命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
| name | ipa-stack-tfstate |
| description | Deploy a Terraform state backend (S3 + DynamoDB) via CloudFormation. |
Deploy the Terraform state backend infrastructure. This stack is always deployed via CloudFormation — even when APP_IAC=terraform — because the Terraform state backend must exist before Terraform can run.
| Property | Value |
|---|---|
| Stack name | {APP_NAMESPACE}-{APP_ENV}-tfstate |
| Template | infra/cfn/tfstate/tfstate.yml |
| Capabilities | none |
| Lifecycle | prepare (prerequisite stack) |
| Tier | tfstate |
| Parameter | Type | Default | Validation | Error Message |
|---|---|---|---|---|
| Namespace | String | — | /^[a-z][a-z0-9-]{0,11}$/ | "Invalid namespace — 1-12 chars, lowercase alphanumeric + hyphens, starts with letter" |
| Environment | String | — | dev | staging | prod | "Must be dev, staging, or prod" |
All parameters are Configuration type — sourced from .env.
No wirable parameters — all parameters are configuration type.
No Compose Config prompts — all values come from .env.
| Output | Description | Export Convention | Used By |
|---|---|---|---|
| StateBucketName | S3 bucket name for Terraform state files | {StackName}-StateBucketName | All Terraform modules (backend config) |
| LockTableName | DynamoDB table name for state locking | {StackName}-LockTableName | All Terraform modules (backend config) |
None.
Both the S3 bucket and DynamoDB table have DeletionPolicy: Retain. Manual cleanup required:
aws s3 rm s3://{bucket-name} --recursiveaws dynamodb delete-table --table-name {table-name}aws s3 rb s3://{bucket-name}make -f scripts/prepare.mk teardown-tfstateRequired IAM actions: s3:CreateBucket, PutBucketVersioning, PutBucketEncryption, PutBucketPublicAccessBlock, PutBucketPolicy — scoped to arn:aws:s3:::{ns}-{env}-tfstate-*. dynamodb:CreateTable, DescribeTable, UpdateTable, UpdateContinuousBackups — scoped to arn:aws:dynamodb:{Region}:{AccountId}:table/{ns}_{env}_tfstate_lock.
Security controls: S3 versioning enabled, AES256 encryption, public access blocked, TLS-only policy. DynamoDB SSE enabled, PITR enabled, PAY_PER_REQUEST billing.
Full advisory: See SECURITY.md
基于 SOC 职业分类
