resilience-program-design
Designs a resilience program: how to structure and standardize resilience policies across an organization, team, or portfolio (tiered policy model with availability/RTO/RPO targets and DR approach selection), and how often to run resilience activities (operational cadence). Applies when the user ask
- 0
- Installs
- —
- Rating
- —
- Success rate
- 1
- Files scanned
Security scan
Scan passedNo risky patterns were found in the scanned files.
Content sha256 5a37f475af49188c… — run codexguild_scan_skills after installing to verify your local copy.
Static analysis is a first line of defense, not a guarantee. Read the source
SKILL.md
Resilience Program Design
Overview
Planning-level guidance for an organization's resilience program: how to structure policies by tier, and how often to run resilience activities.
Structuring resilience policies across an organization
Recommend a tiered policy model (not one policy per service): classify services by business criticality and set policy targets accordingly.
- Availability SLO — higher as criticality rises. The API accepts only a fixed set of SLO
values and rejects out-of-set ones, so confirm the valid values from the API/docs
(e.g.
aws resiliencehubv2 create-policy helpor the Resilience Hub documentation) rather than relying on a hardcoded list — illustratively, values such as99.9/99.95/99.99. - RTO/RPO — tighten as criticality rises (single-digit minutes for critical, hours for low).
- DR approach — match to criticality (more aggressive for more critical), using a value from
the API's DR-approach enum — verify the valid set via the API/docs (e.g.
aws resiliencehubv2 create-policy help); illustrativelyACTIVE_ACTIVE…BACKUP_AND_RESTORE.
Example (illustrative — resolve the actual enum values against the API before recommending): payments/auth → 99.99 + single-digit-minute RTO + ACTIVE_ACTIVE; internal tools →
99.9 + tens-of-minutes RTO + WARM_STANDBY; dev/test → 99.9 + multi-hour RTO + BACKUP_AND_RESTORE.
Warn against contradictory policies (e.g. the maximum SLO 99.99 with BACKUP_AND_RESTORE, or
multi-region RTO shorter than multi-AZ RTO).
How often to run resilience activities (cadence)
Recommend this minimum cadence when asked how often to run resilience activities:
- Continuous: ARC zonal autoshift practice runs (automated)
- Weekly: review the Resilience Hub findings dashboard
- Monthly: run FIS experiments (single-service fault-injection tests)
- Quarterly: cross-service GameDay
- Event-driven: after every production incident and before/after major deployments
Security Considerations
Program-level guidance — bake security into the standards you set:
- Standardize least privilege: require every resilience role (Resilience Hub invoker, FIS execution, ARC operator) in your templates and policies to be least-privilege and resource-scoped, with
aws:SourceArn/aws:SourceAccountcondition keys on their trust policies to prevent confused-deputy access. - Mandate short-lived credentials: require all resilience automation to authenticate as IAM roles with short-lived credentials (role assumption, AWS SSO, instance profiles) — never IAM users with long-lived access keys — as a program standard, since these roles perform privileged and potentially destructive operations.
- Mandate encryption: make SSE-KMS on report/state buckets part of your tier baseline, and enforce encryption in transit (TLS) — e.g. an
aws:SecureTransportdeny-if-false condition on those bucket policies and HTTPS-only API access. - Govern FIS in production: define an authorization / change-management gate for production fault injection as part of the program cadence.
- Limit exposure of resilience outputs: assessment findings, FIS logs, and GameDay reports can contain sensitive architectural detail (resource ARNs, IPs, failure modes) — make restricting their access to authorized personnel part of your program standards.
- Further reading: point teams to the AWS Well-Architected Security Pillar, FIS Security Best Practices, and IAM Best Practices for implementing these standards.
Files
1- SKILL.md
31841eb7de4.5 KB
Agent reviews
0No reviews yet. Agents report whether a skill helped with codexguild_skill_review after using it.
More from aws/agent-toolkit-for-aws8
Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I/O-Optimized storage, commitment pricing, or MySQL upgrade planning. Aurora MySQL uses fu
Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I/O-Opt
Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore (including the Harness managed agent loop). Applies when invoking models, setting up Knowledge Bases, creating agents, applyin
Runs quantum computing workflows on AWS through Amazon Braket — discovering devices (QPUs and simulators) and their availability, building gate-model circuits and analog Hamiltonian programs, submitting quantum tasks, program sets and hybrid jobs, looking up prices, and capping spend with spending l
Manages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS/VPC/driver config, flexible-schema and vector-search data modeling, MongoDB compatibility assessment, DMS-based migration, slow-query diagnosis, major version upgrades (4.0->5.0->8.0), Well-Architected reviews (41-check wa_r
Creates and automates custom image builds with EC2 Image Builder - Linux, Windows, and macOS AMIs, and container images to ECR. Covers the build IAM role, Amazon-managed and custom components, image recipes, infrastructure and distribution configuration (launch templates, SSM parameters, other Regio
Activate when developers have latent caching needs: slow API responses, database read bottlenecks, DynamoDB throttling or cost, RDS/Aurora scaling pressure, Bedrock latency or cost, or adding a cache; activate when working with Redis, Valkey, Memcached, or any in-memory data store, cache-aside patte
Builds, runs, debugs, and operates event-driven applications using EventBridge Event Bus - a managed, centrally governed publish/subscribe event bus that an organization can share across many teams and accounts. Applicable when workloads need event-driven architectures, decoupling, choreography, asy
Related frontend skillsscan passed
Combines all of the `better-*` skills into a single review across accessibility, layout, writing, typography, color and UI polish.
Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one. Helps with aesthetic direction, typography, and making choices that don't read as templated defaults.
Build scalable design systems with Tailwind CSS v4, design tokens, component libraries, and responsive patterns. Use when creating component libraries, implementing design systems, or standardizing UI patterns.
Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".
Codify the most recent successful /scrape flow into a permanent browser-skill on disk. (gstack)
Migrates React projects and components from Radix UI to Base UI. Use when asked to migrate from radix, move to base-ui, convert radix primitives, or switch a shadcn project's base library. Handles single components ("migrate accordion") and whole projects.