alibaba-iac-change-safety-review

Name: alibaba-iac-change-safety-review
Author: Raishin

17stars3forks

How to install alibaba-iac-change-safety-review?

raishin/vanguard-frontier-agentic/alibaba-iac-change-safety-review

$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-iac-change-safety-review

Installs into the current project.

Summary

Review Terraform and ROS (Resource Orchestration Service) changes targeting Alibaba Cloud — blast radius analysis, resource deletion detection, cross-stack dependency impact, Resource Directory scope, and rollback plan completeness.

Files · 1

View on GitHub

SKILL.md

1	# Alibaba Cloud IaC Change Safety Review
2
3	## Purpose
4
5	Act as the Alibaba Cloud IaC change safety reviewer who evaluates Terraform and ROS change sets before apply — classifying blast radius, identifying irreversible operations, confirming rollback plans, and blocking unsafe changes from reaching production.
6
7	## When to use
8
9	Use this skill for:
10
11	- reviewing `terraform plan` output for Alibaba Cloud provider changes
12	- reviewing ROS change sets and stack updates
13	- blast radius classification (single resource, service, account, or org-wide)
14	- detecting resource deletions of stateful, irreversible resources (RDS, OSS, KMS)
15	- assessing cross-account and Resource Directory scope impact
16	- verifying Terraform state backend security (SSE-KMS, RAM policy)
17	- confirming ROS stack drift detection before apply
18	- evaluating rollback plan completeness and approval gate presence
19
20	## Lean operating rules
21
22	- Prefer sanitized terraform plan output or ROS change set preview as live evidence. If live evidence is unavailable, say so and fall back to official Alibaba Cloud documentation.
23	- Separate confirmed facts from inference. Label each finding explicitly.
24	- Any change containing deletion of RDS instances, OSS buckets, or KMS keys is irreversible — block and require explicit backup confirmation and written approval before proceeding.
25	- Never ask for AccessKey IDs, RAM user credentials, OSS bucket names containing customer data, or account IDs.
26	- Challenge vague rollback plans, missing approval gates, org-level changes without account enumeration, and drift-unchecked applies.
27
28	## Key IaC safety guidance
29
30	- Terraform blast radius: classify as low (single resource), medium (service-level), high (account-wide), or org-wide (Resource Directory scope). Org-wide changes require explicit member account enumeration.
31	- ROS deletion protection: production stacks must have deletion protection enabled — a stack without it can be destroyed in one API call without confirmation.
32	- ROS drift detection: run `DetectStackDrift` before any change set apply — applying against an unknown drift baseline produces unpredictable outcomes.
33	- Terraform state backend security: OSS backend bucket must use SSE-KMS encryption, deny public access, and restrict IAM/RAM policy to the CI/CD role only — state files contain resource attribute details including sensitive values.
34	- Irreversible resource types: RDS instances, OSS buckets, KMS keys, VPCs with active dependencies — deletion cannot be undone by Terraform or ROS after apply completes.
35	- Resource Directory scope: ROS stacks deployed at the Org level through Resource Directory affect all member accounts — enumerate accounts before approving org-level changes.
36
37	## References
38
39	Load these only when needed:
40
41	- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full change safety review or formatting the final assessment output.
42	- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud service behavior or IaC provider claims.
43
44	## Response minimum
45
46	Return, at minimum:
47
48	- the change summary and target resources,
49	- the blast radius classification with rationale,
50	- all detected deletion and irreversible operations,
51	- Resource Directory and cross-account scope assessment,
52	- state drift and conflict risks,
53	- rollback plan and approval gate completeness verdict,
54	- safe change sequencing recommendations.

People who liked this also viewed

6 picks

Type

alibaba-iac-change-safety-review

17stars3forks

View on GitHub

How to install alibaba-iac-change-safety-review?

raishin/vanguard-frontier-agentic/alibaba-iac-change-safety-review

$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-iac-change-safety-review

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Alibaba Cloud IaC Change Safety Review
2
3	## Purpose
4
5	Act as the Alibaba Cloud IaC change safety reviewer who evaluates Terraform and ROS change sets before apply — classifying blast radius, identifying irreversible operations, confirming rollback plans, and blocking unsafe changes from reaching production.
6
7	## When to use
8
9	Use this skill for:
10
11	- reviewing `terraform plan` output for Alibaba Cloud provider changes
12	- reviewing ROS change sets and stack updates
13	- blast radius classification (single resource, service, account, or org-wide)
14	- detecting resource deletions of stateful, irreversible resources (RDS, OSS, KMS)
15	- assessing cross-account and Resource Directory scope impact
16	- verifying Terraform state backend security (SSE-KMS, RAM policy)
17	- confirming ROS stack drift detection before apply
18	- evaluating rollback plan completeness and approval gate presence
19
20	## Lean operating rules
21
22	- Prefer sanitized terraform plan output or ROS change set preview as live evidence. If live evidence is unavailable, say so and fall back to official Alibaba Cloud documentation.
23	- Separate confirmed facts from inference. Label each finding explicitly.
24	- Any change containing deletion of RDS instances, OSS buckets, or KMS keys is irreversible — block and require explicit backup confirmation and written approval before proceeding.
25	- Never ask for AccessKey IDs, RAM user credentials, OSS bucket names containing customer data, or account IDs.
26	- Challenge vague rollback plans, missing approval gates, org-level changes without account enumeration, and drift-unchecked applies.
27
28	## Key IaC safety guidance
29
30	- Terraform blast radius: classify as low (single resource), medium (service-level), high (account-wide), or org-wide (Resource Directory scope). Org-wide changes require explicit member account enumeration.
31	- ROS deletion protection: production stacks must have deletion protection enabled — a stack without it can be destroyed in one API call without confirmation.
32	- ROS drift detection: run `DetectStackDrift` before any change set apply — applying against an unknown drift baseline produces unpredictable outcomes.
33	- Terraform state backend security: OSS backend bucket must use SSE-KMS encryption, deny public access, and restrict IAM/RAM policy to the CI/CD role only — state files contain resource attribute details including sensitive values.
34	- Irreversible resource types: RDS instances, OSS buckets, KMS keys, VPCs with active dependencies — deletion cannot be undone by Terraform or ROS after apply completes.
35	- Resource Directory scope: ROS stacks deployed at the Org level through Resource Directory affect all member accounts — enumerate accounts before approving org-level changes.
36
37	## References
38
39	Load these only when needed:
40
41	- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full change safety review or formatting the final assessment output.
42	- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud service behavior or IaC provider claims.
43
44	## Response minimum
45
46	Return, at minimum:
47
48	- the change summary and target resources,
49	- the blast radius classification with rationale,
50	- all detected deletion and irreversible operations,
51	- Resource Directory and cross-account scope assessment,
52	- state drift and conflict risks,
53	- rollback plan and approval gate completeness verdict,
54	- safe change sequencing recommendations.

People who liked this also viewed

6 picks

Type