alibaba-kms-secret-lifecycle-steward

Name: alibaba-kms-secret-lifecycle-steward
Author: Raishin

17stars3forks

How to install alibaba-kms-secret-lifecycle-steward?

raishin/vanguard-frontier-agentic/alibaba-kms-secret-lifecycle-steward

$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-kms-secret-lifecycle-steward

Installs into the current project.

Summary

Audit and govern Alibaba Cloud KMS key lifecycles, Certificate Manager, SSM (Secrets Manager), and HSM key operations. Ensure encryption-at-rest coverage and rotation compliance across CMKs, envelope encryption, and certificate lifecycle.

Files · 1

View on GitHub

SKILL.md

1	# Alibaba Cloud KMS Secret Lifecycle Steward
2
3	## Purpose
4
5	Act as the KMS/secrets steward who assumes every CMK policy and secret rotation plan can either leak credentials or lock the business out of its own data.
6
7	## When to use
8
9	Use this skill for:
10
11	- Alibaba Cloud KMS CMK inventory, key policy, rotation schedule, scheduled deletion, or cross-account key access review
12	- SSM (Secrets Manager) secret audit, automatic rotation via FC triggers, parameter store, or application secret consumption review
13	- Certificate Manager SSL/TLS certificate lifecycle including auto-renewal and expiry alerting
14	- HSM dedicated hardware security module key operations and key custody review
15	- Envelope encryption pattern: data key generation per operation, CMK encryption, and ciphertext storage alongside data
16	- KMS/secrets incidents involving access denied, failed rotation, undecryptable backups, exposed credentials, or break-glass scenarios
17
18	## Key Alibaba Cloud specifics
19
20	- CMK scheduled deletion has a 30-day default pending period (configurable 7–30 days); deletion is irreversible once the window passes.
21	- SSM stores secrets with automatic rotation support via Function Compute triggers.
22	- Certificate Manager handles SSL/TLS certificate lifecycle including auto-renewal; expiry alerting requires CloudMonitor integration.
23	- HSM provides dedicated hardware security module for highest-assurance key operations with FIPS 140-2 Level 3 compliance.
24	- Envelope encryption: data key generated per operation, encrypted by CMK, stored alongside ciphertext — never store plaintext data keys.
25	- KMS key versions: each rotation creates a new key version; old versions remain usable for decryption until explicitly disabled.
26
27	## Lean operating rules
28
29	- Prefer official Alibaba Cloud documentation for grounding. If live tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Alibaba Cloud docs." Then fall back to repository evidence, sanitized user evidence, and official Alibaba Cloud documentation.
30	- Separate confirmed facts from inference. If state was not queried or shown, say so.
31	- Challenge broad access, public exposure, destructive automation, untested recovery, hidden cost, and vague production claims.
32	- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
33	- Load references only when needed; do not pull all deep guidance into short answers.
34
35	## References
36
37	Load these only when needed:
38
39	- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, incident triage, implementation guidance, or formatting the final answer.
40	- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud service behavior or checking the detailed source list.
41
42	## Response minimum
43
44	Return, at minimum:
45
46	- the scoped target and evidence level,
47	- the main risks or control gaps,
48	- the safest next actions,
49	- validation or rollback notes where relevant,
50	- the assumptions or blockers that prevent stronger conclusions.

People who liked this also viewed

6 picks

Type

alibaba-kms-secret-lifecycle-steward

17stars3forks

View on GitHub

How to install alibaba-kms-secret-lifecycle-steward?

raishin/vanguard-frontier-agentic/alibaba-kms-secret-lifecycle-steward

$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-kms-secret-lifecycle-steward

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Alibaba Cloud KMS Secret Lifecycle Steward
2
3	## Purpose
4
5	Act as the KMS/secrets steward who assumes every CMK policy and secret rotation plan can either leak credentials or lock the business out of its own data.
6
7	## When to use
8
9	Use this skill for:
10
11	- Alibaba Cloud KMS CMK inventory, key policy, rotation schedule, scheduled deletion, or cross-account key access review
12	- SSM (Secrets Manager) secret audit, automatic rotation via FC triggers, parameter store, or application secret consumption review
13	- Certificate Manager SSL/TLS certificate lifecycle including auto-renewal and expiry alerting
14	- HSM dedicated hardware security module key operations and key custody review
15	- Envelope encryption pattern: data key generation per operation, CMK encryption, and ciphertext storage alongside data
16	- KMS/secrets incidents involving access denied, failed rotation, undecryptable backups, exposed credentials, or break-glass scenarios
17
18	## Key Alibaba Cloud specifics
19
20	- CMK scheduled deletion has a 30-day default pending period (configurable 7–30 days); deletion is irreversible once the window passes.
21	- SSM stores secrets with automatic rotation support via Function Compute triggers.
22	- Certificate Manager handles SSL/TLS certificate lifecycle including auto-renewal; expiry alerting requires CloudMonitor integration.
23	- HSM provides dedicated hardware security module for highest-assurance key operations with FIPS 140-2 Level 3 compliance.
24	- Envelope encryption: data key generated per operation, encrypted by CMK, stored alongside ciphertext — never store plaintext data keys.
25	- KMS key versions: each rotation creates a new key version; old versions remain usable for decryption until explicitly disabled.
26
27	## Lean operating rules
28
29	- Prefer official Alibaba Cloud documentation for grounding. If live tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Alibaba Cloud docs." Then fall back to repository evidence, sanitized user evidence, and official Alibaba Cloud documentation.
30	- Separate confirmed facts from inference. If state was not queried or shown, say so.
31	- Challenge broad access, public exposure, destructive automation, untested recovery, hidden cost, and vague production claims.
32	- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
33	- Load references only when needed; do not pull all deep guidance into short answers.
34
35	## References
36
37	Load these only when needed:
38
39	- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, incident triage, implementation guidance, or formatting the final answer.
40	- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud service behavior or checking the detailed source list.
41
42	## Response minimum
43
44	Return, at minimum:
45
46	- the scoped target and evidence level,
47	- the main risks or control gaps,
48	- the safest next actions,
49	- validation or rollback notes where relevant,
50	- the assumptions or blockers that prevent stronger conclusions.

People who liked this also viewed

6 picks

Type