alibaba-live-kms-key-mutation-guard

Name: alibaba-live-kms-key-mutation-guard
Author: Raishin

17stars3forks

How to install alibaba-live-kms-key-mutation-guard?

raishin/vanguard-frontier-agentic/alibaba-live-kms-key-mutation-guard

$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-live-kms-key-mutation-guard

Installs into the current project.

Summary

Gate KMS key deletion and disable operations. All data encrypted with a deleted CMK (OSS SSE-KMS, ECS encrypted disks, RDS/PolarDB TDE) becomes permanently and irrecoverably inaccessible. This guard enforces complete CMK dependency audits, deletion window confirmation, and explic

Files · 1

View on GitHub

SKILL.md

1	# Alibaba Cloud Live KMS Key Mutation Guard
2
3	## Purpose
4
5	Act as the guarded live Alibaba Cloud operator for alibaba-live-kms-key-mutation-guard work. Gate every KMS key deletion and disable operation with a complete CMK dependency audit and explicit operator approval. Treat key deletion as an irreversible, permanent data-access loss event.
6
7	## When to Use
8
9	Use this skill when:
10
11	- A KMS CMK (Customer Master Key) deletion is requested or scheduled
12	- A KMS CMK is being disabled
13	- A pending key deletion needs to be cancelled
14	- A key rotation is being configured or triggered
15	- An operator needs to audit CMK-dependent resources before a key operation
16	- A key is being re-enabled after a disable operation
17
18	## When NOT to Use
19
20	Do not use this skill when:
21
22	- The task is a read-only KMS audit with no mutation intent
23	- The task involves only alias operations (alias creation/deletion does not affect key availability)
24	- The task is creating a new CMK (no existing data at risk)
25	- The task involves envelope encryption key management at the application layer with no KMS API calls
26
27	## Key State Model
28
29	Alibaba Cloud KMS keys have the following states:
30
31	- Enabled: Key is active and can be used for encryption/decryption.
32	- Disabled: Key cannot be used for new encryption or decryption operations. This is reversible — re-enable restores full functionality. Existing encrypted data remains accessible once re-enabled.
33	- PendingDeletion: Key is scheduled for deletion. The deletion window is 7–30 days (default: 30 days). This can be cancelled during the pending window.
34	- Deleted: Key has been permanently destroyed. All encrypted data is irrecoverable.
35
36	Always recommend disable over deletion when the operator is uncertain about CMK dependencies.
37
38	## CMK Dependency Categories
39
40	Before any key deletion or disable, audit ALL of the following:
41
42	- OSS SSE-KMS: Buckets using this CMK for server-side encryption. Objects become inaccessible if the key is deleted.
43	- ECS Encrypted Disks: System and data disks encrypted with this CMK. Instances cannot decrypt disk data.
44	- ECS Snapshot Encryption: Snapshots created from encrypted disks using this CMK.
45	- RDS Transparent Data Encryption (TDE): RDS instances with TDE enabled using this CMK.
46	- PolarDB TDE: PolarDB clusters with TDE using this CMK.
47	- SLB/ALB HTTPS Certificates: Certificates stored in KMS used by load balancers.
48	- Secrets Manager (SSM): Secrets encrypted with this CMK.
49
50	## Pre-Flight Checklist
51
52	Before executing any KMS key mutation, verify all of the following:
53
54	1. Key identity confirmed — confirm the exact key ID (not alias). Run `aliyun kms DescribeKey --KeyId <KEY_ID>` to confirm key metadata, current state, and region.
55	2. Active RAM principal confirmed — confirm the identity has `AliyunKMSFullAccess` assumed via STS for this specific operation.
56	3. CMK dependency audit complete — enumerate all OSS buckets, ECS disks, RDS instances, PolarDB clusters, and SSM secrets using this key. This audit must be complete before any mutation.
57	4. Key state assessed — confirm whether the key is Enabled, Disabled, or already in PendingDeletion state.
58	5. Disable vs. delete decision — if the operator is uncertain about dependencies, recommend disable first. Only proceed to deletion after all dependencies are migrated or confirmed non-critical.
59	6. Deletion window confirmed — if proceeding with deletion, confirm the scheduled deletion window (7–30 days). Default is 30 days.
60	7. Rollback plan — for disable: re-enable is the rollback. For deletion: no rollback after the window expires.
61
62	## Required Confirmation
63
64	The operator must explicitly state all of the following before any mutation is executed:
65
66	- "I confirm the key is `<KEY_ID>` in region `<REGION>` in account `<ACCOUNT_ID>`."
67	- "I have completed the CMK dependency audit and the following dependencies are confirmed: `<list or NONE>`."
68	- "I understand that key deletion is permanent after the `<N>`-day deletion window and all dependent encrypted data will be irrecoverable."
69	- "I approve this key `<disable / deletion>` action."
70	- For deletion: "I confirm all CMK-dependent data has been migrated or is non-critical."
71
72	## Execution Steps
73
74	1. Capture pre-change key state: `aliyun kms DescribeKey --KeyId <KEY_ID>`.
75	2. Enumerate CMK dependencies (see CMK Dependency Categories above).
76	3. Present the planned change, dependency audit results, and deletion window t

People who liked this also viewed

6 picks

Type

alibaba-live-kms-key-mutation-guard

17stars3forks

View on GitHub

How to install alibaba-live-kms-key-mutation-guard?

raishin/vanguard-frontier-agentic/alibaba-live-kms-key-mutation-guard

$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-live-kms-key-mutation-guard

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Alibaba Cloud Live KMS Key Mutation Guard
2
3	## Purpose
4
5	Act as the guarded live Alibaba Cloud operator for alibaba-live-kms-key-mutation-guard work. Gate every KMS key deletion and disable operation with a complete CMK dependency audit and explicit operator approval. Treat key deletion as an irreversible, permanent data-access loss event.
6
7	## When to Use
8
9	Use this skill when:
10
11	- A KMS CMK (Customer Master Key) deletion is requested or scheduled
12	- A KMS CMK is being disabled
13	- A pending key deletion needs to be cancelled
14	- A key rotation is being configured or triggered
15	- An operator needs to audit CMK-dependent resources before a key operation
16	- A key is being re-enabled after a disable operation
17
18	## When NOT to Use
19
20	Do not use this skill when:
21
22	- The task is a read-only KMS audit with no mutation intent
23	- The task involves only alias operations (alias creation/deletion does not affect key availability)
24	- The task is creating a new CMK (no existing data at risk)
25	- The task involves envelope encryption key management at the application layer with no KMS API calls
26
27	## Key State Model
28
29	Alibaba Cloud KMS keys have the following states:
30
31	- Enabled: Key is active and can be used for encryption/decryption.
32	- Disabled: Key cannot be used for new encryption or decryption operations. This is reversible — re-enable restores full functionality. Existing encrypted data remains accessible once re-enabled.
33	- PendingDeletion: Key is scheduled for deletion. The deletion window is 7–30 days (default: 30 days). This can be cancelled during the pending window.
34	- Deleted: Key has been permanently destroyed. All encrypted data is irrecoverable.
35
36	Always recommend disable over deletion when the operator is uncertain about CMK dependencies.
37
38	## CMK Dependency Categories
39
40	Before any key deletion or disable, audit ALL of the following:
41
42	- OSS SSE-KMS: Buckets using this CMK for server-side encryption. Objects become inaccessible if the key is deleted.
43	- ECS Encrypted Disks: System and data disks encrypted with this CMK. Instances cannot decrypt disk data.
44	- ECS Snapshot Encryption: Snapshots created from encrypted disks using this CMK.
45	- RDS Transparent Data Encryption (TDE): RDS instances with TDE enabled using this CMK.
46	- PolarDB TDE: PolarDB clusters with TDE using this CMK.
47	- SLB/ALB HTTPS Certificates: Certificates stored in KMS used by load balancers.
48	- Secrets Manager (SSM): Secrets encrypted with this CMK.
49
50	## Pre-Flight Checklist
51
52	Before executing any KMS key mutation, verify all of the following:
53
54	1. Key identity confirmed — confirm the exact key ID (not alias). Run `aliyun kms DescribeKey --KeyId <KEY_ID>` to confirm key metadata, current state, and region.
55	2. Active RAM principal confirmed — confirm the identity has `AliyunKMSFullAccess` assumed via STS for this specific operation.
56	3. CMK dependency audit complete — enumerate all OSS buckets, ECS disks, RDS instances, PolarDB clusters, and SSM secrets using this key. This audit must be complete before any mutation.
57	4. Key state assessed — confirm whether the key is Enabled, Disabled, or already in PendingDeletion state.
58	5. Disable vs. delete decision — if the operator is uncertain about dependencies, recommend disable first. Only proceed to deletion after all dependencies are migrated or confirmed non-critical.
59	6. Deletion window confirmed — if proceeding with deletion, confirm the scheduled deletion window (7–30 days). Default is 30 days.
60	7. Rollback plan — for disable: re-enable is the rollback. For deletion: no rollback after the window expires.
61
62	## Required Confirmation
63
64	The operator must explicitly state all of the following before any mutation is executed:
65
66	- "I confirm the key is `<KEY_ID>` in region `<REGION>` in account `<ACCOUNT_ID>`."
67	- "I have completed the CMK dependency audit and the following dependencies are confirmed: `<list or NONE>`."
68	- "I understand that key deletion is permanent after the `<N>`-day deletion window and all dependent encrypted data will be irrecoverable."
69	- "I approve this key `<disable / deletion>` action."
70	- For deletion: "I confirm all CMK-dependent data has been migrated or is non-critical."
71
72	## Execution Steps
73
74	1. Capture pre-change key state: `aliyun kms DescribeKey --KeyId <KEY_ID>`.
75	2. Enumerate CMK dependencies (see CMK Dependency Categories above).
76	3. Present the planned change, dependency audit results, and deletion window t

People who liked this also viewed

6 picks

Type