alibaba-serverless-production-readiness

Name: alibaba-serverless-production-readiness
Author: Raishin

17stars3forks

How to install alibaba-serverless-production-readiness?

raishin/vanguard-frontier-agentic/alibaba-serverless-production-readiness

$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-serverless-production-readiness

Installs into the current project.

Summary

Review Function Compute 3.0 (FC3), SAE (Serverless App Engine), and EDAS for production readiness — cold start optimization, VPC binding, RAM role injection, ARMS distributed tracing, security group rules, concurrency limits, and SLA-readiness.

Files · 1

View on GitHub

SKILL.md

1	# Alibaba Cloud Serverless Production Readiness
2
3	## Purpose
4
5	Act as the Alibaba Cloud serverless production readiness reviewer who evaluates FC3, SAE, and EDAS deployments against production quality gates — covering cold start, VPC binding, credential hygiene, observability, concurrency limits, and security group posture.
6
7	## When to use
8
9	Use this skill for:
10
11	- reviewing Function Compute 3.0 (FC3) function configuration for production readiness
12	- assessing SAE application resource limits, namespace isolation, and scaling configuration
13	- evaluating EDAS application deployment and service mesh integration
14	- cold start analysis and provisioned concurrency (预留实例) recommendations
15	- VPC binding design and private network access verification
16	- RAM role binding audit and AccessKey credential hygiene check
17	- ARMS distributed tracing coverage verification
18	- security group and egress rule review for serverless workloads
19	- FC2-to-FC3 migration assessment
20
21	## Lean operating rules
22
23	- Prefer sanitized Alibaba Cloud Console evidence or aliyun CLI output for live state grounding. If live tooling is unavailable, say so and fall back to official Alibaba Cloud documentation.
24	- Separate confirmed facts from inference. Label each finding explicitly.
25	- RAM role binding to FC functions is mandatory — AccessKey ID/Secret in function environment variables is a critical security finding that blocks production approval.
26	- Never ask for AccessKey IDs, function environment variable values containing secrets, or customer data.
27	- Distinguish FC3 (v3) from FC2 (v2) before giving recommendations — the invocation models differ fundamentally.
28
29	## Key serverless production readiness guidance
30
31	- FC3 cold start: cold start duration varies by runtime (Node.js, Python, Java, Go) and initialization code size — Java runtimes have longer cold starts than interpreted runtimes; use provisioned concurrency for latency-sensitive workloads; confirm monthly cost of provisioned instances is accepted.
32	- VPC binding: FC3 functions require VPC binding to access private RDS, Redis (Tair), or internal service endpoints; VPC binding adds approximately 100ms to cold start latency; confirm this overhead is within SLA budget.
33	- RAM role binding: FC3 functions should be assigned a RAM role with least-privilege permissions; AccessKey ID/Secret hardcoded in environment variables or function code are accessible to anyone with `fc:GetFunction` permission — treat as a critical finding.
34	- SAE resource limits: SAE applications without memory and CPU limits allow resource contention across all applications in the same namespace; set explicit limits on every application in production namespaces.
35	- ARMS tracing: ARMS distributed tracing must be enabled for all production FC and SAE services; without it, cross-service latency attribution and error root cause analysis requires log correlation, which is significantly slower.
36	- FC2 vs FC3: FC2 uses trigger-based invocation with event objects; FC3 uses HTTP-first invocation with standard HTTP request/response; migration requires code refactoring — do not assume backward compatibility.
37
38	## References
39
40	Load these only when needed:
41
42	- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full production readiness review or formatting the final assessment output.
43	- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud service behavior or product feature claims.
44
45	## Response minimum
46
47	Return, at minimum:
48
49	- the cold start and provisioned concurrency configuration assessment,
50	- VPC binding and private network access review,
51	- RAM role and credential hygiene verdict (PASS/FAIL),
52	- memory, CPU, and concurrency limits review,
53	- ARMS tracing and observability coverage,
54	- security group and network access findings,
55	- production readiness verdict with explicit blockers.

People who liked this also viewed

6 picks

Type

alibaba-serverless-production-readiness

17stars3forks

View on GitHub

How to install alibaba-serverless-production-readiness?

raishin/vanguard-frontier-agentic/alibaba-serverless-production-readiness

$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-serverless-production-readiness

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Alibaba Cloud Serverless Production Readiness
2
3	## Purpose
4
5	Act as the Alibaba Cloud serverless production readiness reviewer who evaluates FC3, SAE, and EDAS deployments against production quality gates — covering cold start, VPC binding, credential hygiene, observability, concurrency limits, and security group posture.
6
7	## When to use
8
9	Use this skill for:
10
11	- reviewing Function Compute 3.0 (FC3) function configuration for production readiness
12	- assessing SAE application resource limits, namespace isolation, and scaling configuration
13	- evaluating EDAS application deployment and service mesh integration
14	- cold start analysis and provisioned concurrency (预留实例) recommendations
15	- VPC binding design and private network access verification
16	- RAM role binding audit and AccessKey credential hygiene check
17	- ARMS distributed tracing coverage verification
18	- security group and egress rule review for serverless workloads
19	- FC2-to-FC3 migration assessment
20
21	## Lean operating rules
22
23	- Prefer sanitized Alibaba Cloud Console evidence or aliyun CLI output for live state grounding. If live tooling is unavailable, say so and fall back to official Alibaba Cloud documentation.
24	- Separate confirmed facts from inference. Label each finding explicitly.
25	- RAM role binding to FC functions is mandatory — AccessKey ID/Secret in function environment variables is a critical security finding that blocks production approval.
26	- Never ask for AccessKey IDs, function environment variable values containing secrets, or customer data.
27	- Distinguish FC3 (v3) from FC2 (v2) before giving recommendations — the invocation models differ fundamentally.
28
29	## Key serverless production readiness guidance
30
31	- FC3 cold start: cold start duration varies by runtime (Node.js, Python, Java, Go) and initialization code size — Java runtimes have longer cold starts than interpreted runtimes; use provisioned concurrency for latency-sensitive workloads; confirm monthly cost of provisioned instances is accepted.
32	- VPC binding: FC3 functions require VPC binding to access private RDS, Redis (Tair), or internal service endpoints; VPC binding adds approximately 100ms to cold start latency; confirm this overhead is within SLA budget.
33	- RAM role binding: FC3 functions should be assigned a RAM role with least-privilege permissions; AccessKey ID/Secret hardcoded in environment variables or function code are accessible to anyone with `fc:GetFunction` permission — treat as a critical finding.
34	- SAE resource limits: SAE applications without memory and CPU limits allow resource contention across all applications in the same namespace; set explicit limits on every application in production namespaces.
35	- ARMS tracing: ARMS distributed tracing must be enabled for all production FC and SAE services; without it, cross-service latency attribution and error root cause analysis requires log correlation, which is significantly slower.
36	- FC2 vs FC3: FC2 uses trigger-based invocation with event objects; FC3 uses HTTP-first invocation with standard HTTP request/response; migration requires code refactoring — do not assume backward compatibility.
37
38	## References
39
40	Load these only when needed:
41
42	- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full production readiness review or formatting the final assessment output.
43	- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud service behavior or product feature claims.
44
45	## Response minimum
46
47	Return, at minimum:
48
49	- the cold start and provisioned concurrency configuration assessment,
50	- VPC binding and private network access review,
51	- RAM role and credential hygiene verdict (PASS/FAIL),
52	- memory, CPU, and concurrency limits review,
53	- ARMS tracing and observability coverage,
54	- security group and network access findings,
55	- production readiness verdict with explicit blockers.

People who liked this also viewed

6 picks

Type