The Agent Skills Directory

[Infrastructure Best Practices]: The skill advocates for modern AWS management techniques, such as using launch templates instead of deprecated launch configurations and enforcing IMDSv2 to protect against SSRF-based credential theft.
[Credential Management]: Includes clear instructions to use IAM instance profiles instead of hardcoded credentials and warns against storing secrets in EC2 user data, which is an unencrypted and accessible metadata field.
[Secure Remote Access]: Promotes Systems Manager Session Manager as a secure, keyless alternative to inbound SSH, reducing the attack surface by eliminating the need for open port 22 and bastion hosts.
[Command Injection Awareness]: Explicitly warns users to sanitize and validate external input before incorporating it into Systems Manager Run Command parameters, addressing potential indirect prompt injection and command execution risks.
[Data Protection]: Provides detailed guidance on EBS and AMI encryption, including cross-account sharing requirements for KMS keys, ensuring that data is protected at rest and during transit.
[Audit and Monitoring]: Recommends enabling CloudTrail and detailed CloudWatch monitoring to maintain an audit trail of all EC2, ASG, and SSM API activity, facilitating the detection of unauthorized changes.

aws-compute