aws-resilience-lifecycle
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- Least Privilege and IAM Security: The skill consistently recommends scoping IAM roles for Resilience Hub, FIS, and ARC to only the specific actions and resources required, explicitly advising against broad wildcard permissions. It also suggests using short-lived credentials (IAM roles, SSO) for sensitive operations.
- Human-in-the-Loop Safeguards: The instructions mandate that the agent must present fully-rendered experiment templates to the user and receive explicit confirmation before starting destructive Fault Injection Service (FIS) experiments.
- Data Protection Controls: The skill provides guidance on securing sensitive artifacts, recommending SSE-KMS encryption and TLS-enforced bucket policies for assessment reports and Terraform state files stored in S3.
- Operational Safety Guardrails: Mandatory safety requirements are included, such as enforcing stop conditions for all FIS experiments to bound blast radius and requiring safety rules for ARC routing controls to prevent accidental total traffic loss.
- Controlled Environment Interaction: The skill checks for the presence of local CLI tools using benign commands like
command -v awsand delegates complex operations to specific companion skills, maintaining a modular and predictable execution flow. - Hallucination Prevention: The inclusion of an API quick reference with a 'Hallucination Rejection Table' ensures that the agent uses correct, valid AWS CLI operations, reducing the risk of generating invalid or unintended commands.
Audit Metadata