AWS Infrastructure

Use this skill when designing, provisioning, or operating AWS cloud infrastructure using OpenTofu v1.13+ with client-side KMS state encryption, Crossplane v2.4+ Go compositions, Bottlerocket distroless EKS nodes, AWS IAM Zero-Trust, Karpenter v1.x autoscaling (or managed EKS Auto Mode), Graviton5/Trainium3/Inferentia2 compute, and Amazon Bedrock PrivateLink isolation.

When to Use

• provisioning VPCs, Bottlerocket EKS clusters, Aurora/RDS, or S3 storage via OpenTofu or Crossplane
• authoring IAM roles with EKS Pod Identity (v1.31+) or Control Tower Service Control Policies (SCPs)
• deploying sidecarless service networking via AWS VPC Lattice (Gateway API) and IAM SigV4 auth
• configuring Karpenter v1.x declarative autoscaling (EKS Auto Mode as the managed default) with Graviton5 (c9g, m9g, r9g) and Spot fleets
• provisioning Amazon Bedrock PrivateLink VPC endpoints with Guardrails v2 (contextual grounding >= 0.7)
• enforcing FinOps cost allocation tags (team, service, environment, cost-center) at apply time
• emitting the aws-infra-spec.json machine handoff for downstream DevOps or System Engineers

Example (OpenTofu KMS & Bottlerocket EKS)