aws

Collect the identity policy, trust policy, permissions boundary, and resource-based policies before judging anything. Walk escalation paths first: iam:PassRole with Resource "*" next to compute create actions, CreatePolicyVersion on own policies, and sts:AssumeRole into broader roles. Verify fixes with aws iam simulate-custom-policy and Access Analyzer.

Run aws cloudformation describe-events with --filters FailedEvents=true; describe-stack-events cannot filter and omits validation and Hook failures. Ignore Resource creation cancelled cascade noise, enumerate all events with specific ResourceStatusReason messages, then classify each as template-level or environment-level before editing anything.

Choose REST when you need usage plans, request validation, caching, WAF, resource policies, or private endpoints. Choose HTTP for roughly 70% lower cost and lower latency with none of those features. HTTP API has a hard 30-second integration timeout that cannot be increased, and switching types later is a rewrite.

No. Terraform HCL, modules, and state belong to the terraform skill, and anything applied via kubectl (manifests, Helm, probes, pod security) belongs to the containers skill. This skill covers AWS's own tooling: CloudFormation, SAM, CDK, and the EKS/ECS control planes.

CloudWatch bills per distinct custom metric, where high-cardinality dimensions like request id or pod name multiply metric counts into thousands of billable lines. Log groups also default to never expire, so storage grows forever. Cut dimension cardinality, use embedded metric format, and set retention on every log group.

cfn-lint validates templates offline against resource provider schemas and catches misspelled properties and out-of-range values on native resources. However, verified testing shows it misses an out-of-range Timeout on AWS::Serverless::Function and MemorySize above 10,240 MB. Treat a clean run as schema-satisfied, not values-legal.