skills.rest
aws-samples
aws-samplesOFFICIAL
Explore all skills by this author →
WebsiteGitHub

migration-security

Plan cross-region migration of AWS security services including ACM, KMS, IAM Identity Center, and WAF.

3|Updated Mar 24, 2026
Search Tags:#security#migration#iam#waf#kms#acm#cross-region
One-click install
npx skills add https://github.com/aws-samples/sample-migration-agentic-cli-assistant --skill migration-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: migration-security
Source: https://github.com/aws-samples/sample-migration-agentic-cli-assistant/tree/main/.kiro/skills/migration-security
Command: npx skills add https://github.com/aws-samples/sample-migration-agentic-cli-assistant --skill migration-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Secure, reliable migration of security-critical resources across AWS regions, coordinating certificates, encryption keys, and identity services to preserve trust and access during DR and failover.

Core Features & Use Cases

  • Cross-region ACM certificate planning, including DNS validation and Private CA scenarios.
  • Re-encryption and key management for AWS KMS and dependent resources across regions.
  • Encryption SDK key management workflows to support cross-region data protection.
  • IAM Identity Center multi-region replication with SAML and STS endpoint alignment.
  • WAF WebACL cloning and regional endpoint failover strategies.
  • DR readiness guidance, validation, and post-migration verification of security configurations.

Quick Start

Outline a cross-region migration plan for ACM certificates, KMS keys, and IAM Identity Center configurations, then validate post-migration security alignment.

Frequently Asked Questions about migration-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I plan a cross-region migration for ACM certificates and KMS keys?▼

Cross-region migration for ACM certificates and KMS keys requires planning certificate re-issuance with DNS validation and key re-encryption workflows. This coordinates regional resource provisioning and secure key handling to preserve data protection during failover.

What is the best way to replicate IAM Identity Center across AWS regions?▼

Replicating IAM Identity Center across regions involves multi-region configuration with SAML and STS endpoint alignment. This ensures identity service replication preserves access coordination during disaster recovery and regional failover.

Can I clone WAF WebACLs for regional endpoint failover?▼

Yes, WAF WebACLs can be cloned for regional endpoint failover. This applies to cases where resources span multiple AWS regions, supporting protocol failover and validation in the target region to maintain security boundaries.

How does cross-region KMS key re-encryption work for dependent resources?▼

Cross-region KMS key re-encryption involves re-encrypting data and managing dependent resources across AWS regions. It leverages Encryption SDK key management workflows to support cross-region data protection and secure key handling during migration.

Do I need post-migration validation for security configurations after moving to a new region?▼

Post-migration validation is required to verify security configurations after moving to a new region. It satisfies requirements for policy and access alignment, DR readiness guidance, and monitoring of security services like certificates and identity endpoints.

When should I consider Private CA scenarios for cross-region ACM certificate planning?▼

Private CA scenarios are considered for cross-region ACM certificate planning when managing internal trust anchors. This involves coordinating certificate re-issuance, DNS validation, and regional resource provisioning to maintain secure communications during failover.

Related Skills

Explore More Software Engineering Skills→
subhamay-bhattacharyyasubhamay-bhattacharyya

aws-config-iam-policies

Create and validate AWS IAM policies for Snowflake data lake access.

Official
Intermediate
masermediagroup-stackmasermediagroup-stack
1

planning-disaster-recovery

Design disaster recovery strategies with RTO/RPO planning, backups, and chaos testing.

Community
Advanced
masermediagroup-stackmasermediagroup-stack
1

managing-dns

Automate multi-provider DNS configuration and propagation strategy for Kubernetes and IaC workflows.

Community
Advanced
bipinksbipinks
3

backup-disaster-recovery

Plan backup and disaster recovery strategies for multi-region IT systems.

Community
Advanced