nitinjain999/platform-skills/aws

AWS Command

Structured guidance for AWS CloudFront, WAF, Lambda@Edge, and multi-account security patterns.

Interactive Wizard (fires when no mode is provided)

When invoked with no arguments, ask before proceeding:

Q1 — Mode?

What do you need?
  1. cloudfront   — distributions, OAC, cache policies, security headers, Lambda@Edge
  2. waf          — web ACLs, managed rule groups, rate limiting, false positive tuning
  3. lambda-edge  — CloudFront Functions vs Lambda@Edge, viewer/origin events
  4. multi-account — Firewall Manager, cross-account OAC, FMS WAF enforcement
  5. orgs         — Organizations, SCPs, OU design, account vending, Control Tower
  6. review       — production-readiness review of CloudFront + WAF config
  7. terraform    — generate a Terraform module scaffold
 
Enter 1–7 or mode name:

Q2 — Context (after mode selected):

• cloudfront: Describe the issue or what you want to build (distribution, OAC, cache, edge function):
• waf: Describe the use case — new WebACL, false positive, adding a rule, or multi-account enforcement:
• lambda-edge: What does the edge function need to do? (auth, URL rewrite, A/B test, dynamic routing):
• multi-account: How many accounts? Do you have FMS administrator configured in the security account?
• orgs: Describe what you need — SCP enforcement, OU design, account vending, or Control Tower setup:
• review / terraform: no follow-up needed — proceed directly

Activation

Invoke with /platform-skills:aws followed by a mode, or describe your problem and the command will route automatically.

/platform-skills:aws cloudfront        # CloudFront distributions, OAC, cache, security headers
/platform-skills:aws waf               # WAF web ACLs, managed rules, rate limiting
/platform-skills:aws lambda-edge       # Lambda@Edge and CloudFront Functions
/platform-skills:aws multi-account     # Firewall Manager, cross-account, Organizations
/platform-skills:aws review            # Production-readiness review of your config
/platform-skills:aws terraform         # Generate Terraform module scaffold

Mode: cloudfront

Triggers: distribution, CDN, OAC, cache behavior, price class, CNAME, SSL, geo restriction, origin, CloudFront

Reference: references/aws-cloudfront.md

Steps:

1. Identify the problem layer:

• Origin access — OAC/OAI, S3 bucket policy, cross-account origin
• Cache — TTL, cache key, cache policy vs origin request policy
• Security — response headers, HTTPS enforcement, WAF attachment
• Edge compute — Lambda@Edge vs CloudFront Functions decision
• Logging — standard logs, real-time logs, Athena

1. Check for the common footguns:

• WAF for CloudFront must be CLOUDFRONT scope in us-east-1
• OAC not OAI — OAI is legacy; new distributions must use OAC
• Lambda@Edge must use numbered version ARN (qualified_arn), not $LATEST
• ACM certificate for custom domains must be in us-east-1

1. Provide: problem diagnosis, Terraform snippet, validation steps, rollback plan.

Key Terraform resources:

Mode: waf

Triggers: WAF, web ACL, rule group, managed rules, rate limit, Bot Control, CAPTCHA, Challenge, IP set, geo block

Reference: references/aws-waf.md

Steps:

1. Confirm scope:

• CLOUDFRONT → must use us-east-1 provider alias
• REGIONAL → same region as the protected resource

1. Classify the request:

• New WebACL → baseline rule groups + rate limit + logging
• False positive → use rule_action_override to Count the specific rule
• Adding rule → Count first, monitor 24–48h, then Block
• Performance → review sampled requests, check which rules add latency
• Multi-account → use Firewall Manager (see multi-account mode)

1. Provide: exact rule block, priority placement, visibility config, logging config.

Baseline rule groups (always include for CloudFront):

# Priority 5 — IP reputation (free)
AWSManagedRulesAmazonIpReputationList
 
# Priority 10 — Core Rule Set (free)
AWSManagedRulesCommonRuleSet
 
# Priority 15 — Known bad inputs: Log4Shell, SSRF (free)
AWSManagedRulesKnownBadInputsRuleGroup
 
# Priority 30 — Rate limit: 2000 req/5min per IP
rate_based_statement { limit = 2000; aggregate_key_type = "IP" }

Paid additions (evaluate based on risk):

• AWSManagedRulesBotControlRuleSet — bot traffic (Common or Targeted level)
• AWSManagedRulesATPRuleSet — credential stuffing on login endpoints
• AWSManagedRulesACFPRuleSet — account creation fraud on registration endpoints

Mode: lambda-edge

Triggers: Lambda@Edge, CloudFront Functions, viewer-request, origin-request, edge function, A/B test, auth at edge, URL rewrite

Reference: references/aws-cloudfront.md → Lambda@Edge section

Decision — CloudFront Functions vs Lambda@Edge:

Need network calls?                → Lambda@Edge (CloudFront Functions have no network access)
Need body access?                  → Lambda@Edge (origin events only)
Need execution > 1ms?              → Lambda@Edge
Need viewer-request/response only? → CloudFront Functions (6× cheaper)
Need complex logic / Node modules? → Lambda@Edge
Need dynamic config without deploy?→ CloudFront Functions + KeyValueStore
Simple URL rewrite / header add?   → CloudFront Functions
Auth token validation (JWT)?       → Lambda@Edge viewer-request
Dynamic origin routing?            → Lambda@Edge origin-request

Lambda@Edge checklist:

• [ ] Function authored in us-east-1
• [ ] publish = true in Terraform
• [ ] Using qualified_arn (not arn) in lambda_function_association
• [ ] IAM trust includes edgelambda.amazonaws.com AND lambda.amazonaws.com
• [ ] No VPC attachment
• [ ] No environment variables (use KeyValueStore for config)
• [ ] No $LATEST version reference
• [ ] Log group pre-created in us-east-1

Mode: multi-account

Triggers: Firewall Manager, FMS, Organizations, cross-account, OU, security account, delegated admin, centralized WAF

References: references/aws-waf.md → Multi-account section, references/aws-cloudfront.md → Multi-account patterns

Steps:

1. Confirm prerequisites:

• AWS Organizations with all features enabled
• FMS administrator account designated
• Member accounts in-scope (OU or account list)

1. Choose pattern:

1. FMS WAF policy structure:

• preProcessRuleGroups (priority 0–19) — security team, locked
• App team rules (priority 20–79) — local additions allowed
• postProcessRuleGroups (priority 80+) — security team, locked

1. Cross-account OAC pattern (shared CDN account):

• Bucket policy AWS:SourceArn scoped to distribution ARN works cross-account
• Distribution ARN includes the CDN account ID — spoke accounts are locked to that distribution

1. Provide: FMS policy Terraform, OAC cross-account bucket policy, SCP to enforce WAF attachment.

Mode: orgs

Triggers: Organizations, SCPs, OU, account vending, Control Tower, delegated admin, account factory, guardrails

Steps:

1. Identify the request:

• SCP design — what to restrict and at which OU level
• OU structure — hierarchy that reflects environment and risk boundary
• Account vending — automated account creation with baseline config
• Control Tower — managed landing zone setup and customizations

1. OU design principles:

1. Essential SCPs (apply at root or Workloads OU):

``json { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyLeavingOrg", "Effect": "Deny", "Action": "organizations:LeaveOrganization", "Resource": "*" }, { "Sid": "DenyDisableCloudTrail", "Effect": "Deny", "Action": ["cloudtrail:StopLogging", "cloudtrail:DeleteTrail"], "Resource": "*" }, { "Sid": "DenyDisableGuardDuty", "Effect": "Deny", "Action": ["guardduty:DeleteDetector", "guardduty:DisassociateFromMasterAccount"], "Resource": "*" }, { "Sid": "DenyRootUser", "Effect": "Deny", "Action": "*", "Resource": "*", "Condition": { "StringLike": { "aws:PrincipalArn": "arn:aws:iam::*:root" } } } ] } ``

1. Account vending (Account Factory for Terraform — AFT):

``hcl module "account_request" { source = "github.com/aws-ia/terraform-aws-control_tower_account_factory" control_tower_parameters = { AccountEmail = "platform+prod-payments@company.com" AccountName = "prod-payments" ManagedOrganizationalUnit = "Workloads/Prod" SSOUserEmail = "admin@company.com" } account_tags = { env = "prod", team = "payments", cost-center = "eng" } account_customizations_name = "prod-baseline" } ``

1. Delegated administrators — always delegate to a dedicated account, never the management account:

• GuardDuty: aws organizations register-delegated-administrator --service-principal guardduty.amazonaws.com
• SecurityHub: --service-principal securityhub.amazonaws.com
• FMS: designated separately via FMS console or Terraform

1. Validate SCP effect before attaching:

``bash # Simulate an action under the SCP (requires aws-cli v2) aws iam simulate-custom-policy \ --policy-input-list file://scp.json \ --action-names cloudtrail:StopLogging \ --resource-arns "*" ``

→ Next: Run /platform-skills:aws review to audit the account configuration, or /platform-skills:compliance checklist to validate SOC 2 controls across the org.

Mode: review

Triggers: review, production ready, production checklist, audit my CloudFront, audit my WAF

Structured production-readiness review. Ask for:

1. The CloudFront distribution config (Terraform or describe key settings)
2. The associated WAF WebACL config
3. The origin type (S3, ALB, custom)

Then evaluate against:

CloudFront:

• [ ] Viewer protocol: https-only or redirect-to-https
• [ ] Minimum TLS: TLSv1.2_2021
• [ ] OAC configured (not OAI, not public bucket)
• [ ] WAF attached
• [ ] Response headers policy: HSTS, X-Frame-Options, X-Content-Type-Options
• [ ] Standard logging enabled
• [ ] Price class appropriate for audience geography
• [ ] Lambda@Edge: qualified_arn used, publish = true