skills.rest
psmfd
psmfdOFFICIAL
Explore all skills by this author →
GitHub

aws-expert

Generates AWS infrastructure recommendations covering IAM, S3, Route 53, VPC, EKS, ECR, ECS, Beanstalk, and MSK.

Updated Jun 24, 2026
Search Tags:#aws#infrastructure#terraform#eks#iam#cloud architecture#vpc
One-click install
npx skills add https://github.com/psmfd/pi-config --skill aws-expert-psmfd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: aws-expert
Source: https://github.com/psmfd/pi-config/tree/main/agent/skills/aws-expert
Command: npx skills add https://github.com/psmfd/pi-config --skill aws-expert-psmfd

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Designing AWS infrastructure requires navigating hundreds of services, conflicting documentation versions, and subtle IAM/networking pitfalls. This Skill provides a read-only AWS reference that researches first-party AWS documentation and produces structured, least-privilege infrastructure recommendations with implementation snippets. ## Core Features & Use Cases - Multi-service reference: Covers IAM/IRSA/Pod Identity, S3, Route 53, VPC networking (Endpoints, PrivateLink, Transit Gateway), EKS, ECR, ECS, Elastic Beanstalk, and MSK with per-service deep-dive reference files. - Source authority hierarchy: Prioritizes AWS docs, CLI v2 reference, API reference, and Well-Architected Framework over community sources, and documents conflicts between first-party sources. - Pitfall detection: Surfaces common cross-service traps such as NAT Gateway data-processing costs, ECS task vs execution role confusion, EKS aws-auth vs Access Entries drift, and MSK Provisioned vs Serverless auth mismatches. - Use Case: Ask how to give EKS pods access to S3, and receive a Pod Identity vs IRSA comparison, a scoped IAM trust policy with Condition keys, Terraform snippets, and cost/networking considerations. ## Quick Start Ask the aws-expert skill how to configure private EKS worker nodes to pull images from ECR without a NAT Gateway.

Frequently Asked Questions about aws-expert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I give EKS pods IAM permissions with IRSA or Pod Identity?▼

IRSA requires a per-cluster OIDC provider in IAM and a role trust policy scoped to the service account subject. Pod Identity is the newer alternative using the pods.eks.amazonaws.com principal and a per-cluster agent, and is recommended for greenfield clusters.

What is the difference between ECS task role and execution role?▼

The task IAM role is used by application code to call AWS APIs like S3 or DynamoDB. The task execution role is used by the ECS agent to pull images from ECR and write logs to CloudWatch. Both are required and are not interchangeable.

Should I use MSK Provisioned or MSK Serverless?▼

MSK Serverless bills per throughput and supports IAM authentication only, suiting variable workloads. MSK Provisioned bills per broker and supports IAM, SASL/SCRAM, and mTLS, suiting sustained high-throughput or non-IAM client requirements.

How do private subnets reach AWS services without a NAT Gateway?▼

Use VPC Gateway Endpoints for S3 and DynamoDB, which are free, and Interface Endpoints (PrivateLink) for other services. This avoids NAT per-GB data-processing charges for workloads that only call AWS APIs.

Why does cross-account S3 access fail even with IAM permissions?▼

Cross-account S3 access requires both an IAM allow on the caller and an explicit allow in the target bucket policy. For KMS-encrypted buckets, the caller also needs kms:Decrypt and the KMS key policy must permit the role.

When should I avoid Elastic Beanstalk for new workloads?▼

Beanstalk is not recommended for greenfield container workloads, which fit App Runner, ECS, or EKS better, nor for workloads needing per-pod IAM. It remains reasonable for existing Beanstalk deployments where migration cost exceeds maintenance cost.

Related Skills

Explore More Software Engineering Skills→
platform-engineering-labsplatform-engineering-labs
5

formae-targets

Query and display configured cloud targets grouped by namespace.

Official
Basic
engineers-hub-ltd-in-house-projectengineers-hub-ltd-in-house-project

iac-cicd

Automate Terraform and CDK deployments through CI/CD pipelines with OIDC authentication.

Official
Advanced
OM-bit-hubOM-bit-hub

Design VPC

Plan AWS VPC architectures with CIDR, subnets, routing, and NAT.

Community
Advanced
igpastorigpastor

infra-code

Generates Terraform, Kubernetes manifest, Helm chart, CloudFormation, Compose, and Ansible templates from input parameters.

Community
Advanced