Agent skill

AWS Cloudformation Security

by giuseppe-trisciuoglio in giuseppe-trisciuoglio/developer-kit

Provides AWS CloudFormation patterns for security infrastructure including KMS encryption, Secrets Manager, IAM security, VPC security, ACM certificates, parameter security, outputs, and secure…

MITAuto-check: notesSecurity

Install AWS Cloudformation Security

skills CLI

$ npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-security -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install giuseppe-trisciuoglio/developer-kit aws-cloudformation-security --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/giuseppe-trisciuoglio/developer-kit.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security .claude/skills/aws-cloudformation-security && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "aws-cloudformation-security" agent skill from https://github.com/giuseppe-trisciuoglio/developer-kit/tree/main/plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security into .claude/skills/aws-cloudformation-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "aws-cloudformation-security", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/giuseppe-trisciuoglio/developer-kit/tree/main/plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-security -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install giuseppe-trisciuoglio/developer-kit aws-cloudformation-security --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/giuseppe-trisciuoglio/developer-kit.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security .agents/skills/aws-cloudformation-security && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "aws-cloudformation-security" agent skill from https://github.com/giuseppe-trisciuoglio/developer-kit/tree/main/plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security into .agents/skills/aws-cloudformation-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "aws-cloudformation-security", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-security -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install giuseppe-trisciuoglio/developer-kit aws-cloudformation-security --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/giuseppe-trisciuoglio/developer-kit.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security .cursor/skills/aws-cloudformation-security && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "aws-cloudformation-security" agent skill from https://github.com/giuseppe-trisciuoglio/developer-kit/tree/main/plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security into .cursor/skills/aws-cloudformation-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "aws-cloudformation-security", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/giuseppe-trisciuoglio/developer-kit.git --path plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-security -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install giuseppe-trisciuoglio/developer-kit aws-cloudformation-security --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/giuseppe-trisciuoglio/developer-kit.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security .gemini/skills/aws-cloudformation-security && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "aws-cloudformation-security" agent skill from https://github.com/giuseppe-trisciuoglio/developer-kit/tree/main/plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security into .gemini/skills/aws-cloudformation-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "aws-cloudformation-security", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install giuseppe-trisciuoglio/developer-kit aws-cloudformation-security

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-security -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/giuseppe-trisciuoglio/developer-kit.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security .github/skills/aws-cloudformation-security && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "aws-cloudformation-security" agent skill from https://github.com/giuseppe-trisciuoglio/developer-kit/tree/main/plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security into .github/skills/aws-cloudformation-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "aws-cloudformation-security", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-security -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install giuseppe-trisciuoglio/developer-kit aws-cloudformation-security --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/giuseppe-trisciuoglio/developer-kit.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security .opencode/skills/aws-cloudformation-security && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "aws-cloudformation-security" agent skill from https://github.com/giuseppe-trisciuoglio/developer-kit/tree/main/plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security into .opencode/skills/aws-cloudformation-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "aws-cloudformation-security", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: aws-cloudformation-security
GitHub stars: 357
Token cost: ~2.8k tokens
SKILL.md length: 532 words
Files: 4 (incl. references)
Skills in repo: 115
Repo updated: Sep 10, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Provides AWS CloudFormation patterns for security infrastructure including KMS encryption, Secrets Manager, IAM security, VPC security, ACM certificates, parameter security, outputs, and secure…

Works in 8 steps: Define KMS Encryption Keys → Manage Secrets with Secrets Manager → Apply IAM Least Privilege → …
Implementing security best practices
SKILL.md covers Overview, When to Use, Instructions and Best Practices, plus 3 more sections
Calls aws

What it does

AWS Cloudformation Security is an agent skill from giuseppe-trisciuoglio/developer-kit. Provides AWS CloudFormation patterns for security infrastructure including KMS encryption, Secrets Manager, IAM security, VPC security, ACM certificates, parameter security, outputs, and secure cross-stack references. Use when implementing security best practices, encrypting data, managing secrets, applying least privilege IAM policies, securing VPC configurations, managing TLS/SSL certificates, and implementing defense in depth strategies.

Its SKILL.md is about 2.8k tokens, which your agent loads only when the skill is triggered. The skill folder holds 4 other files, including reference files (for example `references/constraints.md`, `references/examples.md` and `references/reference.md`).

It sits in Security, covering Cloud security and Secure coding. It works with AWS CloudFormation and Amazon Web Services. The repository describes itself as: Modular plugin marketplace for Claude Code and agentic CLIs, with validated, spec-driven skills, agents, commands, and workflows for Java, TypeScript, Python, PHP, AWS, and AI. The licence is MIT.

When your agent uses it

Implementing security best practices
Encrypting data
Managing secrets
Applying least privilege IAM policies

Example prompts

“Use the aws-cloudformation-security skill to provide AWS CloudFormation patterns for security infrastructure including KMS encryption, Secrets…”
“/aws-cloudformation-security”

Requirements

Pre-approved tools (allowed-tools): Read, Write, Bash

Workflow steps

8 steps, taken from the step headings in SKILL.md.

Define KMS Encryption Keys
Manage Secrets with Secrets Manager
Apply IAM Least Privilege
Secure VPC Configuration
Request ACM Certificates
Implement Secure Parameters
Create Secure Outputs
Encrypt CloudWatch Logs

What it can do on your machine

Read from SKILL.md and the folder at commit fe73fb3. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves these tools, so the agent can use them without asking each time:
- Read
- Write
- Bash
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- aws
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use aws, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

AWS Cloudformation Security loads about 2.8k tokens when it runs, and up to ~23k if it reads all its reference files. Until then it costs about 118 tokens; SKILL.md has 532 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~118
When it runs · the whole SKILL.md, loaded when a task matches: ~2.8k
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~23k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
```
allowed-tools: Read, Write, Bash
```

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from giuseppe-trisciuoglio/developer-kit at commit fe73fb3, republished under its MIT licence (© giuseppe-trisciuoglio). 532 words, ~2,770 tokens.

Download SKILL.mdSave it as .claude/skills/aws-cloudformation-security/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.

name: aws-cloudformation-security
description: Provides AWS CloudFormation patterns for security infrastructure including KMS encryption, Secrets Manager, IAM security, VPC security, ACM certificates, parameter security, outputs, and secure cross-stack references. Use when implementing security best practices, encrypting data, managing secrets, applying least privilege IAM policies, securing VPC configurations, managing TLS/SSL certificates, and implementing defense in depth strategies.
allowed-tools: Read, Write, Bash

AWS CloudFormation Security Infrastructure

Overview

Create production-ready security infrastructure using AWS CloudFormation templates. This skill covers KMS encryption, Secrets Manager, IAM security with least privilege, VPC security configurations, ACM certificates, parameter security, secure outputs, cross-stack references, CloudWatch Logs encryption, defense in depth strategies, and security best practices.

When to Use

Implementing KMS encryption at rest and in transit
Managing secrets with Secrets Manager and automatic rotation
Applying IAM least privilege policies and permission boundaries
Securing VPC with security groups, NACLs, and VPC endpoints
Managing TLS/SSL certificates with ACM
Encrypting CloudWatch Logs and S3 buckets
Creating secure cross-stack references and outputs

Instructions

Follow these steps to create security infrastructure with CloudFormation:

1. Define KMS Encryption Keys

Create customer-managed keys for encryption:

yaml

Resources:
  EncryptionKey:
    Type: AWS::KMS::Key
    Properties:
      Description: Customer-managed key for data encryption
      KeyPolicy:
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action:
              - kms:Decrypt
              - kms:GenerateDataKey
            Resource: "*"
          - Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action:
              - kms:*
            Resource: "*"

  KeyAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub "${AWS::StackName}/encryption-key"
      TargetKeyId: !Ref EncryptionKey

Validate: aws kms get-key-policy --key-id <key-id> --output text

2. Manage Secrets with Secrets Manager

Store and retrieve sensitive data securely:

yaml

Resources:
  DatabaseSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub "${AWS::StackName}/database"
      Description: Database credentials
      SecretString: !Sub |
        {
          "username": "admin",
          "password": "${DatabasePassword}",
          "engine": "mysql",
          "host": "${DatabaseEndpoint}",
          "port": 3306
        }
      KmsKeyId: !Ref EncryptionKey

  SecretRotationSchedule:
    Type: AWS::SecretsManager::RotationSchedule
    Properties:
      SecretId: !Ref DatabaseSecret
      RotationLambdaARN: !Ref RotationLambda.Arn
      RotationRules:
        AutomaticallyAfterDays: 30

Validate: aws secretsmanager describe-secret --secret-id <secret-name>

3. Apply IAM Least Privilege

Create roles and policies with minimal required permissions:

yaml

Resources:
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: SpecificPermissions
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                Resource: !Sub "${DataBucket.Arn}/*"

Validate: aws iam simulate-principal-policy --policy-source-arn <role-arn> --action-names s3:GetObject --resource-arns <bucket-arn>

4. Secure VPC Configuration

Implement network security with security groups and NACLs:

yaml

Resources:
  ApplicationSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Application security group
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0

  ApplicationNACL:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId: !Ref VPC

  NACLEntry:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref ApplicationNACL
      RuleNumber: 100
      Protocol: "6"
      RuleAction: allow
      Egress: false
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: 443
        To: 443

Validate: aws ec2 describe-security-groups --group-ids <sg-id> --query 'SecurityGroups[0].IpPermissions'

5. Request ACM Certificates

Manage TLS/SSL certificates for secure communication:

yaml

Resources:
  Certificate:
    Type: AWS::ACM::Certificate
    Properties:
      DomainName: !Ref DomainName
      SubjectAlternativeNames:
        - !Sub "www.${DomainName}"
        - !Sub "api.${DomainName}"
      DomainValidationOptions:
        - DomainName: !Ref DomainName
          ValidationDomain: !Ref DomainName
      Tags:
        - Key: Environment
          Value: !Ref Environment

  # DNS validation record
  DnsValidationRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneName: !Ref HostedZone
      Name: !Sub "_${DomainName}."
      Type: CNAME
      TTL: 300
      ResourceRecords:
        - !Ref Certificate

Validate: aws acm describe-certificate --certificate-arn <arn> --query 'Certificate.Status'

6. Implement Secure Parameters

Use SecureString for sensitive parameter values:

yaml

Resources:
  DatabasePasswordParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/${AWS::StackName}/database/password"
      Type: SecureString
      Value: !Ref DatabasePassword
      Description: Database master password
      KmsKeyId: !Ref EncryptionKey

  # Reference in other resources
  DatabaseInstance:
    Type: AWS::RDS::DBInstance
    Properties:
      MasterUsername: admin
      MasterUserPassword: !Ref DatabasePasswordParameter

Validate: aws ssm get-parameter --name <param-name> --with-decryption --query 'Parameter.Type'

7. Create Secure Outputs

Export only non-sensitive values from stacks:

yaml

Outputs:
  # Safe to export
  KMSKeyArn:
    Description: KMS Key ARN for encryption
    Value: !GetAtt EncryptionKey.Arn
    Export:
      Name: !Sub "${AWS::StackName}-KMSKeyArn"

  SecretArn:
    Description: Secret ARN (not the secret value)
    Value: !Ref DatabaseSecret
    Export:
      Name: !Sub "${AWS::StackName}-SecretArn"

  # DO NOT export sensitive data
  # Incorrect:
  # SecretValue:
  #   Value: !GetAtt DatabaseSecret.SecretString

Validate: aws cloudformation list-exports --query "Exports[?Name=='<stack-name>-KMSKeyArn']"

8. Encrypt CloudWatch Logs

Enable encryption for log groups:

yaml

Resources:
  EncryptedLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/applications/${ApplicationName}"
      RetentionInDays: 30
      KmsKeyId: !Ref EncryptionKey

Validate: aws logs describe-log-groups --log-group-name-prefix <prefix> --query 'logGroups[0].kmsKeyId'

Best Practices

KMS: Use separate keys per data classification; enable annual key rotation; use customer-managed keys for compliance
Secrets: Rotate automatically (30 days for databases); never store secrets in plain text; use IAM policies for access control
IAM: Apply least privilege; use roles not access keys; enable MFA; implement permission boundaries
Network: Prefer security groups over NACLs; use VPC endpoints; restrict by specific CIDR ranges
Certificates: Use ACM for automatic renewal; DNS validation is faster than email
Encryption: Encrypt at rest and in transit; TLS 1.2+ required; use SSE-KMS for S3

Show full SKILL.md (182 more words)Show less

Examples

Complete KMS and Secrets Stack

yaml

Resources:
  # KMS Key with proper policy
  AppKey:
    Type: AWS::KMS::Key
    Properties:
      KeyPolicy:
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action: kms:*
            Resource: "*"
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action:
              - kms:Decrypt
              - kms:GenerateDataKey
            Resource: "*"

  # Secrets Manager with rotation
  DbSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      SecretString: !Sub '{"password":"${DbPassword}"}'
      KmsKeyId: !Ref AppKey
      RotationRules:
        AutomaticallyAfterDays: 30

IAM Least Privilege Role

yaml

Resources:
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: AccessPolicy
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action: s3:GetObject
                Resource: !Sub "${Bucket.Arn}/*"

For comprehensive examples with VPC security groups, ACM certificates, and complete encrypted infrastructure stacks, see examples.md.

Constraints and Warnings

Resource Limits

Security groups: max 60 inbound + 60 outbound rules
NACLs: max 20 inbound + 20 outbound rules per subnet
VPCs: max 5 per region (soft limit)
Key rotation: annual for KMS customer-managed keys

Security Constraints

NACLs are stateless: return traffic must be explicitly allowed
Default security groups cannot be deleted
Security group references cannot span VPC peering (use CIDR)
Cross-account access requires both IAM and resource policies

Operational Warnings

Secrets rotation requires Lambda function with proper IAM permissions
KMS key deletion requires pending window (7-30 days)
ACM certificates need DNS validation before issuance
VPC CIDR blocks cannot overlap with peered VPCs

For detailed constraints including cost considerations and quota management, see constraints.md.

References

For detailed implementation guidance, see:

examples.md - Complete KMS stacks, Secrets Manager with rotation, IAM least privilege roles, VPC security groups, ACM certificates, and encrypted infrastructure
constraints.md - Resource limits, security constraints, operational constraints, network constraints, cost considerations, and access control constraints

Files

SKILL.md and 3 other files (references) in plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security of giuseppe-trisciuoglio/developer-kit.

SKILL.md
references/constraints.md
references/examples.md
references/reference.md

Open the folder on GitHubat commit fe73fb3

Compare with similar skills

AWS Cloudformation Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

AWS Cloudformation Security compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
AWS Cloudformation Security this skillgiuseppe-trisciuoglio/developer-kit	357	—	~2.8k	Automated safety check: Notes	MIT	1 mo ago
AWS Security ArchitectureHack23/cia	239	—	~2.3k	Automated safety check: Pass	Apache-2.0	today
Configuring Firewallsancoleman/ai-design-components	525	—	~3.5k	Automated safety check: Notes	MIT	10 mo ago
AWS Essentialsericrisco/rsc-harness	180	—	~2.9k	Automated safety check: Notes	MIT	yesterday
Cloud Auditbriiirussell/cybersecurity-skills	413	—	~1.3k	Automated safety check: Notes	MIT	4 mo ago
Iamitsmostafa/aws-agent-skills	1.2k	—	~1.8k	Automated safety check: Pass	MIT	5 days ago

Similar skills

AWS Security Architecture
Hack23/cia
AWS security best practices, VPC security, IAM, KMS, CloudTrail, GuardDuty for CIA platform deployment
239 GitHub stars~2.3k tokensUpdated today
SecurityAuto-check passed
Configuring Firewalls
ancoleman/ai-design-components
Configure host-based firewalls (iptables, nftables, UFW) and cloud security groups (AWS, GCP, Azure) with practical rules for common scenarios like web servers, databases, and bastion hosts.
525 GitHub stars~3.5k tokensUpdated 10 mo ago
SecurityAuto-check: notes
AWS Essentials
ericrisco/rsc-harness
A skill your agent uses when standing up the core AWS surface a small product needs: hardening a fresh account, a private S3 bucket, encrypted RDS Postgres, ECS Fargate vs EC2, CloudFront + OAC, or…
180 GitHub stars~2.9k tokensUpdated yesterday
DevOps & CloudAuto-check: notes
Cloud Audit
briiirussell/cybersecurity-skills
Audit cloud infrastructure (AWS, GCP, Azure) for misconfigurations, excessive permissions, and security gaps.
413 GitHub stars~1.3k tokensUpdated 4 mo ago
SecurityAuto-check: notes
Iam
itsmostafa/aws-agent-skills
AWS Identity and Access Management for users, roles, policies, and permissions.
1.2k GitHub stars~1.8k tokensUpdated 5 days ago
SecurityAuto-check passed
AWS Iam
sickn33/agentic-awesome-skills
Manage IAM users, roles, and policies. An agent skill from sickn33/agentic-awesome-skills.
47k GitHub starsUsed in 2 repos~3.4k tokens
SecurityAuto-check passed

More from giuseppe-trisciuoglio/developer-kit

All 115 skills in this repo

Nestjs Drizzle Crud Generator
giuseppe-trisciuoglio/developer-kit
Generates complete CRUD modules for NestJS applications with Drizzle ORM.
357 GitHub stars~1.3k tokensUpdated 1 mo ago
Auto-check: notes
Spring Boot Actuator
giuseppe-trisciuoglio/developer-kit
Provides patterns to configure Spring Boot Actuator for production-grade monitoring, health probes, secured management endpoints, and Micrometer metrics across JVM services.
357 GitHub stars~2.2k tokensUpdated 1 mo ago
Auto-check: notes
Spring Boot Crud Patterns
giuseppe-trisciuoglio/developer-kit
Provides and generates complete CRUD workflows for Spring Boot 3 services.
357 GitHub stars~2.5k tokensUpdated 1 mo ago
Auto-check: notes
Spring Boot Security JWT
giuseppe-trisciuoglio/developer-kit
Provides JWT authentication and authorization patterns for Spring Boot 3.5.x covering token generation with JJWT, Bearer/cookie authentication, database/OAuth2 integration, and RBAC/permission-based…
357 GitHub stars~3.9k tokensUpdated 1 mo ago
Auto-check: notes
AWS CLI Beast
giuseppe-trisciuoglio/developer-kit
Provides advanced AWS CLI patterns for managing EC2, Lambda, S3, DynamoDB, RDS, VPC, IAM, and CloudWatch.
357 GitHub stars~1.7k tokensUpdated 1 mo ago
Auto-check: notes
PR Review Comments
giuseppe-trisciuoglio/developer-kit
Posts review findings from a JSON file as inline comments on a GitHub Pull Request, attaching each comment to its file and line.
357 GitHub stars~1k tokensUpdated 1 mo ago
Auto-check: notes

Works with

Questions about AWS Cloudformation Security

What does AWS Cloudformation Security do?

Provides AWS CloudFormation patterns for security infrastructure including KMS encryption, Secrets Manager, IAM security, VPC security, ACM certificates, parameter security, outputs, and secure…. AWS Cloudformation Security is an agent skill from giuseppe-trisciuoglio/developer-kit. Provides AWS CloudFormation patterns for security infrastructure including KMS encryption, Secrets Manager, IAM security, VPC security, ACM certificates, parameter security, outputs, and secure cross-stack references.

When should I use AWS Cloudformation Security?

AWS Cloudformation Security fits situations like: implementing security best practices; encrypting data; managing secrets; applying least privilege IAM policies.

How do I install AWS Cloudformation Security in Claude Code?

Run `npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-security -a claude-code`. Or copy the skill folder (plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security in giuseppe-trisciuoglio/developer-kit) into .claude/skills/aws-cloudformation-security in your project. Claude Code loads it when a task matches its description.

How do I install AWS Cloudformation Security in Codex?

Run `npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-security -a codex`. Or copy the skill folder (plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security in giuseppe-trisciuoglio/developer-kit) into .agents/skills/aws-cloudformation-security in your project. Codex loads it when a task matches its description.

Can I use AWS Cloudformation Security in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/aws-cloudformation-security, .gemini/skills/aws-cloudformation-security, .github/skills/aws-cloudformation-security and .opencode/skills/aws-cloudformation-security in your project.

What does AWS Cloudformation Security need to run?

Going by SKILL.md and its folder, AWS Cloudformation Security needs the command-line tools its instructions call (aws). Its frontmatter pre-approves these tools: Read, Write, Bash.

Does AWS Cloudformation Security access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is AWS Cloudformation Security safe to install?

Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does AWS Cloudformation Security use?

AWS Cloudformation Security is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does AWS Cloudformation Security use?

About 2.8k tokens (SKILL.md is roughly 11k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 21k tokens, read only when the agent opens those files.

What are the alternatives to AWS Cloudformation Security?

Skills that share tags, products or a category with AWS Cloudformation Security: AWS Security Architecture (Hack23/cia, 239 stars), Configuring Firewalls (ancoleman/ai-design-components, 525 stars), AWS Essentials (ericrisco/rsc-harness, 180 stars) and Cloud Audit (briiirussell/cybersecurity-skills, 413 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains AWS Cloudformation Security?

giuseppe-trisciuoglio (a GitHub user) maintains it in giuseppe-trisciuoglio/developer-kit, which has 357 GitHub stars. The repository holds 115 skills in this directory. The repository was last updated on September 10, 2026.

Source: giuseppe-trisciuoglio/developer-kit on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install AWS Cloudformation Security

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

AWS CloudFormation Security Infrastructure

Overview

When to Use

Instructions

1. Define KMS Encryption Keys

2. Manage Secrets with Secrets Manager

3. Apply IAM Least Privilege

4. Secure VPC Configuration

5. Request ACM Certificates

6. Implement Secure Parameters

7. Create Secure Outputs

8. Encrypt CloudWatch Logs

Best Practices

Examples

Complete KMS and Secrets Stack

IAM Least Privilege Role

Constraints and Warnings

Resource Limits

Security Constraints

Operational Warnings

References

Files

Compare with similar skills

Similar skills

More from giuseppe-trisciuoglio/developer-kit

Related

Questions about AWS Cloudformation Security