skilld
All skills
jeffallan avatar

/cloud-architect

@efebc44
by jeffallanjeffallan/claude-skills12k stars
1,124

Designs cloud architectures, creates migration plans, generates cost optimization recommendations, and produces disaster recovery strategies across AWS, Azure, and GCP. Use when designing cloud architectures, planning migrations, or optimizing multi-cloud deployments. Invoke for Well-Architected Framework, cost optimization, disaster recovery, landing zones, security architecture, serverless design.

Ask your Agent

Use this Skill: https://skilld.dev/gh/jeffallan/claude-skills/cloud-architect

This session only. Nothing lands on disk.

referencesaws.md

≈2.8k tokens on demand. Your agent reads this file only when SKILL.md points to it.

AWS Architecture Reference

Comprehensive guide for AWS services, patterns, and Well-Architected Framework implementation.

Well-Architected Framework

Six Pillars

  1. Operational Excellence

    • Infrastructure as Code (CloudFormation, CDK, Terraform)
    • Continuous integration/deployment
    • Observability (CloudWatch, X-Ray)
    • Runbooks and playbooks
    • Game days and failure injection

  2. Security

    • Identity and Access Management (IAM)
    • Detective controls (GuardDuty, Security Hub)
    • Infrastructure protection (VPC, security groups, NACLs)
    • Data protection (KMS, encryption at rest/transit)
    • Incident response automation

  3. Reliability

    • Multi-AZ deployments
    • Auto Scaling groups
    • Route 53 health checks and failover
    • Backup and restore (AWS Backup)
    • Chaos engineering (AWS FIS)

  4. Performance Efficiency

    • Right-sizing with Compute Optimizer
    • Caching strategies (CloudFront, ElastiCache)
    • Database optimization (RDS Performance Insights)
    • Serverless architectures
    • Global content delivery

  5. Cost Optimization

    • Reserved Instances and Savings Plans
    • Spot Instances for fault-tolerant workloads
    • S3 Intelligent-Tiering and lifecycle policies
    • Right-sizing recommendations
    • Cost allocation tags and budgets

  6. Sustainability

    • Region selection for renewable energy
    • Serverless to minimize idle resources
    • Efficient data storage patterns
    • Resource utilization optimization

Core Services Architecture

Compute

EC2 (Elastic Compute Cloud)

  • Instance families: General (t3, m5), Compute (c5), Memory (r5), GPU (p3, g4)
  • Auto Scaling: Target tracking, step scaling, scheduled scaling
  • Placement groups: Cluster, partition, spread
  • Best practices: Use latest generation, right-size, enable detailed monitoring

Lambda

  • Invocation models: Synchronous, asynchronous, event source mapping
  • Concurrency: Reserved, provisioned, burst limits
  • Layers for shared dependencies
  • Best practices: Keep functions small, use environment variables, set timeouts

ECS/EKS (Container Services)

  • ECS: Fargate for serverless, EC2 for control
  • EKS: Managed Kubernetes with AWS integration
  • Service mesh: App Mesh for observability
  • Best practices: Use Fargate for simplicity, EKS for portability

Elastic Beanstalk

  • Managed platform for web apps
  • Auto-scaling and load balancing included
  • Support for multiple languages and Docker

Storage

S3 (Simple Storage Service)

  • Storage classes: Standard, IA, One Zone-IA, Glacier, Deep Archive
  • Lifecycle policies for automatic tiering
  • Versioning and MFA delete for protection
  • Cross-region replication for DR
  • Best practices: Enable versioning, use lifecycle policies, block public access

EBS (Elastic Block Store)

  • Volume types: gp3 (general), io2 (IOPS), st1 (throughput), sc1 (cold)
  • Snapshots to S3 for backup
  • Encryption by default
  • Best practices: Use gp3 for most workloads, enable encryption

EFS (Elastic File System)

  • NFSv4 file system for shared access
  • Performance modes: General purpose, Max I/O
  • Throughput modes: Bursting, provisioned
  • Best practices: Use lifecycle management, enable encryption

FSx

  • FSx for Windows File Server (SMB)
  • FSx for Lustre (HPC workloads)
  • FSx for NetApp ONTAP
  • FSx for OpenZFS

Database

RDS (Relational Database Service)

  • Engines: MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, Aurora
  • Multi-AZ for high availability
  • Read replicas for scalability
  • Automated backups and point-in-time recovery
  • Best practices: Use Aurora for performance, enable Multi-AZ, use read replicas

Aurora

  • MySQL and PostgreSQL compatible
  • 5x MySQL, 3x PostgreSQL performance
  • Global databases for cross-region DR
  • Serverless v2 for variable workloads
  • Best practices: Use Aurora Serverless for unpredictable workloads

DynamoDB

  • NoSQL key-value and document database
  • On-demand or provisioned capacity
  • Global tables for multi-region replication
  • DynamoDB Streams for change data capture
  • Best practices: Use on-demand for unpredictable traffic, implement GSI carefully

ElastiCache

  • Redis or Memcached in-memory caching
  • Cluster mode for Redis scalability
  • Best practices: Use for session storage, API caching

Networking

VPC (Virtual Private Cloud)

  • CIDR planning: Avoid overlaps, plan for growth
  • Subnets: Public (IGW), private (NAT), isolated (no internet)
  • Route tables and routing decisions
  • Security groups (stateful) and NACLs (stateless)
  • Best practices: Use /16 for VPC, /24 for subnets, plan IP space

Route 53

  • DNS service with health checks
  • Routing policies: Simple, weighted, latency, failover, geolocation
  • Best practices: Use alias records, enable DNSSEC

CloudFront

  • Global CDN with edge locations
  • Origin types: S3, ALB, custom origins
  • Lambda@Edge for request/response manipulation
  • Best practices: Enable compression, use field-level encryption

VPN and Direct Connect

  • Site-to-Site VPN for encrypted tunnels
  • Direct Connect for dedicated bandwidth
  • Transit Gateway for hub-and-spoke topology
  • Best practices: Use Direct Connect for high bandwidth, Transit Gateway for complex routing

API Gateway

  • REST APIs, HTTP APIs, WebSocket APIs
  • Throttling and quotas
  • Integration with Lambda, HTTP endpoints, AWS services
  • Best practices: Use HTTP APIs for lower cost, implement caching

Security

IAM (Identity and Access Management)

  • Principle of least privilege
  • Roles for applications, not access keys
  • MFA for privileged users
  • Service Control Policies (SCPs) for organization-wide controls
  • Best practices: Use roles, enable MFA, rotate credentials

KMS (Key Management Service)

  • Customer managed keys (CMKs)
  • Automatic key rotation
  • Envelope encryption pattern
  • Best practices: Enable automatic rotation, use grants for temporary access

Secrets Manager

  • Automatic rotation for RDS credentials
  • Versioning and rollback
  • Best practices: Rotate secrets regularly, use VPC endpoints

Security Hub

  • Centralized security findings
  • CIS AWS Foundations Benchmark
  • Integration with GuardDuty, Inspector, Macie

GuardDuty

  • Threat detection using ML
  • Monitors CloudTrail, VPC Flow Logs, DNS logs

Architecture Patterns

High Availability

Multi-AZ Pattern

- Application Load Balancer across 3 AZs
- Auto Scaling group with instances in each AZ
- RDS Multi-AZ for database
- S3 for static assets (11 9's durability)

Multi-Region Pattern

- Route 53 with health checks and failover
- CloudFront for global distribution
- Aurora Global Database for <1s RPO
- S3 Cross-Region Replication

Serverless Architecture

API-Driven Pattern

API Gateway -> Lambda -> DynamoDB
              |
              v
          EventBridge -> Lambda (async processing)

Event-Driven Pattern

S3 Event -> Lambda -> Process -> SNS
                                  |
                                  v
                              Multiple subscribers

Microservices on AWS

Container-Based

ALB -> ECS Fargate (multiple services)
    |
    v
Service Discovery (Cloud Map)
    |
    v
RDS/DynamoDB per service

Service Mesh

App Mesh for traffic management
X-Ray for distributed tracing
CloudWatch Container Insights

Data Lake Architecture

Data Sources -> Kinesis Data Streams
                      |
                      v
              Kinesis Firehose
                      |
                      v
                S3 (raw bucket)
                      |
                      v
        Glue ETL or Lambda processing
                      |
                      v
            S3 (processed bucket)
                      |
                      v
          Athena/Redshift Spectrum
                      |
                      v
              QuickSight dashboards

Migration Strategies (6Rs)

  1. Rehost (Lift-and-Shift)

    • AWS Application Migration Service (MGN)
    • Minimal changes, quick migration
    • Use for legacy apps with compliance constraints

  2. Replatform (Lift-Tinker-and-Shift)

    • Migrate to RDS instead of self-managed databases
    • Use Elastic Beanstalk instead of custom app servers
    • Small optimizations during migration

  3. Repurchase (Drop-and-Shop)

    • Move to SaaS (e.g., Salesforce, Workday)
    • Reduce maintenance burden

  4. Refactor/Re-architect

    • Modernize to serverless or containers
    • Highest effort, highest benefit
    • Use for competitive advantage applications

  5. Retire

    • Decommission unused applications
    • Reduce attack surface and costs

  6. Retain

    • Keep on-premises temporarily
    • Migrate later or keep for regulatory reasons

Landing Zone Design

AWS Control Tower

  • Multi-account strategy (AWS Organizations)
  • Account factory for standardization
  • Guardrails for governance (SCPs)
  • Centralized logging (CloudTrail, Config)

Account Structure

Root
├── Security OU
│   ├── Log Archive Account
│   └── Security Tooling Account
├── Infrastructure OU
│   ├── Network Account (Transit Gateway, VPN)
│   └── Shared Services Account
└── Workloads OU
    ├── Production Account
    ├── Staging Account
    └── Development Account

Network Design

Transit Gateway (hub)
    |
    ├── Production VPC
    ├── Staging VPC
    ├── Development VPC
    └── On-premises (Direct Connect/VPN)

Cost Optimization Strategies

Compute Savings

  • Compute Savings Plans (up to 66% savings)
  • EC2 Reserved Instances (1-year or 3-year)
  • Spot Instances for batch/fault-tolerant workloads
  • Lambda: Reduce memory if possible, use reserved concurrency

Storage Savings

  • S3 Intelligent-Tiering for unpredictable access
  • Lifecycle policies to Glacier/Deep Archive
  • EBS gp3 instead of gp2 (20% cheaper, better performance)
  • Delete unused snapshots and volumes

Database Savings

  • Aurora Serverless v2 for variable workloads
  • RDS Reserved Instances
  • DynamoDB on-demand for unpredictable workloads
  • Read replicas in same region to reduce cross-AZ data transfer

Monitoring and Alerting

  • AWS Cost Explorer for analysis
  • AWS Budgets for alerts
  • Cost Anomaly Detection
  • Trusted Advisor for recommendations

Disaster Recovery

RPO and RTO Targets

  • Backup and Restore: Hours RPO/RTO (lowest cost)
  • Pilot Light: Minutes RPO, hours RTO
  • Warm Standby: Seconds RPO, minutes RTO
  • Multi-Site Active/Active: Near-zero RPO/RTO (highest cost)

Implementation

  • AWS Backup for centralized backup management
  • Aurora Global Database for cross-region replication
  • S3 Cross-Region Replication
  • Route 53 health checks and failover routing
  • Regular DR testing with CloudFormation/Terraform

Monitoring and Observability

CloudWatch

  • Metrics: Standard (5 min) and detailed (1 min)
  • Alarms with SNS notifications
  • Logs Insights for log analysis
  • Dashboards for visualization

X-Ray

  • Distributed tracing for microservices
  • Service map visualization
  • Trace annotations and metadata

AWS Config

  • Resource inventory and change tracking
  • Compliance rules evaluation
  • Relationship tracking between resources

Source: SKILL.md on GitHub

Third-party checks

1 alert16d5 checks · Risk CRITICAL
  • Gen Agent Trust Hub16d

    The skill has been flagged by automated security scanners for containing blacklisted URLs and potential malware. Although the provided cloud architecture templates and documentation appear standard, these external reputation findings indicate a critical security risk that must not be ignored.

  • Socket16d

    No alerts

  • Snyk16d

    Risk: LOW · No issues

  • Runlayer6mo

    6/6 files flagged

  • ZeroLeaks5mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at efebc44. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 2 months ago.

Steadyupdated 5 months ago

Capability

Other metadata
metadata
{
  "author": "https://github.com/Jeffallan",
  "version": "1.1.0",
  "domain": "infrastructure",
  "triggers": "AWS, Azure, GCP, Google Cloud, cloud migration, cloud architecture, multi-cloud, cloud cost, Well-Architected, landing zone, cloud security, disaster recovery, cloud native, serverless architecture",
  "role": "architect",
  "scope": "infrastructure",
  "output-format": "architecture",
  "related-skills": "devops-engineer, kubernetes-specialist, terraform-engineer, security-reviewer, microservices-architect, monitoring-expert"
}

README badge

README badge for jeffallan/claude-skills/cloud-architect