/cloud-deployment-routing-workflow

name: cloud-deployment-routing-workflow
description: Choose a cloud deployment path before implementation. Route AWS work to the official AWS Agent Toolkit and Azure work to Microsoft's Azure Skills plugin while keeping credentials, regions, and mutation boundaries explicit.
license: Apache-2.0
compatibility: Designed for Codex and compatible Agent Skills clients working with cloud deployments, provider CLIs, provider plugins, MCP servers, and repository-owned deployment configuration.
metadata:
  owner: gaelic-ghost
  repo: socket
  category: cloud-deployment-routing
allowed-tools: Read Bash(rg:*) Bash(git:*) Bash(codex:*) Bash(aws:*) Bash(uv:*) Bash(uvx:*)

Cloud Deployment Routing Workflow

Purpose

Choose the smallest correct cloud deployment path before changing infrastructure, credentials, or production-facing configuration.

The practical decision is whether the agent should use an official provider plugin, a provider MCP server, a provider CLI, a framework-owned deployment workflow, or a Socket-owned provider skill.

When To Use

• Use this skill when the user wants cloud deployment help and has not chosen a provider-owned workflow.
• Use this skill when a project mentions AWS, Cloudflare, Vercel, Fly.io, Azure, GCP, Terraform, Pulumi, CDK, CloudFormation, SAM, containers, serverless, hosting, DNS, secrets, deployment, or production infrastructure.
• Use this skill before adding provider credentials, changing cloud resources, deploying production services, or wiring new MCP server configuration.
• Use this skill when an official provider plugin may already own the requested work.

Source Check

Use repo-local deployment files, checked-out provider config, installed provider CLIs, official provider plugins, and official provider documentation before making claims about current deployment behavior:

• [Agent Toolkit for AWS](https://github.com/aws/agent-toolkit-for-aws)
• [AWS Agent Toolkit plugins](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/plugins.html)
• [AWS MCP Server setup](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/getting-started-aws-mcp-server.html)
• [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/)
• [AWS SAM CLI](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/what-is-sam.html)
• [Azure Skills](https://github.com/microsoft/azure-skills)
• [Azure MCP Server](https://learn.microsoft.com/azure/developer/azure-mcp-server/)
• [Azure Developer CLI](https://learn.microsoft.com/azure/developer/azure-developer-cli/)

Translate any documentation rule into the concrete repository decision it changes.

Routing Workflow

1. Inspect the project shape:

• deployment manifests such as `template.yaml`, `serverless.yml`, `cloudformation.yml`, `cdk.json`, `samconfig.toml`, `wrangler.toml`, `vercel.json`, `fly.toml`, `Dockerfile`, `compose.yaml`, Terraform, or Pulumi files
• package scripts, Make targets, CI workflows, release docs, and provider-specific README sections
• existing credentials guidance, environment variables, account aliases, regions, profiles, and secret names

2. Identify the deployment job:

• provider selection
• local credential setup
• documentation lookup
• infrastructure planning
• preview or diff
• dev/staging deploy
• production deploy
• failure triage
• cost, IAM, observability, or rollback review

3. Route AWS work first:

• Prefer the official AWS Agent Toolkit for AWS for Codex when the task is general AWS discovery, AWS MCP access, AWS CLI or AWS SAM setup, CDK, CloudFormation, serverless, containers, storage, observability, billing, SDK usage, or deployment.
• Install path for Codex users:

     codex plugin marketplace add aws/agent-toolkit-for-aws

Then use `/plugins` in Codex to install `aws-core`.

• Do not duplicate AWS MCP configuration in Socket while `aws-core` bundles that configuration.
• Do not copy AWS Agent Toolkit skills into Socket.

4. Route non-AWS work:

• For Azure, prefer Microsoft's Azure Skills plugin for Azure MCP, Foundry MCP,

preparation, validation, deployment, diagnostics, cost, RBAC, and service guidance. Add its marketplace with `codex plugin marketplace add microsoft/azure-skills`, then install `azure` through `/plugins`.

• Do not duplicate Azure MCP declarations, Azure CLI or Azure Developer CLI

setup, Azure Skills workflows, or account-specific IaC in Socket.

• Use a first-party provider plugin or MCP server when one exists and is current.
• Use framework-owned Socket skills when the deployment surface is already covered by a stack workflow, such as `server-side-swift:fly-io-deployment-workflow`.
• Add or use a Socket-owned provider skill only when no official provider-owned agent surface exists or when Socket needs a small provider-neutral decision layer.

5. Confirm mutation boundaries:

• account or organization
• project or app
• region
• profile or identity
• environment such as local, dev, staging, or production
• exact resource mutations
• expected cost or billing effect
• rollback or cleanup path

6. Choose validation:

• read-only documentation or discovery query for planning
• provider CLI version and auth check for local setup
• plan, diff, dry-run, validate, package, or synth command before deploy
• smoke test, logs, metrics, and rollback checks after deploy

Recommendations

AWS

Use the official AWS Agent Toolkit for AWS as the default Codex path. It owns AWS MCP setup and the curated AWS skill set, including common deployment, CDK, CloudFormation, serverless, container, storage, observability, billing, and SDK workflows.

Use Socket only for the routing decision, local repo handoff, and any project-specific deployment guardrails that the official AWS plugin does not know.

Azure

Use Microsoft's Azure Skills plugin as the default Codex path. It owns Azure MCP and Foundry MCP