/website-infra

name: website-infra
description: Deploys AWS CloudFormation infrastructure stacks for the website (S3, CloudFront, Route 53, ACM, and optionally contact form API).
allowed-tools: Bash, Read, Write, Edit, Glob

Website Infrastructure Skill

You are running the `/grc-portfolio:infra` skill. Your job is to deploy the AWS infrastructure needed to host the website using CloudFormation.

Step 1: Locate and Validate Config

Find `site-config.json`:

• Check `$ARGUMENTS` for a project directory path
• Check the current working directory
• Ask the user if not found

Read it and validate that `status.preflightComplete === true`. If not, tell the user to run `/grc-portfolio:preflight` first.

Step 2: Choose Template

Based on `features.customDomain`:

• **With custom domain**: Use `$TOOLKIT_DIR/cloudformation/website-infrastructure.yaml`
• **Without custom domain**: Use `$TOOLKIT_DIR/cloudformation/website-infrastructure-no-domain.yaml`

Step 3: Validate Template

Run the validation script:

$TOOLKIT_DIR/scripts/validate-stack.sh <template-path> <aws.profile>

If validation fails, report the error and stop.

Step 4: Deploy Main Stack

Use `aws cloudformation deploy` — it is idempotent (creates the stack on first run, applies a change-set on subsequent runs) and waits for completion inline, so the user doesn't need a separate `wait` step.

**With custom domain:**

aws cloudformation deploy \
  --stack-name <aws.stackName> \
  --template-file <template-path> \
  --parameter-overrides \
    ProjectName=<projectName> \
    DomainName=<aws.domain> \
    HostedZoneId=<aws.hostedZoneId> \
    CertificateArn=<aws.certArn> \
  --profile <aws.profile> \
  --region us-east-1 \
  --no-fail-on-empty-changeset

**Without custom domain:**

aws cloudformation deploy \
  --stack-name <aws.stackName> \
  --template-file <template-path> \
  --parameter-overrides ProjectName=<projectName> \
  --profile <aws.profile> \
  --region us-east-1 \
  --no-fail-on-empty-changeset

Note: Check the actual template parameters first by reading the template file, as parameter names may differ from the examples above. Use the actual parameter names from the template.

The deploy command can take 5-15 minutes (especially with CloudFront distribution creation). Tell the user it's in progress and approximately how long it might take.

If the deploy fails, retrieve the failure reason:

aws cloudformation describe-stack-events \
  --stack-name <aws.stackName> \
  --profile <aws.profile> \
  --region us-east-1 \
  --query "StackEvents[?ResourceStatus=='CREATE_FAILED' || ResourceStatus=='UPDATE_FAILED'].[LogicalResourceId,ResourceStatusReason]" \
  --output table

Step 6: Retrieve Stack Outputs

aws cloudformation describe-stacks \
  --stack-name <aws.stackName> \
  --profile <aws.profile> \
  --region us-east-1 \
  --query "Stacks[0].Outputs"

Extract and save to `site-config.json`:

• `aws.bucketName` -- the S3 bucket name
• `aws.distributionId` -- the CloudFront distribution ID
• `aws.cloudFrontUrl` -- the CloudFront domain name (e.g., d123abc.cloudfront.net)

Step 7: Deploy Contact Form API (if enabled)

If `features.contactForm` is true:

1. Ask the user for two SES-verified email addresses (no defaults — the stack will refuse to deploy without them):

• `SESFromEmail`: verified sender identity
• `SESToEmail`: recipient inbox for submissions

If either is not yet verified in SES, stop and instruct the user to verify them in the AWS Console (`SES → Verified identities → Create identity`) before continuing. Save both to `aws.sesFromEmail` and `aws.sesToEmail` in `site-config.json`.

2. Deploy the contact form stack:

aws cloudformation deploy \
  --template-file $TOOLKIT_DIR/cloudformation/contact-form-api.yaml \
  --stack-name <projectName>-contact-form-api \
  --parameter-overrides "SESFromEmail=<aws.sesFromEmail>" "SESToEmail=<aws.sesToEmail>" \
  --capabilities CAPABILITY_IAM \
  --profile <aws.profile> \
  --region us-east-1 \
  --no-fail-on-empty-changeset

3. Retrieve the API endpoint:

aws cloudformation describe-stacks \
  --stack-name <projectName>-contact-form-api \
  --profile <aws.profile> \
  --region us-east-1 \
  --query "Stacks[0].Outputs[?OutputKey=='ApiEndpoint'].OutputValue" \
  --output text

4. Save to `aws.contactApiEndpoint` in config.

5. Package and deploy the Lambda function code (reference `$TOOLKIT_DIR/scripts/deploy-contact-api.sh` for the pattern -- create temp dir, copy handler, install @aws-sdk/client-ses, zip, update function code). The function name is `<projectName>-contact-form-api-handler` (derived from the stack name in the template).

Step 8: Domain Instructions (if custom domain)

If using a custom domain, tell the user:

• The nameservers they need to set at their domain registrar
• How to verify DNS propagation: `dig NS <domain>`
• That DNS propagation can take up to 48 hours (usually much faster)

Get the nameservers:

aws route53 get-hosted-zone --id <aws.hostedZoneId> --profile <aws.profile> --query "DelegationSet.NameServers"

Step 9: Update Config

Update `site-config.json`:

• Set `aws.bucketName`, `aws.distributionId`, `aws.cloudFrontUrl`
• Set `aws.contactApiEndpoint` (if contact form)
• Set `status.infraDeployed = true`

Step 10: Summary

Tell the user:

• Infrastructure deployed successfully
• CloudFront URL where the site will be accessible
• Contact form API endpoint (if applicable)
• DNS instructions (if custom domain)
• Suggest running `/grc-portfolio:deploy` next to push the built site to AWS

Variables

• `$TOOLKIT_DIR` = read from `site-config.json` `toolkitDir` field
• `$ARGUMENTS` = arguments passed after `/infra` (expected: project directory path)