/aws

name: aws
description: Structured guidance for AWS CloudFront distributions, WAF web ACLs, Lambda@Edge, CloudFront Functions, Firewall Manager multi-account enforcement, and IAM/IRSA patterns. Covers OAC, cache policies, security headers, managed rule groups, rate limiting, FMS FIRST/MIDDLE/LAST ownership model, and production-ready Terraform generation.
argument-hint: "[cloudfront|waf|lambda-edge|multi-account|orgs|review|terraform] [description or code]"
title: "AWS Command"
sidebar_label: "aws"
custom_edit_url: null

AWS Command

Structured guidance for AWS CloudFront, WAF, Lambda@Edge, and multi-account security patterns.

Interactive Wizard (fires when no mode is provided)

When invoked with no arguments, ask before proceeding:

**Q1 — Mode?**

What do you need?
  1. cloudfront   — distributions, OAC, cache policies, security headers, Lambda@Edge
  2. waf          — web ACLs, managed rule groups, rate limiting, false positive tuning
  3. lambda-edge  — CloudFront Functions vs Lambda@Edge, viewer/origin events
  4. multi-account — Firewall Manager, cross-account OAC, FMS WAF enforcement
  5. orgs         — Organizations, SCPs, OU design, account vending, Control Tower
  6. review       — production-readiness review of CloudFront + WAF config
  7. terraform    — generate a Terraform module scaffold

Enter 1–7 or mode name:

**Q2 — Context** (after mode selected):

• **cloudfront**: `Describe the issue or what you want to build (distribution, OAC, cache, edge function):`
• **waf**: `Describe the use case — new WebACL, false positive, adding a rule, or multi-account enforcement:`
• **lambda-edge**: `What does the edge function need to do? (auth, URL rewrite, A/B test, dynamic routing):`
• **multi-account**: `How many accounts? Do you have FMS administrator configured in the security account?`
• **orgs**: `Describe what you need — SCP enforcement, OU design, account vending, or Control Tower setup:`
• **review / terraform**: no follow-up needed — proceed directly

---

Activation

Invoke with `/platform-skills:aws` followed by a mode, or describe your problem and the command will route automatically.

/platform-skills:aws cloudfront        # CloudFront distributions, OAC, cache, security headers
/platform-skills:aws waf               # WAF web ACLs, managed rules, rate limiting
/platform-skills:aws lambda-edge       # Lambda@Edge and CloudFront Functions
/platform-skills:aws multi-account     # Firewall Manager, cross-account, Organizations
/platform-skills:aws review            # Production-readiness review of your config
/platform-skills:aws terraform         # Generate Terraform module scaffold

---

Mode: cloudfront

**Triggers:** distribution, CDN, OAC, cache behavior, price class, CNAME, SSL, geo restriction, origin, CloudFront

**Reference:** `references/aws-cloudfront.md`

Steps:

1. Identify the problem layer:

• **Origin access** — OAC/OAI, S3 bucket policy, cross-account origin
• **Cache** — TTL, cache key, cache policy vs origin request policy
• **Security** — response headers, HTTPS enforcement, WAF attachment
• **Edge compute** — Lambda@Edge vs CloudFront Functions decision
• **Logging** — standard logs, real-time logs, Athena

2. Check for the common footguns:

• WAF for CloudFront **must** be `CLOUDFRONT` scope in `us-east-1`
• OAC not OAI — OAI is legacy; new distributions must use OAC
• Lambda@Edge must use numbered version ARN (`qualified_arn`), not `$LATEST`
• ACM certificate for custom domains must be in `us-east-1`

3. Provide: problem diagnosis, Terraform snippet, validation steps, rollback plan.

**Key Terraform resources:**

| Resource | Purpose | |---|---| | `aws_cloudfront_distribution` | The distribution | | `aws_cloudfront_origin_access_control` | OAC (replaces OAI) | | `aws_cloudfront_cache_policy` | Custom cache key and TTL | | `aws_cloudfront_origin_request_policy` | What to forward to origin | | `aws_cloudfront_response_headers_policy` | Security headers | | `aws_cloudfront_function` | CloudFront Function (JS, viewer events) | | `aws_cloudfront_realtime_log_config` | Real-time logs to Kinesis |

---

Mode: waf

**Triggers:** WAF, web ACL, rule group, managed rules, rate limit, Bot Control, CAPTCHA, Challenge, IP set, geo block

**Reference:** `references/aws-waf.md`

Steps:

1. Confirm scope:

• `CLOUDFRONT` → must use `us-east-1` provider alias
• `REGIONAL` → same region as the protected resource

2. Classify the request:

• **New WebACL** → baseline rule groups + rate limit + logging
• **False positive** → use `rule_action_override` to Count the specific rule
• **Adding rule** → Count first, monitor 24–48h, then Block
• **Performance** → review sampled requests, check which rules add latency
• **Multi-account** → use Firewall Manager (see multi-account mode)

3. Provide: exact rule block, priority placement, visibility config, logging config.

**Baseline rule groups (always include for CloudFront):**

# Priority 5 — IP reputation (free)
AWSManagedRulesAmazonIpReputationList

# Priority 10 — Core Rule Set (free)
AWSManagedRulesCommonRuleSet

# Priority 15 — Known bad inputs: Log4Shell, SSRF (free)
AWSManagedRulesKnownBadInputsRuleGroup

# Priority 30 — Rate limit: 2000 req/5min per IP
rate_based_statement { limit = 2000; aggregate_key_type = "IP" }

**Paid additions (evaluate based on risk):**

• `AWSManagedRulesBotControlRuleSet` — bot traffic (Common or Targeted level)
• `AWSManagedRulesATPRuleSet` — credential stuffing on login endpoints
• `AWSManagedRulesACFPRuleSet` — account creation fraud on registration endpoints

---

Mode: lambda-edge

**Triggers:** Lambda@Edge, CloudFront Functions, viewer-request, origin-request, edge function, A/B test, auth at edge, URL rewrite

**Reference:** `references/aws-cloudfront.md` → Lambda@Edge section

Decision — CloudFront Functions vs Lambda@Edge:

Need network calls?                → Lambda@Edge (CloudFront Functi