jaycommit/jstack

Use when you add logs, metrics, alarms or a dashboard. Set a retention on every log group, alarm on the symptom the user hits, and read the series before you change the resource.

Use when you read, change or replace a CodePipeline or CodeBuild project. Keep a working pipeline on its current tool, and start a new deploy on GitHub Actions with OIDC.

Use before a change that adds AWS spend, and when you read a bill. Check Cost Explorer, set a budget, right-size from Compute Optimizer, and include NAT, public IPv4 and cross-AZ data transfer.

Use when you create or deploy an ECS service. Prefer Fargate, split the task role from the execution role, and put the service behind a load balancer with a deployment circuit breaker.

Use when you create or upgrade an EKS cluster. Prefer a private API endpoint, Pod Identity for new pods, managed node groups or Karpenter, and move one Kubernetes minor at a time.

Use when you add or widen an IAM policy, role or permission boundary. Write the API calls the job makes, validate the policy, and keep AdministratorAccess off pipelines and people.

Use when you add an account, an OU or a service control policy. Keep workloads out of the management account, treat an SCP as a ceiling that does not grant access, and leave Control Tower policies untouched.

Use when you store a secret or a configuration value in AWS. Put rotating credentials in Secrets Manager, put other secrets in Parameter Store as SecureString, and scope the pipeline to one ARN.

Use when you add or change a VPC, subnet, route, NAT gateway, VPC endpoint, security group or Transit Gateway. Keep data subnets private and send S3 and DynamoDB through gateway endpoints.

Use when you create or upgrade an AKS cluster. Prefer a private cluster, Azure CNI overlay, Azure RBAC and workload identity, keep system and user pools apart, and move one Kubernetes minor at a time.

Use when you read, preview or take over a Bicep or ARM stack. Compile and run what-if before you deploy, keep Bicep if it already owns an Azure-only stack, and move to Terraform only when the rest of the estate is Terraform.

Use before a change that adds Azure spend, and when you read a bill. Check Cost Management, set a budget alert, right-size from metrics, and list orphaned disks, public IPs, idle load balancers and unused application gateways.

Use when you create a Key Vault or let a pipeline or app read it. Turn on RBAC authorization, purge protection and a private endpoint, split secrets, keys and certificates, and keep values out of logs and plan output.

Use when you add or change an Azure landing zone. Set the management group hierarchy, keep each subscription as the isolation boundary, and pin a reviewed hub or Virtual WAN module behind a federated pipeline identity.

Use when you change hub or spoke networks, peering, routes, NSGs, private endpoints or Private DNS. Send traffic through the hub firewall and name every route, zone and peering the change can break.

Use when you grant Azure RBAC or Entra access to a person, a workload or a pipeline. Assign the narrowest built-in or custom role at the resource, use Privileged Identity Management for people, and federate pipeline identities.

Use when you create or protect an Azure DevOps Git repository, or you open or review its pull request. Require a reviewer who is not the author, and do not bypass branch policy.

Use when you open or review a GitHub pull request. Target the default branch, wait for the ruleset and the checks, and stop before you approve or merge your own change.

Use when you create or protect a GitHub repository. Keep it private unless the change says otherwise, protect the default branch with a ruleset, and turn on secret scanning where the plan allows.

Use when you deliver workloads with Argo CD or Flux. Promote a digest through overlays, keep production sync from deleting on the first apply, and store secrets with SOPS or External Secrets.

Use when a request covers Azure, AWS, Terraform, a pipeline, a GitHub or Azure DevOps repository, or ServiceNow, and more than one skill could fit. Take the first matching row. That row names the one skill to load.

Use when you write or review a Dockerfile. Build in stages, run as a non-root user, pin the base image by digest, and scan the image before anyone deploys it.

Use when you add or upgrade a Helm chart. Require a values schema, read the rendered manifests, run helm diff, and keep a tested rollback to the previous release.

Use when you add or review a Kubernetes workload. Set requests and a memory limit, probes, a restricted security context, a disruption budget and a NetworkPolicy before the manifest is applied.

Use when someone joins, moves, or leaves, or you review who still has standing access on Azure or AWS. Remove what the job no longer needs, and keep break-glass out of daily use.

Use when you protect or restore data on Azure or AWS. Name the recovery point and the restore time, lock the backup vault, and prove a restore on a copy before you delete anything.

Use when you plan a change across Azure, AWS, or a pipeline. Name every subscription, account, cluster, and pipeline the change can touch before you apply it.

Use when a TLS certificate is expiring or you issue, renew, or bind one on Azure or AWS. Inventory every listener, renew into the store you already use, and prove the new certificate before you remove the old one.

Use when a production service is failing. Name a lead, set a severity from user impact, mitigate with a rehearsed rollback, and send updates on a fixed cadence.

Use when you add an alert or an SLO. Page on the symptom the user hits, attach one runbook, and wire Azure Monitor or CloudWatch only after you have read the series.

Use when a SEV1 or SEV2 incident is over. Write a blameless postmortem with the timeline, the contributing factors, and action items that each have an owner and a date.

Use when a change can reach production. Write the rollback for that change type, Terraform, deploy, migration, network, or IAM, and rehearse it before the change starts.

Use when you write or update a runbook. Give each step a command, the output you expect, and the person to escalate to when that output does not appear.

Use when you write a Bash, PowerShell, or Python automation script. Fail on errors and unset variables, support a dry run, and make a second run change nothing.

Use when a secret is created, copied, or leaked. Keep one home in Key Vault, Secrets Manager, or SOPS, and rotate a leaked value before you close the leak.

Use when you build an image or a package and promote it. Build once, deploy the digest, attach provenance and an SBOM, and keep registry tags immutable.

Use when you write, change, or diagnose an Azure DevOps YAML pipeline. Read a failed run before you edit it, put checks on the resource, and deploy with workload identity federation.

Use when a pipeline deploys to a shared environment. Require a reviewer on the GitHub environment or an Azure DevOps check, and bind the federated subject to that environment.

Use when you add or edit a GitHub Actions workflow. Pin every action to a reviewed commit SHA, keep permissions least privilege, and stop overlapping deploys with timeouts and concurrency.

Use when a GitHub Actions run fails, hangs or stays queued. Read the failed logs, re-run with debug logging, and fix the runner or the step instead of hiding the failure with a retry.

Use when a GitHub Actions or Azure DevOps pipeline logs in to Azure or AWS. Federate the identity with an exact subject and drop any stored cloud key or client secret.

Use when you share a GitHub Actions workflow, a composite action or an Azure DevOps template. Pin the caller to a reviewed ref and pass named secrets instead of inheriting every secret.

Use when you add or harden a GitHub Actions runner or an Azure DevOps agent pool. Keep it ephemeral, keep cloud keys off the host, and keep untrusted builds away from the production network.

Use when a pipeline runs Terraform for Azure or AWS. Lint with no cloud credential, plan on the pull request and comment a summary, then apply the saved plan from the merge commit after the environment approves, one environment at a time.

Use when you add or change a policy on a Terraform plan or a Kubernetes manifest. Run Conftest in CI, start Azure Policy and admission in audit, and keep an SCP as the AWS ceiling.

Apply before any change to Azure or AWS infrastructure, Terraform, or a GitHub Actions or Azure DevOps pipeline. Read the plan, name the blast radius, make one change at a time and promote it through environments.

Apply before you ship a change that adds or resizes Azure or AWS resources, or that increases log, NAT, public IP or data-transfer use. Price the monthly cost, set a budget alert and drop spend the design does not need.

Apply when Azure, AWS, Terraform or pipeline resources change, including a portal or console edit. Codify the change in the repository and import any drift so the next plan matches what is running.

Apply when writing or rerunning Terraform, scripts, GitHub Actions or Azure DevOps pipelines. A second run with the same inputs must succeed, change nothing further and be safe to start twice.

Apply when granting IAM, Azure RBAC or pipeline access for Azure, AWS, Terraform, GitHub Actions or Azure DevOps. Give each identity only the actions and scope the job needs, including GITHUB_TOKEN permissions and service connection scope.

Apply before a pipeline or workload authenticates to Azure or AWS, and again if a credential leaks. Use OIDC or workload identity federation and short-lived tokens. Revoke and rotate anything that has leaked.

Apply before changing Azure, AWS, Terraform or a pipeline to fix a failure or an alert. Read the actual logs, metrics and error text first, then fix the root cause those records show.

Use when you create an Azure or AWS resource. Take the name from the scheme you already use, set the tags that account requires, and deny delete on state and vaults.

Apply before any production change to Azure, AWS, Terraform, or a GitHub Actions or Azure DevOps pipeline. Write the rollback, rehearse it on a non-production environment and keep it ready before the change starts.

Use when an agent is about to apply, merge, deploy, or grant access for Azure, AWS, Terraform, or a pipeline. Prepare the diff and stop at the human approval that already exists.

Use when you raise or handle a ServiceNow change for the signed-in user. Default to a normal change, write the backout, and stop before approval or implementation.

Use when you open or update a ServiceNow incident for the signed-in user. Search the open queue first, set impact and urgency, and resolve only after the user confirms the symptom has stopped.

Use when you open or update a ServiceNow problem for the signed-in user. Relate the incidents that share a cause, record a workaround, and send the fix through a change.

Use when you look up what is open for a person in ServiceNow. Call the instance as that user, list their incidents, problems, changes, and requests, and do not create a record from this list.

Use when the signed-in user wants a ServiceNow catalog item. Search the catalog, submit that item with their variables, and stop before you approve the request.

Use when you install jstack for Cursor, GitHub Copilot, or Claude Code. Sync only the skills that machine or repository needs, and prove the copy with a dry run.

Detect and reconcile Terraform drift on Azure and AWS. Use when a scheduled plan exits with changes you did not ship, or Activity Log or CloudTrail shows a change made outside the code.

Design Terraform modules for Azure and AWS. Use when you add or change a child module: typed inputs and outputs, a pinned registry or git tag, and no provider block inside the module.

Review a Terraform plan before any Azure or AWS apply. Use when a pull request changes infrastructure: read the full plan, flag destroys and grants, name the blast radius, and apply only a saved plan file.

Configure remote Terraform state with locking for Azure and AWS. Use when you add a backend, split state by environment, move or import resources, or restore a versioned state blob or object.

Run Terraform fmt, validate, tflint, Checkov and Trivy on Azure and AWS code. Use when a pull request changes Terraform, or when you wire the same checks into pre-commit and the pipeline.

Test Terraform modules before they ship to Azure or AWS. Use when a module change needs a plan assertion with mocked providers, or a short-lived apply in an ephemeral test subscription or account.

Separate Terraform environments for Azure and AWS. Use when you choose a directory, workspace or Terragrunt layout, or when you promote one pinned module version to the next environment.