[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7AAGMYMXAMQFDSAF43VGQBQ":3,"skill-same:01M7AAGMYMXAMQFDSAF43VGQBQ":134},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":42,"commitSha":43,"skillDirectory":44,"forksCount":45,"repositoryHtmlUrl":46,"repositoryHomepageUrl":6,"ownerHtmlUrl":47,"ownerBlogUrl":6,"ownerDescription":48,"updatedAt":49,"install":50,"resources":63},"01M7AAGMYMXAMQFDSAF43VGQBQ","opensearch-domain-deployer",null,"Provisions Amazon OpenSearch Service domains with production defaults: deployment type (managed cluster vs Serverless), instance type (t3.small.search dev to r6g.4xlarge.search production), data nodes vs dedicated masters vs UltraWarm vs cold storage, Multi-AZ 3-zone, EBS (gp3 default, io1 for high IOPS), encryption at-rest (KMS, must enable at creation) and in-transit (TLS), VPC-only vs public access, fine-grained access control (FGAC) with IAM or Cognito master user, snapshots (automated + manual to S3), shard and replica count, OpenSearch Serverless, vector search, streaming ingestion. Emits a READY_TO_DEPLOY checklist with verification commands. Use when creating an OpenSearch domain, choosing managed vs Serverless, designing Multi-AZ topology, sizing shards and instances, enabling FGAC, or generating provisioning CLI \u002F IaC templates. Triggers: create OpenSearch, provision OpenSearch, OpenSearch Serverless, OpenSearch FGAC, UltraWarm, vector search.","jhkchan\u002Faws-agent-skills","jhkchan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1083902?v=4","01M7A2SVQYP9GQTPTDXP5JKYQ4","Jacky Chan","01M7A2SVS117YWCTZABB75HZR1",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: opensearch-domain-deployer\ndescription: 'Provisions Amazon OpenSearch Service domains with production defaults: deployment type (managed cluster vs Serverless), instance type (t3.small.search dev to r6g.4xlarge.search production), data nodes vs dedicated masters vs UltraWarm vs cold storage, Multi-AZ 3-zone, EBS (gp3 default, io1 for high IOPS), encryption at-rest (KMS, must enable at creation) and in-transit (TLS), VPC-only vs public access, fine-grained access control (FGAC) with IAM or Cognito master user, snapshots (automated + manual to S3), shard and replica count, OpenSearch Serverless, vector search, streaming ingestion. Emits a READY_TO_DEPLOY checklist with verification commands. Use when creating an OpenSearch domain, choosing managed vs Serverless, designing Multi-AZ topology, sizing shards and instances, enabling FGAC, or generating provisioning CLI \u002F IaC templates. Triggers: create OpenSearch, provision OpenSearch, OpenSearch Serverless, OpenSearch FGAC, UltraWarm, vector search.'\nlicense: Apache-2.0\ncompatibility: 'Agent runtime that reads SKILL.md (Claude Code, Cursor, Windsurf, Codex, Gemini). For live deployment: AWS CLI v2 with opensearch, opensearchserverless, ec2, kms, iam, and cognito-idp access. Works with Terraform aws_opensearch_domain \u002F aws_opensearchserverless_collection resources and CloudFormation AWS::OpenSearchService::Domain templates.'\nmetadata:\n  domain: aws-cloudops\n  complexity: high\n  requires_llm: 'true'\n  phase: '1'\n  supports_pipeline: 'true'\n  entry_point: 'false'\n  family: Analytics\n  task_type: deploy\n  skill_class: capability\n  lifecycle_status: active\n  verdict_shape: READY_TO_DEPLOY | PREREQUISITES_MISSING\n  version: 0.1.0\n  author: Jacky Chan — AWS Community Builder\n  tags: aws, opensearch, elasticsearch, cloudops, deploy, analytics, search, provisioning, managed-cluster, serverless, multi-az, encryption, fgac, ultrawarm, vector-search\n  dependencies: aws-orchestrator\n  keywords: aws, opensearch, elasticsearch, cloudops, deploy, provisioning, search, analytics, domain, managed cluster, serverless, data nodes, dedicated master, ultrawarm, cold storage, multi-az, 3-zone, ebs, gp3, io1, encryption at rest, encryption in transit, tls, kms, vpc, public access, fine-grained access control, fgac, iam master user, cognito, snapshot, repository, shard count, replica count, vector search, streaming ingestion\n  when_to_use: Invoke when the user wants to create a new OpenSearch Service domain (managed cluster or Serverless), design a Multi-AZ production topology with dedicated master nodes, size data nodes and shard count, enable fine-grained access control (FGAC), configure UltraWarm or cold storage for cost optimization, set up vector search collections, configure snapshot repositories, or generate provisioning CLI commands \u002F IaC templates. Do NOT invoke for auditing existing domain posture (use opensearch-domain-auditor), or for non-OpenSearch search\u002Fanalytics (Athena, CloudSearch, self-managed Elasticsearch on EC2).\n---\n\n# OpenSearch Domain Deployer\n\nAn AWS CloudOps agent skill that provisions Amazon OpenSearch Service\ndomains with correct defaults. The skill walks the operator through a\n10-step provisioning procedure and emits a READY_TO_DEPLOY checklist with\nverification commands.\n\n## Activation keywords\n\ncreate OpenSearch, provision OpenSearch, managed cluster, OpenSearch\nServerless, data nodes, dedicated master nodes, UltraWarm, cold storage,\nMulti-AZ, 3-zone deployment, instance type, EBS storage, gp3, io1,\nencryption at rest, encryption in transit, TLS, KMS, VPC access, public\naccess, fine-grained access control, FGAC, IAM master user, Cognito,\nsnapshot repository, shard count, replica count, vector search collection,\nstreaming ingestion.\n\n## Invocation contract (hard requirement)\n\nWhen this skill is invoked with a domain-provisioning request (domain\nname, instance type, workload shape, region, or a partial configuration),\nthe agent MUST respond with the READY_TO_DEPLOY checklist defined in\n\"Output format\" using the literal all-caps labels `DOMAIN:`, `VERDICT:`,\n`CHECKLIST:`, and `VERIFICATION_COMMANDS:`. Do NOT preface with prose,\nheadings, or disclaimers — emit the block as the first lines of the response.\n\n## Mindset\n\n**One-line takeaway:** OpenSearch correctness is decided at creation\ntime. Encryption at rest, FGAC mode, VPC vs public access, and Multi-AZ\ntopology are impossible or disruptive to change later — treat each as a\none-way door and force an explicit decision before `create-domain`.\n\nThree misconceptions dominate OpenSearch misdesign:\n- **\"Pick the largest instance and scale down later.\"** OpenSearch charges\n  per instance-hour regardless of utilization. Size based on storage +\n  the shard-count heuristic (1 shard per 30-50 GB), not \"we might need it.\"\n- **\"Public access with IP allowlist is fine for production.\"** An IP\n  allowlist is a network control, not authentication. VPC-only with\n  FGAC + IAM is the production baseline.\n- **\"Dedicated master nodes are optional.\"** Without dedicated masters,\n  cluster-state changes consume CPU on data nodes — query latency spikes\n  during recovery. Mandatory for > 10 data nodes or latency-sensitive workloads.\n\n## Quick navigation\n\n| Section | When to read |\n|---|---|\n| Prerequisites | Always — verify before provisioning |\n| Step 1 — Deployment type | Managed cluster vs Serverless |\n| Step 2 — Instance types | t3\u002Fr6g\u002Fm6g\u002Fc6g.search selection |\n| Step 3 — Multi-AZ + dedicated masters | Production topology |\n| Step 4 — Storage (EBS, instance) | gp3 vs io1 vs instance-store |\n| Step 5 — Encryption | KMS at-rest, TLS in-transit |\n| Step 6 — Network + FGAC | VPC vs public, IAM vs Cognito |\n| Step 7 — Indexing (shards, replicas) | Shard count, replica count |\n| Step 8 — Snapshots | Automated + manual to S3 |\n| Step 9 — UltraWarm \u002F cold storage | Tiered storage for cost |\n| Step 10 — Serverless \u002F vector search | Latest 2023-2026 features |\n| NEVER do these things | Review before signing off |\n| Output format | The literal checklist template |\n| references\u002Ftopology-and-indexing.md | Deep Multi-AZ + shard math |\n| references\u002Fprovisioning-cli-commands.md | Copy-pasteable CLI sequence |\n\n## Reasoning framework (why provisioning order matters)\n\nOpenSearch configurations have **dependency and immutability semantics**.\nThe four one-way doors decided at creation time:\n\n1. **Encryption at rest** — MUST enable at creation. Cannot be added to\n   an existing domain without new domain + reindex.\n2. **FGAC mode** (IAM vs Cognito) — chosen at creation. Switching modes\n   requires full reindex via remote reindex.\n3. **VPC vs public access** — cannot switch post-creation. No modify path.\n4. **Multi-AZ topology** — requires node count multiple of 3. Adding a\n   third AZ to a 2-AZ cluster requires disruptive node-count change.\n\nAdditionally: instance type changes require blue-green deployment (multi-hour\nshard migration). Shard count changes require `_split` or `_shrink` (disruptive).\n\nThe full configuration dependency graph (which settings are immutable,\nwhich silently downgrade, which enable downstream features) is in\n`references\u002Ftopology-and-indexing.md`.\n\n## Prerequisites (verify before provisioning)\n\n| Prerequisite | Why it matters | How to verify |\n|---|---|---|\n| AWS account with OpenSearch access | Required | `aws sts get-caller-identity` |\n| Region selected | Domains are region-scoped | `aws configure get region` |\n| Domain name unique in account-region | Name is immutable; endpoint derives from it | `aws opensearch describe-domain --domain-name \u003Cname>` |\n| VPC ID + subnets in 3 AZs (Multi-AZ) | Multi-AZ requires 3 AZs | `aws ec2 describe-subnets` — confirm 3 distinct AZs |\n| Security group with port 443 inbound | OpenSearch uses HTTPS | `aws ec2 describe-security-groups --group-ids \u003Csg>` |\n| KMS key ARN (if encryption with CMK) | Custom encryption requires CMK in same region | `aws kms describe-key --key-id \u003Ccmk-id>` |\n| IAM role ARN for master user (if FGAC) | FGAC requires master user | `aws iam get-role --role-name \u003Crole>` |\n| Cognito user pool + identity pool (if Cognito FGAC) | Required for Cognito-based FGAC | `aws cognito-idp describe-user-pool --user-pool-id \u003Cpool>` |\n| S3 bucket + IAM role for manual snapshots | Manual snapshots require registered repository | `aws s3api head-bucket --bucket \u003Cbucket>` |\n| Workload description (data size, query pattern) | Drives instance\u002Fshard\u002Freplica decisions | Captured in prompt |\n\nIf any prerequisite is missing, output `VERDICT: PREREQUISITES_MISSING`\nand cite the specific gap.\n\n## Sizing heuristics (quick reference)\n\nFull detail in `references\u002Ftopology-and-indexing.md`.\n\n**Shard count:** `ceil(total_data_size_gb \u002F 30)` for write-heavy, `\u002F 50`\nfor read-heavy. Over-sharding small datasets wastes overhead; use 1 shard\nfor \u003C 10 GB.\n\n**Storage capacity:** `total_storage = raw_data × (1 + replica_count) × 1.1`\n(10% overhead + 15% free-space watermark). Required data nodes =\n`ceil(total_storage \u002F per_node_storage)`. Round UP to multiple of 3 for Multi-AZ.\n\n**Dedicated masters:** mandatory for > 10 data nodes. Type: `c6g.large.search`\nfor up to 15 data nodes; `c6g.2xlarge.search` for 15-30; `c6g.4xlarge.search` for 30+.\n\n**Heap:** 50% of instance RAM, capped at 31 GB (compressed oops boundary).\n\n## 10-step provisioning procedure\n\n### Step 1 — Deployment type: managed cluster vs Serverless (immutable)\n\n**Decision:**\n- **Unpredictable\u002Fbursty workload** → OpenSearch Serverless (auto-scaling,\n  pay-per-use). Does NOT support UltraWarm, cold storage, dedicated masters,\n  or cross-cluster search.\n- **Steady-state + predictable** → Managed cluster (full feature set).\n- **Vector search only** → Serverless VECTORSEARCH collection.\n- **Needs UltraWarm\u002Fcold storage** → Managed cluster (Serverless lacks tiered storage).\n\n### Step 2 — Instance types (managed cluster)\n\n| Family | Examples | Optimized for | Use when |\n|---|---|---|---|\n| `r6g.search` \u002F `r7g.search` | r6g.large to r6g.4xlarge | Memory | **Production DEFAULT** |\n| `c6g.search` | c6g.large to c6g.2xlarge | Compute | Aggregations, ML; dedicated masters |\n| `m6g.search` | m6g.large to m6g.4xlarge | Balanced | Mixed workloads |\n| `i3.search` | i3.large to i3.2xlarge | Instance storage (NVMe) | Very high IOPS; log analytics |\n| `t3.search` | t3.small to t3.medium | Burst | **Dev\u002Ftest ONLY** |\n| Legacy (`t2`,`m3`,`m4`,`c4`,`r3`,`r4`,`i2`) | — | — | **DO NOT USE — end-of-life** |\n\n**Size by workload:**\n- Dev\u002Ftest: `t3.small.search` × 1 (no Multi-AZ).\n- Small production (\u003C 50 GB): `r6g.large.search` × 3.\n- Mid production (50-500 GB): `r6g.2xlarge.search` × 3-6 (Multi-AZ).\n- Large production (500 GB-5 TB): `r6g.4xlarge.search` × 6-12 + 3 dedicated masters.\n- Very large (5+ TB): shard across domains OR use UltraWarm\u002Fcold storage.\n\n**NEVER use `t3.small.search` for production** — CPU credits deplete and\nthrottle under sustained traffic.\n\n### Step 3 — Multi-AZ + dedicated master nodes\n\nMulti-AZ (3-zone) is the primary resilience control. **Instance count must\nbe a multiple of 3.**\n\n- Enable `ZoneAwarenessEnabled=true` + `AvailabilityZoneCount=3`.\n- OpenSearch places primary and replica shards in different AZs.\n- A 3-node cluster with `replica=1` tolerates one AZ loss.\n\n**Dedicated masters** (3 — one per AZ):\n- Mandatory for > 10 data nodes, latency-sensitive workloads (p99 \u003C 100 ms),\n  or frequent index creation.\n- Master type: `c6g.large.search` (≤15 data nodes), `c6g.2xlarge.search`\n  (15-30), `c6g.4xlarge.search` (30+).\n- Masters are CPU-bound, not memory-bound. Use `c6g`, not `r6g`.\n\n**NEVER use a 2-AZ topology with odd node count** — uneven shard\ndistribution makes one AZ a SPOF.\n\n### Step 4 — Storage (EBS vs instance-store)\n\n| Volume type | IOPS | Use when |\n|---|---|---|\n| `gp3` (default) | 3,000 baseline, up to 16,000 | **DEFAULT CHOICE** — most production |\n| `io1` | up to 64,000 provisioned | High-IOPS; consistent latency |\n| `standard` (magnetic) | low | **DO NOT USE — legacy** |\n\n- EBS size: 10 GB - 6 TB (gp3). Plan for 15% free (write-block watermark at 85%).\n- Instance-store (NVMe): `i3.search` only. Higher IOPS but ephemeral — data\n  lost on instance failure. Use with `replica >= 1`.\n\n**Common mistake:** sizing EBS for raw data without the replica + overhead\nmultiplier. A 500 GB index with 1 replica needs 500 × 2 × 1.1 = 1.1 TB.\n\n### Step 5 — Encryption (at-rest + in-transit)\n\n**Encryption at rest:**\n- **MUST enable at domain creation.** Cannot be added later.\n- Uses AWS KMS. Default: AWS-managed key. For compliance: customer CMK.\n\n**Encryption in transit (TLS):**\n- Recommended at creation. Can enable post-creation but triggers rolling\n  node replacement disconnecting clients for 10-30 minutes.\n- Use `Policy-Min-TLS-1-2-2019-07` (TLS 1.2 minimum). Never allow TLS 1.0\u002F1.1.\n\n```bash\naws opensearch create-domain ... \\\n  --encryption-at-rest-options Enabled=true,KmsKeyId=arn:aws:kms:...:alias\u002F\u003Ccmk> \\\n  --node-to-node-encryption-options Enabled=true \\\n  --domain-endpoint-options EnforceHTTPS=true,TLSSecurityPolicy=Policy-Min-TLS-1-2-2019-07\n```\n\n### Step 6 — Network access + fine-grained access control (FGAC)\n\n**Network access:**\n\n| Mode | Use when |\n|---|---|\n| VPC-only | **PRODUCTION.** Network isolation; security group controls ingress. |\n| Public | Dev\u002Ftest only. IP allowlist is a network control, not authentication. |\n\n**FGAC modes (mutually exclusive — choose at creation):**\n\n| Mode | Master user | Use when |\n|---|---|---|\n| IAM master user | IAM role ARN | Programmatic access; AWS-native orgs |\n| Cognito user pool | Cognito pool + identity pool | Human users; SSO; web-app dashboards |\n| IP-only (no FGAC) | N\u002FA | **DO NOT USE for production** |\n\n**Common mistake:** public access with IP allowlist for \"production.\" Always\nuse VPC-only access with FGAC for production.\n\n### Step 7 — Indexing (shard count, replica count)\n\n- **Shard count:** apply the 30-50 GB per shard rule. Set at index creation\n  via `\"number_of_shards\": N`. Change post-creation: `_split`\u002F`_shrink`\n  (disruptive).\n- **Replica count:** default 1. Set via `\"number_of_replicas\": N`.\n  Changeable at runtime (no disruption). Multi-AZ places replicas in\n  different AZs.\n\n| Replica | Storage multiplier | Use when |\n|---|---|---|\n| 0 | 1x | Dev\u002Ftest only (data loss on failure) |\n| 1 | 2x | **Production standard** |\n| 2 | 3x | High availability (rare; cost) |\n\n**NEVER over-shard a small dataset.** A 1 GB index with 5 shards wastes\noverhead — use 1 shard.\n\n### Step 8 — Snapshots (automated + manual)\n\n- **Automated:** daily to AWS-managed S3. Retention 1-35 days (configurable).\n  Used for point-in-time recovery to same or new domain.\n- **Manual:** customer-managed S3 bucket. Requires \"snapshot repository\"\n  registered via `PUT _snapshot\u002F\u003Crepo>`. Used for long-term retention,\n  cross-cluster migration, backup before upgrades.\n\nFull snapshot repository registration and restore CLI is in\n`references\u002Fprovisioning-cli-commands.md`.\n\n**NEVER rely on automated snapshots as the ONLY backup.** For long-term\nretention or cross-region DR, configure manual snapshots.\n\n### Step 9 — UltraWarm and cold storage (managed cluster only)\n\nServerless does NOT support these. Managed cluster only.\n\n- **UltraWarm:** read-only warm tier. ~50% cheaper than hot. Indices become\n  READ-ONLY after migration. Hot→warm via ISM; warm→hot requires reindex.\n- **Cold storage:** read-only archive on S3. ~80% cheaper. Recall takes\n  minutes-hours. Requires UltraWarm enabled.\n\n**ISM lifecycle:** hot (active) → warm (7d) → cold (30d) → delete (365d).\n\n**NEVER use UltraWarm as a write target** — READ-ONLY. Writes must\ncomplete on hot tier before ISM migrates.\n\n### Step 10 — OpenSearch Serverless \u002F vector search \u002F streaming ingestion\n\n- **OpenSearch Serverless:** auto-scaling, pay-per-use (OCU billing). No\n  capacity management. Separate API (`opensearchserverless`).\n- **Vector search collections:** `--type VECTORSEARCH`. Optimized for k-NN\n  similarity search (HNSW, IVF). For RAG\u002Fgenerative AI workloads.\n- **Streaming ingestion:** direct from Kinesis, MSK, or S3 without Lambda.\n  Lower latency than Lambda-based ingestion.\n- **Cross-cluster search:** connect multiple domains for federated search.\n\n**Common mistake:** provisioning a managed cluster for vector-search-only\nworkload. Serverless VECTORSEARCH is cheaper and simpler for pure k-NN.\n\n## NEVER do these things\n\n1. **NEVER use public access for a production OpenSearch domain.** Public\n   access exposes the endpoint to internet scanning. VPC-only with FGAC + IAM.\n\n2. **NEVER forget to enable encryption at rest at domain creation.**\n   Adding it later requires a new domain + full reindex + client repoint.\n\n3. **NEVER use `t3.small.search` for production.** CPU credits deplete\n   under sustained traffic. Use `r6g.search` or `r7g.search`.\n\n4. **NEVER provision a 2-AZ topology with odd node count.** Multi-AZ\n   requires 3 AZs and node count multiple of 3. Uneven allocation = SPOF.\n\n5. **NEVER skip dedicated master nodes for clusters > 10 data nodes.**\n   Without dedicated masters, cluster-state updates spike query latency\n   during recovery. Use 3 dedicated masters (one per AZ).\n\nExtended anti-patterns (JVM heap cap, TLS policy, IP-only FGAC, automated\nsnapshot reliance, FGAC mode switch, UltraWarm writes, EOL instances) are\ndocumented in `references\u002Ftopology-and-indexing.md`.\n\n## Error handling\n\n| Error | Cause | Fix |\n|---|---|---|\n| `ResourceAlreadyExistsException` | Domain name taken | Check existing config; update mutable settings or create new domain |\n| Encryption-at-rest enable fails on existing domain | Cannot add post-creation | Create NEW domain with encryption, reindex via `_remote\u002Freindex` |\n| Multi-AZ create with uneven node count | `InstanceCount` not divisible by 3 | Round UP to next multiple of 3 |\n| Dedicated master toggle during update | Blue-green deployment (1-4 hours) | Enable at creation; toggle requires maintenance window |\n| `RepositoryMissingException` | Snapshot repo not registered | Register via `PUT _snapshot\u002F\u003Crepo>` before taking snapshots |\n| FGAC mode switch fails | IAM↔Cognito not supported via update | Create NEW domain with desired FGAC mode, reindex |\n| Cluster stuck in `PROCESSING` | Blue-green on large cluster (1-4 hours) | `aws opensearch describe-domain --query 'DomainStatus.Processing'` — wait for false |\n\n## Output format\n\n```text\nDOMAIN: \u003Cdomain-or-collection-name>\nVERDICT: READY_TO_DEPLOY | PREREQUISITES_MISSING\nCHECKLIST:\n  [✓|✗] Deployment type: managed cluster | serverless\n  [✓|✗] Instance type: \u003Cfamily>.\u003Csize>.search (data nodes)\n  [✓|✗] Instance count: \u003CN> data nodes (multiple of 3 for Multi-AZ)\n  [✓|✗] Multi-AZ (3-zone): Enabled | Disabled\n  [✓|✗] Dedicated master nodes: \u003CN> × \u003Cfamily>.\u003Csize>.search | None\n  [✓|✗] Storage: EBS \u003Ctype> \u003Csize>GB | instance-store NVMe\n  [✓|✗] Encryption at rest: Enabled (customer CMK \u003Ckey-arn> | AWS-managed) | Disabled\n  [✓|✗] Encryption in transit (TLS): Enabled (Policy-Min-TLS-1-2-2019-07) | Disabled\n  [✓|✗] Network access: VPC-only (subnets: \u003Cids>, SG: \u003Csg-id> port 443) | Public (IP allowlist)\n  [✓|✗] Fine-grained access control (FGAC): IAM master user (\u003Crole-arn>) | Cognito (\u003Cpool-id>) | Disabled\n  [✓|✗] Master user: IAM role \u003Carn> | Cognito user \u003Cusername>\n  [✓|✗] Shard count rule: 30-50 GB per shard applied\n  [✓|✗] Replica count: \u003CN> (tolerates \u003CN> node losses)\n  [✓|✗] Automated snapshots: Enabled (retention \u003CN> days)\n  [✓|✗] Manual snapshot repository: registered (S3 bucket \u003Cname>, role \u003Carn>) | None\n  [✓|✗] UltraWarm: Enabled (\u003CN> × \u003Ctype>) | Disabled\n  [✓|✗] Cold storage: Enabled | Disabled\n  [✓|✗] OpenSearch Serverless: Yes (collection type \u003Ctype>) | No\nVERIFICATION_COMMANDS:\n  aws opensearch describe-domain --domain-name \u003Cname>\n  aws opensearch describe-domain-config --domain-name \u003Cname>\n  aws ec2 describe-security-groups --group-ids \u003Csg-id>\n  aws kms describe-key --key-id \u003Ccmk-id>\n  aws iam get-role --role-name \u003Cmaster-role>\n```\n\n### Worked example — production managed cluster with Multi-AZ\n\n```text\nDOMAIN: prod-search\nVERDICT: READY_TO_DEPLOY\nCHECKLIST:\n  [✓] Deployment type: managed cluster\n  [✓] Instance type: r6g.2xlarge.search (data nodes)\n  [✓] Instance count: 6 data nodes (2 per AZ × 3 AZs)\n  [✓] Multi-AZ (3-zone): Enabled (us-east-1a\u002Fb\u002Fc)\n  [✓] Dedicated master nodes: 3 × c6g.large.search (1 per AZ)\n  [✓] Storage: EBS gp3 100GB per node (600 GB cluster capacity)\n  [✓] Encryption at rest: Enabled (customer CMK alias\u002Fprod-opensearch-kms)\n  [✓] Encryption in transit (TLS): Enabled (Policy-Min-TLS-1-2-2019-07)\n  [✓] Network access: VPC-only (subnets: subnet-0aaa\u002F0bbb\u002F0ccc, SG: sg-search123 port 443)\n  [✓] Fine-grained access control (FGAC): IAM master user (arn:aws:iam::123456789012:role\u002Fopensearch-master)\n  [✓] Master user: IAM role arn:aws:iam::123456789012:role\u002Fopensearch-master\n  [✓] Shard count rule: 30 GB per shard applied (17 shards for 500 GB indices)\n  [✓] Replica count: 1 (tolerates 1 node loss per shard)\n  [✓] Automated snapshots: Enabled (retention 14 days)\n  [✓] Manual snapshot repository: registered (S3 bucket opensearch-snapshots-prod, role arn:aws:iam::123456789012:role\u002Fopensearch-snapshot)\n  [✓] UltraWarm: Disabled (workload is search, not time-series)\n  [✓] Cold storage: Disabled\n  [✓] OpenSearch Serverless: No\nVERIFICATION_COMMANDS:\n  aws opensearch describe-domain --domain-name prod-search\n  aws opensearch describe-domain-config --domain-name prod-search\n  aws ec2 describe-security-groups --group-ids sg-search123\n  aws kms describe-key --key-id alias\u002Fprod-opensearch-kms\n  aws iam get-role --role-name opensearch-master\n```\n\n## STRICT output contract\n\nThis section codifies the exact output shape the eval harness asserts\nagainst. Every invocation MUST produce output matching this contract or\nthe response is rejected.\n\n### Required output structure\n\nEvery response MUST be a single block with these literal labels, in order,\nas the first lines of the response (no preamble, no prose, no disclaimers):\n\n```text\nDOMAIN: \u003Cdomain-or-collection-name>\nVERDICT: READY_TO_DEPLOY | PREREQUISITES_MISSING\nCHECKLIST:\n  [✓|✗] Deployment type: managed cluster | serverless\n  [✓|✗] Instance type: \u003Cfamily>.\u003Csize>.search (data nodes)\n  [✓|✗] Instance count: \u003CN> data nodes (multiple of 3 for Multi-AZ)\n  [✓|✗] Multi-AZ (3-zone): Enabled | Disabled\n  [✓|✗] Dedicated master nodes: \u003CN> × \u003Cfamily>.\u003Csize>.search | None\n  [✓|✗] Storage: EBS \u003Ctype> \u003Csize>GB | instance-store NVMe\n  [✓|✗] Encryption at rest: Enabled (customer CMK \u003Ckey-arn> | AWS-managed) | Disabled\n  [✓|✗] Encryption in transit (TLS): Enabled (Policy-Min-TLS-1-2-2019-07) | Disabled\n  [✓|✗] Network access: VPC-only (subnets: \u003Cids>, SG: \u003Csg-id> port 443) | Public (IP allowlist)\n  [✓|✗] Fine-grained access control (FGAC): IAM master user (\u003Crole-arn>) | Cognito (\u003Cpool-id>) | Disabled\n  [✓|✗] Master user: IAM role \u003Carn> | Cognito user \u003Cusername>\n  [✓|✗] Shard count rule: 30-50 GB per shard applied\n  [✓|✗] Replica count: \u003CN> (tolerates \u003CN> node losses)\n  [✓|✗] Automated snapshots: Enabled (retention \u003CN> days)\n  [✓|✗] Manual snapshot repository: registered (S3 bucket \u003Cname>, role \u003Carn>) | None\n  [✓|✗] UltraWarm: Enabled (\u003CN> × \u003Ctype>) | Disabled\n  [✓|✗] Cold storage: Enabled | Disabled\n  [✓|✗] OpenSearch Serverless: Yes (collection type \u003Ctype>) | No\nVERIFICATION_COMMANDS:\n  aws opensearch describe-domain --domain-name \u003Cname>\n  aws opensearch describe-domain-config --domain-name \u003Cname>\n  aws ec2 describe-security-groups --group-ids \u003Csg-id>\n  aws kms describe-key --key-id \u003Ccmk-id>\n  aws iam get-role --role-name \u003Cmaster-role>\n```\n\n### FORBIDDEN output patterns\n\n1. **NEVER output READY_TO_DEPLOY without listing every checklist item\n   with [✓] or [✗].** Every row must appear with an explicit status marker.\n   The eval harness asserts a minimum row count.\n\n2. **NEVER omit the instance type recommendation.** Must specify the exact\n   `.search`-suffixed type (e.g., r6g.large.search). \"TBD\" or \"memory-optimized\"\n   is rejected.\n\n3. **NEVER recommend public access for production.** VPC-only is the\n   production default. Only dev\u002Ftest may use public, with explicit note.\n\n4. **NEVER emit a checklist without the encryption-at-rest status.**\n   Encryption at rest is immutable after creation — omitting it leaves the\n   operator blind to a one-way door decision.\n\n5. **NEVER substitute lowercase or markdown-styled labels for the literal\n   all-caps `DOMAIN:`, `VERDICT:`, `CHECKLIST:`, `VERIFICATION_COMMANDS:`.**\n\n6. **NEVER preface the checklist with prose, headings, or disclaimers.**\n   The `DOMAIN:` line must be the first line of the response.\n\n## Recent AWS features (2022-2026)\n\n- **OpenSearch Serverless (2022-2023):** Auto-scaling, pay-per-use. Separate\n  API. Does NOT support UltraWarm, cold storage, dedicated masters.\n- **Vector search collections (2023-2024):** Serverless `VECTORSEARCH`. k-NN\n  similarity search (HNSW, IVF). For RAG\u002Fgenerative AI workloads.\n- **Streaming ingestion (2023-2024):** Direct from Kinesis, MSK, or S3\n  without Lambda. Lower latency than Lambda-based ingestion.\n- **Cross-cluster search (2023-2024):** Connect multiple domains for\n  federated search via `connections` API.\n- **gp3 EBS default (2022-2023):** gp3 replaces gp2. Higher baseline IOPS\n  (3,000 vs gp2's 250). Cheaper and faster.\n- **Graviton (g-series) instance types (2022-2024):** `r6g`, `c6g`, `m6g`\n  offer ~20% better price\u002Fperformance over Intel. Default for new clusters.\n- **OpenSearch 2.x (2022-2024):** Anomaly detection, k-NN boosts, session-\n  based search, streaming ingestion. Use OpenSearch 2.11+.\n\n## References\n\n- `references\u002Ftopology-and-indexing.md` — managed vs Serverless feature\n  matrix, Multi-AZ topology math, dedicated master sizing, EBS vs instance-\n  store selection, shard\u002Freplica heuristics, UltraWarm\u002Fcold storage lifecycle,\n  vector search collection sizing, configuration dependency graph.\n- `references\u002Fprovisioning-cli-commands.md` — full copy-pasteable CLI\n  sequence for all provisioning steps, including managed cluster creation,\n  Serverless collection setup, vector search, snapshot registration, ISM\n  policies, CloudWatch alarms, and Terraform equivalents.\n\n## Domain\n\nAWS CloudOps \u002F OpenSearch Service Provisioning & Search Topology Design.\n\n## AWS documentation\n\n- **Amazon OpenSearch Service Developer Guide** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fwhat-is.html\n- **Managed domains** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fcreateupdatedomains.html\n- **OpenSearch Serverless** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fserverless.html\n- **Multi-AZ domains** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fmanagedomains-multiaz.html\n- **Dedicated master nodes** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fmanagedomains-dedicatedmasternodes.html\n- **Encryption at rest** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fencryption-at-rest.html\n- **Fine-grained access control** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Ffgac.html\n- **UltraWarm storage** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fultrawarm.html\n- **Cold storage** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fcold-storage.html\n- **Sizing domains** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fsizing-domains.html\n- **Vector search** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fknn.html\n","# OpenSearch Domain Deployer\n\nAn AWS CloudOps agent skill that provisions Amazon OpenSearch Service\ndomains with correct defaults. The skill walks the operator through a\n10-step provisioning procedure and emits a READY_TO_DEPLOY checklist with\nverification commands.\n\n## Activation keywords\n\ncreate OpenSearch, provision OpenSearch, managed cluster, OpenSearch\nServerless, data nodes, dedicated master nodes, UltraWarm, cold storage,\nMulti-AZ, 3-zone deployment, instance type, EBS storage, gp3, io1,\nencryption at rest, encryption in transit, TLS, KMS, VPC access, public\naccess, fine-grained access control, FGAC, IAM master user, Cognito,\nsnapshot repository, shard count, replica count, vector search collection,\nstreaming ingestion.\n\n## Invocation contract (hard requirement)\n\nWhen this skill is invoked with a domain-provisioning request (domain\nname, instance type, workload shape, region, or a partial configuration),\nthe agent MUST respond with the READY_TO_DEPLOY checklist defined in\n\"Output format\" using the literal all-caps labels `DOMAIN:`, `VERDICT:`,\n`CHECKLIST:`, and `VERIFICATION_COMMANDS:`. Do NOT preface with prose,\nheadings, or disclaimers — emit the block as the first lines of the response.\n\n## Mindset\n\n**One-line takeaway:** OpenSearch correctness is decided at creation\ntime. Encryption at rest, FGAC mode, VPC vs public access, and Multi-AZ\ntopology are impossible or disruptive to change later — treat each as a\none-way door and force an explicit decision before `create-domain`.\n\nThree misconceptions dominate OpenSearch misdesign:\n- **\"Pick the largest instance and scale down later.\"** OpenSearch charges\n  per instance-hour regardless of utilization. Size based on storage +\n  the shard-count heuristic (1 shard per 30-50 GB), not \"we might need it.\"\n- **\"Public access with IP allowlist is fine for production.\"** An IP\n  allowlist is a network control, not authentication. VPC-only with\n  FGAC + IAM is the production baseline.\n- **\"Dedicated master nodes are optional.\"** Without dedicated masters,\n  cluster-state changes consume CPU on data nodes — query latency spikes\n  during recovery. Mandatory for > 10 data nodes or latency-sensitive workloads.\n\n## Quick navigation\n\n| Section | When to read |\n|---|---|\n| Prerequisites | Always — verify before provisioning |\n| Step 1 — Deployment type | Managed cluster vs Serverless |\n| Step 2 — Instance types | t3\u002Fr6g\u002Fm6g\u002Fc6g.search selection |\n| Step 3 — Multi-AZ + dedicated masters | Production topology |\n| Step 4 — Storage (EBS, instance) | gp3 vs io1 vs instance-store |\n| Step 5 — Encryption | KMS at-rest, TLS in-transit |\n| Step 6 — Network + FGAC | VPC vs public, IAM vs Cognito |\n| Step 7 — Indexing (shards, replicas) | Shard count, replica count |\n| Step 8 — Snapshots | Automated + manual to S3 |\n| Step 9 — UltraWarm \u002F cold storage | Tiered storage for cost |\n| Step 10 — Serverless \u002F vector search | Latest 2023-2026 features |\n| NEVER do these things | Review before signing off |\n| Output format | The literal checklist template |\n| references\u002Ftopology-and-indexing.md | Deep Multi-AZ + shard math |\n| references\u002Fprovisioning-cli-commands.md | Copy-pasteable CLI sequence |\n\n## Reasoning framework (why provisioning order matters)\n\nOpenSearch configurations have **dependency and immutability semantics**.\nThe four one-way doors decided at creation time:\n\n1. **Encryption at rest** — MUST enable at creation. Cannot be added to\n   an existing domain without new domain + reindex.\n2. **FGAC mode** (IAM vs Cognito) — chosen at creation. Switching modes\n   requires full reindex via remote reindex.\n3. **VPC vs public access** — cannot switch post-creation. No modify path.\n4. **Multi-AZ topology** — requires node count multiple of 3. Adding a\n   third AZ to a 2-AZ cluster requires disruptive node-count change.\n\nAdditionally: instance type changes require blue-green deployment (multi-hour\nshard migration). Shard count changes require `_split` or `_shrink` (disruptive).\n\nThe full configuration dependency graph (which settings are immutable,\nwhich silently downgrade, which enable downstream features) is in\n`references\u002Ftopology-and-indexing.md`.\n\n## Prerequisites (verify before provisioning)\n\n| Prerequisite | Why it matters | How to verify |\n|---|---|---|\n| AWS account with OpenSearch access | Required | `aws sts get-caller-identity` |\n| Region selected | Domains are region-scoped | `aws configure get region` |\n| Domain name unique in account-region | Name is immutable; endpoint derives from it | `aws opensearch describe-domain --domain-name \u003Cname>` |\n| VPC ID + subnets in 3 AZs (Multi-AZ) | Multi-AZ requires 3 AZs | `aws ec2 describe-subnets` — confirm 3 distinct AZs |\n| Security group with port 443 inbound | OpenSearch uses HTTPS | `aws ec2 describe-security-groups --group-ids \u003Csg>` |\n| KMS key ARN (if encryption with CMK) | Custom encryption requires CMK in same region | `aws kms describe-key --key-id \u003Ccmk-id>` |\n| IAM role ARN for master user (if FGAC) | FGAC requires master user | `aws iam get-role --role-name \u003Crole>` |\n| Cognito user pool + identity pool (if Cognito FGAC) | Required for Cognito-based FGAC | `aws cognito-idp describe-user-pool --user-pool-id \u003Cpool>` |\n| S3 bucket + IAM role for manual snapshots | Manual snapshots require registered repository | `aws s3api head-bucket --bucket \u003Cbucket>` |\n| Workload description (data size, query pattern) | Drives instance\u002Fshard\u002Freplica decisions | Captured in prompt |\n\nIf any prerequisite is missing, output `VERDICT: PREREQUISITES_MISSING`\nand cite the specific gap.\n\n## Sizing heuristics (quick reference)\n\nFull detail in `references\u002Ftopology-and-indexing.md`.\n\n**Shard count:** `ceil(total_data_size_gb \u002F 30)` for write-heavy, `\u002F 50`\nfor read-heavy. Over-sharding small datasets wastes overhead; use 1 shard\nfor \u003C 10 GB.\n\n**Storage capacity:** `total_storage = raw_data × (1 + replica_count) × 1.1`\n(10% overhead + 15% free-space watermark). Required data nodes =\n`ceil(total_storage \u002F per_node_storage)`. Round UP to multiple of 3 for Multi-AZ.\n\n**Dedicated masters:** mandatory for > 10 data nodes. Type: `c6g.large.search`\nfor up to 15 data nodes; `c6g.2xlarge.search` for 15-30; `c6g.4xlarge.search` for 30+.\n\n**Heap:** 50% of instance RAM, capped at 31 GB (compressed oops boundary).\n\n## 10-step provisioning procedure\n\n### Step 1 — Deployment type: managed cluster vs Serverless (immutable)\n\n**Decision:**\n- **Unpredictable\u002Fbursty workload** → OpenSearch Serverless (auto-scaling,\n  pay-per-use). Does NOT support UltraWarm, cold storage, dedicated masters,\n  or cross-cluster search.\n- **Steady-state + predictable** → Managed cluster (full feature set).\n- **Vector search only** → Serverless VECTORSEARCH collection.\n- **Needs UltraWarm\u002Fcold storage** → Managed cluster (Serverless lacks tiered storage).\n\n### Step 2 — Instance types (managed cluster)\n\n| Family | Examples | Optimized for | Use when |\n|---|---|---|---|\n| `r6g.search` \u002F `r7g.search` | r6g.large to r6g.4xlarge | Memory | **Production DEFAULT** |\n| `c6g.search` | c6g.large to c6g.2xlarge | Compute | Aggregations, ML; dedicated masters |\n| `m6g.search` | m6g.large to m6g.4xlarge | Balanced | Mixed workloads |\n| `i3.search` | i3.large to i3.2xlarge | Instance storage (NVMe) | Very high IOPS; log analytics |\n| `t3.search` | t3.small to t3.medium | Burst | **Dev\u002Ftest ONLY** |\n| Legacy (`t2`,`m3`,`m4`,`c4`,`r3`,`r4`,`i2`) | — | — | **DO NOT USE — end-of-life** |\n\n**Size by workload:**\n- Dev\u002Ftest: `t3.small.search` × 1 (no Multi-AZ).\n- Small production (\u003C 50 GB): `r6g.large.search` × 3.\n- Mid production (50-500 GB): `r6g.2xlarge.search` × 3-6 (Multi-AZ).\n- Large production (500 GB-5 TB): `r6g.4xlarge.search` × 6-12 + 3 dedicated masters.\n- Very large (5+ TB): shard across domains OR use UltraWarm\u002Fcold storage.\n\n**NEVER use `t3.small.search` for production** — CPU credits deplete and\nthrottle under sustained traffic.\n\n### Step 3 — Multi-AZ + dedicated master nodes\n\nMulti-AZ (3-zone) is the primary resilience control. **Instance count must\nbe a multiple of 3.**\n\n- Enable `ZoneAwarenessEnabled=true` + `AvailabilityZoneCount=3`.\n- OpenSearch places primary and replica shards in different AZs.\n- A 3-node cluster with `replica=1` tolerates one AZ loss.\n\n**Dedicated masters** (3 — one per AZ):\n- Mandatory for > 10 data nodes, latency-sensitive workloads (p99 \u003C 100 ms),\n  or frequent index creation.\n- Master type: `c6g.large.search` (≤15 data nodes), `c6g.2xlarge.search`\n  (15-30), `c6g.4xlarge.search` (30+).\n- Masters are CPU-bound, not memory-bound. Use `c6g`, not `r6g`.\n\n**NEVER use a 2-AZ topology with odd node count** — uneven shard\ndistribution makes one AZ a SPOF.\n\n### Step 4 — Storage (EBS vs instance-store)\n\n| Volume type | IOPS | Use when |\n|---|---|---|\n| `gp3` (default) | 3,000 baseline, up to 16,000 | **DEFAULT CHOICE** — most production |\n| `io1` | up to 64,000 provisioned | High-IOPS; consistent latency |\n| `standard` (magnetic) | low | **DO NOT USE — legacy** |\n\n- EBS size: 10 GB - 6 TB (gp3). Plan for 15% free (write-block watermark at 85%).\n- Instance-store (NVMe): `i3.search` only. Higher IOPS but ephemeral — data\n  lost on instance failure. Use with `replica >= 1`.\n\n**Common mistake:** sizing EBS for raw data without the replica + overhead\nmultiplier. A 500 GB index with 1 replica needs 500 × 2 × 1.1 = 1.1 TB.\n\n### Step 5 — Encryption (at-rest + in-transit)\n\n**Encryption at rest:**\n- **MUST enable at domain creation.** Cannot be added later.\n- Uses AWS KMS. Default: AWS-managed key. For compliance: customer CMK.\n\n**Encryption in transit (TLS):**\n- Recommended at creation. Can enable post-creation but triggers rolling\n  node replacement disconnecting clients for 10-30 minutes.\n- Use `Policy-Min-TLS-1-2-2019-07` (TLS 1.2 minimum). Never allow TLS 1.0\u002F1.1.\n\n```bash\naws opensearch create-domain ... \\\n  --encryption-at-rest-options Enabled=true,KmsKeyId=arn:aws:kms:...:alias\u002F\u003Ccmk> \\\n  --node-to-node-encryption-options Enabled=true \\\n  --domain-endpoint-options EnforceHTTPS=true,TLSSecurityPolicy=Policy-Min-TLS-1-2-2019-07\n```\n\n### Step 6 — Network access + fine-grained access control (FGAC)\n\n**Network access:**\n\n| Mode | Use when |\n|---|---|\n| VPC-only | **PRODUCTION.** Network isolation; security group controls ingress. |\n| Public | Dev\u002Ftest only. IP allowlist is a network control, not authentication. |\n\n**FGAC modes (mutually exclusive — choose at creation):**\n\n| Mode | Master user | Use when |\n|---|---|---|\n| IAM master user | IAM role ARN | Programmatic access; AWS-native orgs |\n| Cognito user pool | Cognito pool + identity pool | Human users; SSO; web-app dashboards |\n| IP-only (no FGAC) | N\u002FA | **DO NOT USE for production** |\n\n**Common mistake:** public access with IP allowlist for \"production.\" Always\nuse VPC-only access with FGAC for production.\n\n### Step 7 — Indexing (shard count, replica count)\n\n- **Shard count:** apply the 30-50 GB per shard rule. Set at index creation\n  via `\"number_of_shards\": N`. Change post-creation: `_split`\u002F`_shrink`\n  (disruptive).\n- **Replica count:** default 1. Set via `\"number_of_replicas\": N`.\n  Changeable at runtime (no disruption). Multi-AZ places replicas in\n  different AZs.\n\n| Replica | Storage multiplier | Use when |\n|---|---|---|\n| 0 | 1x | Dev\u002Ftest only (data loss on failure) |\n| 1 | 2x | **Production standard** |\n| 2 | 3x | High availability (rare; cost) |\n\n**NEVER over-shard a small dataset.** A 1 GB index with 5 shards wastes\noverhead — use 1 shard.\n\n### Step 8 — Snapshots (automated + manual)\n\n- **Automated:** daily to AWS-managed S3. Retention 1-35 days (configurable).\n  Used for point-in-time recovery to same or new domain.\n- **Manual:** customer-managed S3 bucket. Requires \"snapshot repository\"\n  registered via `PUT _snapshot\u002F\u003Crepo>`. Used for long-term retention,\n  cross-cluster migration, backup before upgrades.\n\nFull snapshot repository registration and restore CLI is in\n`references\u002Fprovisioning-cli-commands.md`.\n\n**NEVER rely on automated snapshots as the ONLY backup.** For long-term\nretention or cross-region DR, configure manual snapshots.\n\n### Step 9 — UltraWarm and cold storage (managed cluster only)\n\nServerless does NOT support these. Managed cluster only.\n\n- **UltraWarm:** read-only warm tier. ~50% cheaper than hot. Indices become\n  READ-ONLY after migration. Hot→warm via ISM; warm→hot requires reindex.\n- **Cold storage:** read-only archive on S3. ~80% cheaper. Recall takes\n  minutes-hours. Requires UltraWarm enabled.\n\n**ISM lifecycle:** hot (active) → warm (7d) → cold (30d) → delete (365d).\n\n**NEVER use UltraWarm as a write target** — READ-ONLY. Writes must\ncomplete on hot tier before ISM migrates.\n\n### Step 10 — OpenSearch Serverless \u002F vector search \u002F streaming ingestion\n\n- **OpenSearch Serverless:** auto-scaling, pay-per-use (OCU billing). No\n  capacity management. Separate API (`opensearchserverless`).\n- **Vector search collections:** `--type VECTORSEARCH`. Optimized for k-NN\n  similarity search (HNSW, IVF). For RAG\u002Fgenerative AI workloads.\n- **Streaming ingestion:** direct from Kinesis, MSK, or S3 without Lambda.\n  Lower latency than Lambda-based ingestion.\n- **Cross-cluster search:** connect multiple domains for federated search.\n\n**Common mistake:** provisioning a managed cluster for vector-search-only\nworkload. Serverless VECTORSEARCH is cheaper and simpler for pure k-NN.\n\n## NEVER do these things\n\n1. **NEVER use public access for a production OpenSearch domain.** Public\n   access exposes the endpoint to internet scanning. VPC-only with FGAC + IAM.\n\n2. **NEVER forget to enable encryption at rest at domain creation.**\n   Adding it later requires a new domain + full reindex + client repoint.\n\n3. **NEVER use `t3.small.search` for production.** CPU credits deplete\n   under sustained traffic. Use `r6g.search` or `r7g.search`.\n\n4. **NEVER provision a 2-AZ topology with odd node count.** Multi-AZ\n   requires 3 AZs and node count multiple of 3. Uneven allocation = SPOF.\n\n5. **NEVER skip dedicated master nodes for clusters > 10 data nodes.**\n   Without dedicated masters, cluster-state updates spike query latency\n   during recovery. Use 3 dedicated masters (one per AZ).\n\nExtended anti-patterns (JVM heap cap, TLS policy, IP-only FGAC, automated\nsnapshot reliance, FGAC mode switch, UltraWarm writes, EOL instances) are\ndocumented in `references\u002Ftopology-and-indexing.md`.\n\n## Error handling\n\n| Error | Cause | Fix |\n|---|---|---|\n| `ResourceAlreadyExistsException` | Domain name taken | Check existing config; update mutable settings or create new domain |\n| Encryption-at-rest enable fails on existing domain | Cannot add post-creation | Create NEW domain with encryption, reindex via `_remote\u002Freindex` |\n| Multi-AZ create with uneven node count | `InstanceCount` not divisible by 3 | Round UP to next multiple of 3 |\n| Dedicated master toggle during update | Blue-green deployment (1-4 hours) | Enable at creation; toggle requires maintenance window |\n| `RepositoryMissingException` | Snapshot repo not registered | Register via `PUT _snapshot\u002F\u003Crepo>` before taking snapshots |\n| FGAC mode switch fails | IAM↔Cognito not supported via update | Create NEW domain with desired FGAC mode, reindex |\n| Cluster stuck in `PROCESSING` | Blue-green on large cluster (1-4 hours) | `aws opensearch describe-domain --query 'DomainStatus.Processing'` — wait for false |\n\n## Output format\n\n```text\nDOMAIN: \u003Cdomain-or-collection-name>\nVERDICT: READY_TO_DEPLOY | PREREQUISITES_MISSING\nCHECKLIST:\n  [✓|✗] Deployment type: managed cluster | serverless\n  [✓|✗] Instance type: \u003Cfamily>.\u003Csize>.search (data nodes)\n  [✓|✗] Instance count: \u003CN> data nodes (multiple of 3 for Multi-AZ)\n  [✓|✗] Multi-AZ (3-zone): Enabled | Disabled\n  [✓|✗] Dedicated master nodes: \u003CN> × \u003Cfamily>.\u003Csize>.search | None\n  [✓|✗] Storage: EBS \u003Ctype> \u003Csize>GB | instance-store NVMe\n  [✓|✗] Encryption at rest: Enabled (customer CMK \u003Ckey-arn> | AWS-managed) | Disabled\n  [✓|✗] Encryption in transit (TLS): Enabled (Policy-Min-TLS-1-2-2019-07) | Disabled\n  [✓|✗] Network access: VPC-only (subnets: \u003Cids>, SG: \u003Csg-id> port 443) | Public (IP allowlist)\n  [✓|✗] Fine-grained access control (FGAC): IAM master user (\u003Crole-arn>) | Cognito (\u003Cpool-id>) | Disabled\n  [✓|✗] Master user: IAM role \u003Carn> | Cognito user \u003Cusername>\n  [✓|✗] Shard count rule: 30-50 GB per shard applied\n  [✓|✗] Replica count: \u003CN> (tolerates \u003CN> node losses)\n  [✓|✗] Automated snapshots: Enabled (retention \u003CN> days)\n  [✓|✗] Manual snapshot repository: registered (S3 bucket \u003Cname>, role \u003Carn>) | None\n  [✓|✗] UltraWarm: Enabled (\u003CN> × \u003Ctype>) | Disabled\n  [✓|✗] Cold storage: Enabled | Disabled\n  [✓|✗] OpenSearch Serverless: Yes (collection type \u003Ctype>) | No\nVERIFICATION_COMMANDS:\n  aws opensearch describe-domain --domain-name \u003Cname>\n  aws opensearch describe-domain-config --domain-name \u003Cname>\n  aws ec2 describe-security-groups --group-ids \u003Csg-id>\n  aws kms describe-key --key-id \u003Ccmk-id>\n  aws iam get-role --role-name \u003Cmaster-role>\n```\n\n### Worked example — production managed cluster with Multi-AZ\n\n```text\nDOMAIN: prod-search\nVERDICT: READY_TO_DEPLOY\nCHECKLIST:\n  [✓] Deployment type: managed cluster\n  [✓] Instance type: r6g.2xlarge.search (data nodes)\n  [✓] Instance count: 6 data nodes (2 per AZ × 3 AZs)\n  [✓] Multi-AZ (3-zone): Enabled (us-east-1a\u002Fb\u002Fc)\n  [✓] Dedicated master nodes: 3 × c6g.large.search (1 per AZ)\n  [✓] Storage: EBS gp3 100GB per node (600 GB cluster capacity)\n  [✓] Encryption at rest: Enabled (customer CMK alias\u002Fprod-opensearch-kms)\n  [✓] Encryption in transit (TLS): Enabled (Policy-Min-TLS-1-2-2019-07)\n  [✓] Network access: VPC-only (subnets: subnet-0aaa\u002F0bbb\u002F0ccc, SG: sg-search123 port 443)\n  [✓] Fine-grained access control (FGAC): IAM master user (arn:aws:iam::123456789012:role\u002Fopensearch-master)\n  [✓] Master user: IAM role arn:aws:iam::123456789012:role\u002Fopensearch-master\n  [✓] Shard count rule: 30 GB per shard applied (17 shards for 500 GB indices)\n  [✓] Replica count: 1 (tolerates 1 node loss per shard)\n  [✓] Automated snapshots: Enabled (retention 14 days)\n  [✓] Manual snapshot repository: registered (S3 bucket opensearch-snapshots-prod, role arn:aws:iam::123456789012:role\u002Fopensearch-snapshot)\n  [✓] UltraWarm: Disabled (workload is search, not time-series)\n  [✓] Cold storage: Disabled\n  [✓] OpenSearch Serverless: No\nVERIFICATION_COMMANDS:\n  aws opensearch describe-domain --domain-name prod-search\n  aws opensearch describe-domain-config --domain-name prod-search\n  aws ec2 describe-security-groups --group-ids sg-search123\n  aws kms describe-key --key-id alias\u002Fprod-opensearch-kms\n  aws iam get-role --role-name opensearch-master\n```\n\n## STRICT output contract\n\nThis section codifies the exact output shape the eval harness asserts\nagainst. Every invocation MUST produce output matching this contract or\nthe response is rejected.\n\n### Required output structure\n\nEvery response MUST be a single block with these literal labels, in order,\nas the first lines of the response (no preamble, no prose, no disclaimers):\n\n```text\nDOMAIN: \u003Cdomain-or-collection-name>\nVERDICT: READY_TO_DEPLOY | PREREQUISITES_MISSING\nCHECKLIST:\n  [✓|✗] Deployment type: managed cluster | serverless\n  [✓|✗] Instance type: \u003Cfamily>.\u003Csize>.search (data nodes)\n  [✓|✗] Instance count: \u003CN> data nodes (multiple of 3 for Multi-AZ)\n  [✓|✗] Multi-AZ (3-zone): Enabled | Disabled\n  [✓|✗] Dedicated master nodes: \u003CN> × \u003Cfamily>.\u003Csize>.search | None\n  [✓|✗] Storage: EBS \u003Ctype> \u003Csize>GB | instance-store NVMe\n  [✓|✗] Encryption at rest: Enabled (customer CMK \u003Ckey-arn> | AWS-managed) | Disabled\n  [✓|✗] Encryption in transit (TLS): Enabled (Policy-Min-TLS-1-2-2019-07) | Disabled\n  [✓|✗] Network access: VPC-only (subnets: \u003Cids>, SG: \u003Csg-id> port 443) | Public (IP allowlist)\n  [✓|✗] Fine-grained access control (FGAC): IAM master user (\u003Crole-arn>) | Cognito (\u003Cpool-id>) | Disabled\n  [✓|✗] Master user: IAM role \u003Carn> | Cognito user \u003Cusername>\n  [✓|✗] Shard count rule: 30-50 GB per shard applied\n  [✓|✗] Replica count: \u003CN> (tolerates \u003CN> node losses)\n  [✓|✗] Automated snapshots: Enabled (retention \u003CN> days)\n  [✓|✗] Manual snapshot repository: registered (S3 bucket \u003Cname>, role \u003Carn>) | None\n  [✓|✗] UltraWarm: Enabled (\u003CN> × \u003Ctype>) | Disabled\n  [✓|✗] Cold storage: Enabled | Disabled\n  [✓|✗] OpenSearch Serverless: Yes (collection type \u003Ctype>) | No\nVERIFICATION_COMMANDS:\n  aws opensearch describe-domain --domain-name \u003Cname>\n  aws opensearch describe-domain-config --domain-name \u003Cname>\n  aws ec2 describe-security-groups --group-ids \u003Csg-id>\n  aws kms describe-key --key-id \u003Ccmk-id>\n  aws iam get-role --role-name \u003Cmaster-role>\n```\n\n### FORBIDDEN output patterns\n\n1. **NEVER output READY_TO_DEPLOY without listing every checklist item\n   with [✓] or [✗].** Every row must appear with an explicit status marker.\n   The eval harness asserts a minimum row count.\n\n2. **NEVER omit the instance type recommendation.** Must specify the exact\n   `.search`-suffixed type (e.g., r6g.large.search). \"TBD\" or \"memory-optimized\"\n   is rejected.\n\n3. **NEVER recommend public access for production.** VPC-only is the\n   production default. Only dev\u002Ftest may use public, with explicit note.\n\n4. **NEVER emit a checklist without the encryption-at-rest status.**\n   Encryption at rest is immutable after creation — omitting it leaves the\n   operator blind to a one-way door decision.\n\n5. **NEVER substitute lowercase or markdown-styled labels for the literal\n   all-caps `DOMAIN:`, `VERDICT:`, `CHECKLIST:`, `VERIFICATION_COMMANDS:`.**\n\n6. **NEVER preface the checklist with prose, headings, or disclaimers.**\n   The `DOMAIN:` line must be the first line of the response.\n\n## Recent AWS features (2022-2026)\n\n- **OpenSearch Serverless (2022-2023):** Auto-scaling, pay-per-use. Separate\n  API. Does NOT support UltraWarm, cold storage, dedicated masters.\n- **Vector search collections (2023-2024):** Serverless `VECTORSEARCH`. k-NN\n  similarity search (HNSW, IVF). For RAG\u002Fgenerative AI workloads.\n- **Streaming ingestion (2023-2024):** Direct from Kinesis, MSK, or S3\n  without Lambda. Lower latency than Lambda-based ingestion.\n- **Cross-cluster search (2023-2024):** Connect multiple domains for\n  federated search via `connections` API.\n- **gp3 EBS default (2022-2023):** gp3 replaces gp2. Higher baseline IOPS\n  (3,000 vs gp2's 250). Cheaper and faster.\n- **Graviton (g-series) instance types (2022-2024):** `r6g`, `c6g`, `m6g`\n  offer ~20% better price\u002Fperformance over Intel. Default for new clusters.\n- **OpenSearch 2.x (2022-2024):** Anomaly detection, k-NN boosts, session-\n  based search, streaming ingestion. Use OpenSearch 2.11+.\n\n## References\n\n- `references\u002Ftopology-and-indexing.md` — managed vs Serverless feature\n  matrix, Multi-AZ topology math, dedicated master sizing, EBS vs instance-\n  store selection, shard\u002Freplica heuristics, UltraWarm\u002Fcold storage lifecycle,\n  vector search collection sizing, configuration dependency graph.\n- `references\u002Fprovisioning-cli-commands.md` — full copy-pasteable CLI\n  sequence for all provisioning steps, including managed cluster creation,\n  Serverless collection setup, vector search, snapshot registration, ISM\n  policies, CloudWatch alarms, and Terraform equivalents.\n\n## Domain\n\nAWS CloudOps \u002F OpenSearch Service Provisioning & Search Topology Design.\n\n## AWS documentation\n\n- **Amazon OpenSearch Service Developer Guide** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fwhat-is.html\n- **Managed domains** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fcreateupdatedomains.html\n- **OpenSearch Serverless** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fserverless.html\n- **Multi-AZ domains** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fmanagedomains-multiaz.html\n- **Dedicated master nodes** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fmanagedomains-dedicatedmasternodes.html\n- **Encryption at rest** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fencryption-at-rest.html\n- **Fine-grained access control** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Ffgac.html\n- **UltraWarm storage** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fultrawarm.html\n- **Cold storage** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fcold-storage.html\n- **Sizing domains** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fsizing-domains.html\n- **Vector search** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fopensearch-service\u002Flatest\u002Fdeveloperguide\u002Fknn.html\n",{"name":5,"license":15,"metadata":24,"description":7,"compatibility":41},{"tags":25,"phase":26,"author":27,"domain":28,"family":29,"version":30,"keywords":31,"task_type":32,"complexity":33,"entry_point":34,"skill_class":35,"when_to_use":36,"dependencies":37,"requires_llm":38,"verdict_shape":39,"lifecycle_status":40,"supports_pipeline":38},"aws, opensearch, elasticsearch, cloudops, deploy, analytics, search, provisioning, managed-cluster, serverless, multi-az, encryption, fgac, ultrawarm, vector-search","1","Jacky Chan — AWS Community Builder","aws-cloudops","Analytics","0.1.0","aws, opensearch, elasticsearch, cloudops, deploy, provisioning, search, analytics, domain, managed cluster, serverless, data nodes, dedicated master, ultrawarm, cold storage, multi-az, 3-zone, ebs, gp3, io1, encryption at rest, encryption in transit, tls, kms, vpc, public access, fine-grained access control, fgac, iam master user, cognito, snapshot, repository, shard count, replica count, vector search, streaming ingestion","deploy","high","false","capability","Invoke when the user wants to create a new OpenSearch Service domain (managed cluster or Serverless), design a Multi-AZ production topology with dedicated master nodes, size data nodes and shard count, enable fine-grained access control (FGAC), configure UltraWarm or cold storage for cost optimization, set up vector search collections, configure snapshot repositories, or generate provisioning CLI commands \u002F IaC templates. Do NOT invoke for auditing existing domain posture (use opensearch-domain-auditor), or for non-OpenSearch search\u002Fanalytics (Athena, CloudSearch, self-managed Elasticsearch on EC2).","aws-orchestrator","true","READY_TO_DEPLOY | PREREQUISITES_MISSING","active","Agent runtime that reads SKILL.md (Claude Code, Cursor, Windsurf, Codex, Gemini). For live deployment: AWS CLI v2 with opensearch, opensearchserverless, ec2, kms, iam, and cognito-idp access. Works with Terraform aws_opensearch_domain \u002F aws_opensearchserverless_collection resources and CloudFormation AWS::OpenSearchService::Domain templates.","main","eeace51bd5dd1db2030729d83eeab988861553aa","skills\u002Fopensearch-domain-deployer",0,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills","https:\u002F\u002Fgithub.com\u002Fjhkchan","CTO & Co-Founder @Beever-AI  & @votee. CAISP. AWS Community Builder. Organizer@GDGCloudHK. MongoDB Champion. Technopreneur + Infornographer.","2026-09-24 08:54:10",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add jhkchan\u002Faws-agent-skills --skill opensearch-domain-deployer",{"tool":56,"command":57},"bunx","bunx skills add jhkchan\u002Faws-agent-skills --skill opensearch-domain-deployer",{"tool":59,"command":60},"pnpm","pnpm dlx skills add jhkchan\u002Faws-agent-skills --skill opensearch-domain-deployer","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002FSKILL.md",true,[64,70,74,78,82,86,90,94,98,102,106,110,114,118,122,126,130],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"eval\u002Ftest-cases.yaml","REFERENCE","参考文档",6597,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Feval\u002Ftest-cases.yaml",{"path":71,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":72,"sourceHtmlUrl":73},"evals\u002Fbaselines\u002Fdedicated-master-large-cluster.md",946,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Fevals\u002Fbaselines\u002Fdedicated-master-large-cluster.md",{"path":75,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":76,"sourceHtmlUrl":77},"evals\u002Fbaselines\u002Fdev-t3-single-node.md",639,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Fevals\u002Fbaselines\u002Fdev-t3-single-node.md",{"path":79,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":80,"sourceHtmlUrl":81},"evals\u002Fbaselines\u002Fmissing-vpc-and-kms.md",813,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Fevals\u002Fbaselines\u002Fmissing-vpc-and-kms.md",{"path":83,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":84,"sourceHtmlUrl":85},"evals\u002Fbaselines\u002Fproduction-managed-cluster-multiaz.md",1135,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Fevals\u002Fbaselines\u002Fproduction-managed-cluster-multiaz.md",{"path":87,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":88,"sourceHtmlUrl":89},"evals\u002Fbaselines\u002Fserverless-vector-search.md",969,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Fevals\u002Fbaselines\u002Fserverless-vector-search.md",{"path":91,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":92,"sourceHtmlUrl":93},"evals\u002Feval_config.yaml",1800,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Fevals\u002Feval_config.yaml",{"path":95,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":96,"sourceHtmlUrl":97},"evals\u002Fevals.json",15364,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Fevals\u002Fevals.json",{"path":99,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":100,"sourceHtmlUrl":101},"evals\u002Fprompts\u002Fdedicated-master-large-cluster.md",984,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Fevals\u002Fprompts\u002Fdedicated-master-large-cluster.md",{"path":103,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":104,"sourceHtmlUrl":105},"evals\u002Fprompts\u002Fdev-t3-single-node.md",613,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Fevals\u002Fprompts\u002Fdev-t3-single-node.md",{"path":107,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":108,"sourceHtmlUrl":109},"evals\u002Fprompts\u002Fmissing-vpc-and-kms.md",454,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Fevals\u002Fprompts\u002Fmissing-vpc-and-kms.md",{"path":111,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":112,"sourceHtmlUrl":113},"evals\u002Fprompts\u002Fproduction-managed-cluster-multiaz.md",939,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Fevals\u002Fprompts\u002Fproduction-managed-cluster-multiaz.md",{"path":115,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":116,"sourceHtmlUrl":117},"evals\u002Fprompts\u002Fserverless-vector-search.md",580,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Fevals\u002Fprompts\u002Fserverless-vector-search.md",{"path":119,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":120,"sourceHtmlUrl":121},"examples\u002FREADME.md",9292,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Fexamples\u002FREADME.md",{"path":123,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002Fprovisioning-cli-commands.md",19624,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Freferences\u002Fprovisioning-cli-commands.md",{"path":127,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002Ftopology-and-indexing.md",13435,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Freferences\u002Ftopology-and-indexing.md",{"path":131,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":132,"sourceHtmlUrl":133},"skill.usf.yaml",4396,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fopensearch-domain-deployer\u002Fskill.usf.yaml",[135,142,149,156,163,170],{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":19},"01M7ADVD60X4PCAPKSE58P9NDC","xray-tracing-deployer","Deploys AWS X-Ray distributed tracing with production-grade configuration: X-Ray daemon deployment (EC2 systemd, ECS sidecar, EKS DaemonSet, Lambda built-in), SDK instrumentation (Java, Python, Node.js, Go, .NET) with annotations and metadata, sampling rules (default reservoir + rate vs custom rules with URL \u002F method \u002F service-name predicates), service map generation, trace query and retrieval, groups and insights, CloudWatch ServiceLens integration, IAM permissions (PutTraceSegments, GetSamplingRules), and latest features (Lambda Powertools tracing, OpenTelemetry \u002F ADOT Collector support, W3C trace context). Emits a READY_TO_DEPLOY checklist with every configuration item verified. Use when enabling X-Ray on a new application, adding tracing to ECS \u002F EKS \u002F Lambda, validating a sampling configuration, or generating daemon deployment CLI and IaC templates. Triggers: X-Ray, distributed tracing, X-Ray daemon, sampling rules, service map, X-Ray SDK, OpenTelemetry, ADOT, Lambda Powertools, CloudWatch ServiceLens.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxray-tracing-deployer\u002FSKILL.md",[],[],{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":148,"publishedAt":19},"01M7ADTVJ7DCBM9CB1FY51GH7J","wellarchitected-workload-auditor","Audits AWS Well-Architected Tool workloads for review staleness, per-pillar high-risk issue counts, milestone tracking gaps, and remediation plan completeness. Emits a deterministic verdict (STALE_REVIEW | HIGH_RISK | CONFIG_GAP | OK) per workload with per-pillar risk breakdown, milestone trend analysis, and specific remediation. Use when reviewing Well-Architected workloads, checking WA review freshness, auditing high-risk issues per pillar, validating milestone coverage, or tracking remediation plans.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwellarchitected-workload-auditor\u002FSKILL.md",[],[],{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":19},"01M7ADT59G6FTTNZYHT2QRPNNP","wellarchitected-review-operator","Operates AWS Well-Architected Tool reviews end-to-end — creates workloads, runs pillar reviews (operational excellence, security, reliability, performance, cost optimization, sustainability, Prosperity), answers questions with risk-tier rationale, generates reports and improvement plans, creates milestones, and integrates with Trusted Advisor and Well-Architected Labs. Runs deterministic pre-checks (workload existence, lens availability, pillar coverage), emits the exact update-answer \u002F get-consolidated-report CLI behind a CONFIRM gate, and verifies risk-tier transitions. Emits READY | BLOCKED | COMPLETED. Use when creating a workload, answering pillar questions, generating an improvement plan, creating a milestone, or integrating with Trusted Advisor. Triggers: well-architected tool, well architected review, workload review, pillar, operational excellence, security, reliability, performance, cost optimization, sustainability, prosperity, improvement plan, milestone, trusted advisor.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwellarchitected-review-operator\u002FSKILL.md",[],[],{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":19},"01M7ADSH5JA9QHNPPHQCD7EVA7","wafv2-web-acl-deployer","Provisions AWS WAFv2 Web ACLs with correct production defaults: scope selection (CLOUDFRONT vs REGIONAL), managed rule groups (AWSManagedRulesCommonRuleSet, SQLiRuleSet, LinuxRuleSet, WindowsRuleSet, IPReputationList, BotControlRuleSet, AmazonIpReputationList, ATP), custom rules (byte match, IP set, regex pattern, geo match, size constraint, rate-based), rule priority ordering, logging destinations (Kinesis Firehose, CloudWatch Logs, S3), resource association (ALB, API Gateway, CloudFront), rate-based rules with aggregate keys (IP, forwarded IP), Challenge and CAPTCHA actions, and account takeover prevention. Emits a READY_TO_DEPLOY checklist. Use when creating a Web ACL, attaching managed rules, configuring rate limiting, enabling WAF logging, associating a Web ACL with an ALB\u002FAPI Gateway\u002FCloudFront, or configuring CAPTCHA\u002FChallenge actions. Triggers: create WAF Web ACL, WAFv2, managed rule groups, WAF rate limiting, WAF logging, WAF CAPTCHA, WAF Challenge action, bot control, ATP managed rules.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwafv2-web-acl-deployer\u002FSKILL.md",[],[],{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":19},"01M7ADRYFAT8R73FBNCHRC573X","wafv2-web-acl-auditor","Audits AWS WAFv2 Web ACL configurations to determine whether the ACL provides effective protection: default-action posture (Allow vs Block), managed-rule-group coverage gaps, rule effectiveness (BLOCK vs COUNT, shadow\u002Fbypass rules, stale exclusions), rate-based rule correctness, logging and visibility configuration, and text-transformation bypass vectors. Emits a deterministic verdict per Web ACL. Use when reviewing a WAFv2 Web ACL for security posture, checking managed-rule coverage, validating rate-limit configuration, auditing WAF logging, or hardening a WAF before production deployment. Triggers: WAF, WAFv2, Web ACL, managed rule group, AWSManagedRules, rate-based rule, CAPTCHA, Challenge, OverrideAction, Count mode, forwarded IP, Bot Control, ATP, text transformation, WAF logging, WAF visibility, OWASP, SQLi, XSS, RFI.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwafv2-web-acl-auditor\u002FSKILL.md",[],[],{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":176,"publishedAt":19},"01M7ADR8W7G72JX4KFGN03QK8Q","waf-rule-deployer","Provisions AWS WAFv2 rule sets with production defaults: Web ACL creation (CloudFront scope in us-east-1 vs Regional scope), rule groups (managed vs custom) with capacity planning in WCU (Web ACL Capacity Units, 1500 default per ACL), managed rule groups (AWSManagedRulesCommonRuleSet, AWSManagedRulesSQLiRuleSet, AWSManagedRulesAmazonIpReputationList, AWSManagedRulesLinuxRuleSet, AWSManagedRulesWindowsRuleSet, AWSManagedRulesUnixRuleSet), custom rules (byte-match, regex pattern set, geo-match, rate-based), IP set and regex pattern set resources, rule priority ordering (lowest number evaluated first), action types (allow, block, count, CAPTCHA, Challenge), bot control managed rule group, account takeover. Triggers: create WAF rule, WAF managed rule group, WAF custom rule, WAF byte match, WAF geo match, WAF rate based rule, WAF IP set, WAF regex pattern set, WAF WCU budget, WAF CloudFront ACL, WAF logging Kinesis Firehose, WAF bot control, WAF ATP, WAF label matching, WAF Challenge action, WAF CAPTCHA.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwaf-rule-deployer\u002FSKILL.md",[],[]]