Tf Best Practices
AWSOfficialPublished by AWS
- Skill
- Tool integration
- Cloud and DevOps
- Apache-2.0
- Low risk
- Has scripts
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
tf-best-practices provides a structured approach to authoring and validating AWS Terraform code. It functions as a two-part system: an authoring guide that defines security posture rules before code generation, and a read-only policy gate that evaluates generated Terraform against those rules after it is written. The skill is designed to be integrated into migration workflows, providing deterministic verdicts and actionable fix hints without modifying the underlying files.
What it does
- Provides security posture rules for authoring AWS Terraform.
- Executes a read-only policy check on generated Terraform directories.
- Generates machine-readable JSON reports detailing policy violations.
- Offers specific fix hints for identified infrastructure issues.
- Validates migration artifacts including database and deployment configurations.
- Supports a multi-stage validation protocol including fmt, init, and validate.
When to use it
- Before writing Terraform code to ensure adherence to security posture rules.
- After generating Terraform to verify compliance with defined policy gates.
- When integrating automated validation into a migration workflow.
- To identify and remediate infrastructure configuration issues during development.
Advantages
- Enforces consistent security standards across generated infrastructure.
- Provides actionable feedback with file and line-specific remediation hints.
- Operates as a read-only tool that does not modify user files.
- Functions without requiring provider downloads or active registry connections.
- Integrates into existing migration pipelines as a deterministic gate.
Usage examples
- “Check the generated terraform/ directory for policy violations.”
- The skill runs the policy checker against the specified directory and returns a JSON report containing any identified violations and corresponding fix hints.
- “What are the security requirements for an internet-facing ALB?”
- The skill provides the posture rules requiring an HTTPS listener on port 443 and an HTTP redirect to HTTPS on port 80.
Install
Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/aws/tf-best-practices/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip tf-best-practices.zip -d .agents/skills
Documentation by AWS
tf-best-practices — Generated-IaC posture rules + read-only policy gate
A shared authoring guide and verdict producer, not a workflow. It answers two questions for a phase that generates AWS Terraform:
Before writing — "what security posture must the generated
terraform/follow?" (the posture rules + thebaseline.tfaccount-hardening spec)After writing — "does the generated
terraform/pass policy?" (a deterministic, read-only verdict + a machine-readable report)
Routing — load the part that matches your context
This skill is entered at two touchpoints in the caller's Generate flow, with the caller's own terraform-authoring work in between. The caller states which touchpoint it is at when it loads this skill, and reads the corresponding part:
| Caller context | Load | Why |
|---|---|---|
About to author terraform/ (before writing) | Part 1 → references/security-posture-rules.md | The "what to emit" AWS authoring rules (gate-enforced + authoring-only + compliance-conditional). |
terraform/ written, ready to validate (after writing) | Part 2 → references/terraform-validation.md + run the gate script | The fmt → init → validate → policy protocol and the read-only verdict. |
Everything this skill states is source-cloud-agnostic (pure AWS Terraform). Any GCP/Heroku
detection or artifact reading is the caller's job; where a rule needs a caller-known fact (e.g.
declared compliance frameworks), the caller passes it as a caller-context signal — see
references/security-posture-rules.md § Caller-context signals.
Boundary (read this first)
This unit is a verdict producer, never a mutator. Its entire write surface is the JSON verdict it is asked to emit. Specifically it MUST NOT:
edit, format, or rewrite any
.tffile (the caller owns remediation),read or write
.phase-status.jsonor any run-state file (interpreter-owned),decide whether a phase may complete, or prompt the user (caller policy).
The caller (a migration skill's Generate phase) owns: the fix-and-retry loop that edits
the .tf it generated, terraform fmt auto-apply, the retry/skip/abort prompt, the
Phase Completion gate, and every .phase-status.json write. See the consuming skill's
generate phase for how the verdict feeds those decisions.
Consumers:
gcp-to-aws(prose Generate) andheroku-to-aws(DSL Generate). The contract is source-agnostic; each caller wires the two touchpoints in its own Generate idiom — gcp-to-aws as prose steps, heroku-to-aws as a fragment step plus a fail-closed_postconditionsassert enforced by the interpreter.
Part 1 — Authoring posture (load before writing terraform/)
Emit generated Terraform that satisfies the posture in
references/security-posture-rules.md.
These are the "what good AWS Terraform looks like" rules. Following them makes the Part 2 gate pass by construction. This unit does not read the caller's artifacts — it consumes only caller-context signals the caller passes in.
Scope.
security-posture-rules.mdcovers, in three tiers:
Gate-enforced (Part 2 verifies statically): ALB TLS, no-public-database, RDS + ElastiCache encryption-at-rest, no-public-DB-port ingress, no-public admin/datastore-port ingress, no-wildcard-IAM.
Authoring-only (not gate-checkable, still required):
deletion_protection, master-password-via-Secrets-Manager, S3 hardening, Fargate/EKS/ECR settings, private-subnet placement, backups, baseline monitoring.Compliance-conditional (emitted when the caller declares
soc2/pci/hipaa/fedramp): VPC flow logs, S3 access logging, secret rotation, customer-managed KMS.Still the caller's own generation concern (candidates to migrate here later): the account-hardening
baseline.tflayer (CloudTrail, GuardDuty, Config, Security Hub).
Part 2 — Policy gate (run after writing terraform/)
Run the read-only checker against the generated directory. Resolve the script path relative to
the plugin root ($PLUGIN_ROOT/skills/tf-best-practices/scripts/...), the same convention the
plugin uses for its other scripts:
python3 "$PLUGIN_ROOT/skills/tf-best-practices/scripts/validate-terraform-policy.py" "$TERRAFORM_DIR" --json "$VERDICT_PATH"$TERRAFORM_DIR— required, caller-supplied: the generatedterraform/directory (e.g.$MIGRATION_DIR/terraform). This skill never defaults or discovers it — the caller always passes the path it wrote Terraform to.--json $VERDICT_PATH— optional; writes a machine-readable verdict the caller can merge into its ownvalidation-report.json.
The policy check is one stage of a larger validation flow (fmt → init → validate → policy).
The full protocol — including offline-fallback behavior and how the policy verdict maps into a
validation-report.json — is documented in
references/terraform-validation.md. That protocol is
descriptive: the caller owns the fmt/init/validate execution, the fix-and-retry loop, and
the report write; this unit contributes only the read-only policy stage + verdict shape.
Before infrastructure completion, the caller must run
scripts/validate-terraform-report.py on the saved validation-report.json and
require exit 0. The checker enforces the shared v2 completion contract. Its
RUNTIME_REPORT_OK result does not establish that Terraform ran or passed.
Exit codes → caller action
| Exit | stdout | Meaning | Caller does |
|---|---|---|---|
0 | POLICY_OK | posture satisfied | proceed |
1 | POLICY_FAIL | violations present | read violations[], edit the named .tf sites, re-run (caller's retry budget) |
2 | (usage error) | bad path / IO | surface to user; do not treat as pass |
Verdict shape (--json)
{
"check": "policy",
"policy_status": "POLICY_OK | POLICY_FAIL",
"violations": [
{
"check": "policy",
"rule": "alb_https_listener | alb_http_redirect | no_tf_files",
"file": "compute.tf",
"line": 7,
"severity": "error",
"summary": "human-readable violation",
"fix_hint": "concrete remediation the caller can apply"
}
]
}Each violations[] entry is actionable evidence — file + line + fix_hint tell the
caller exactly what to edit. The caller applies the edit; this unit only reports.
Policy rules enforced today
Companion checks for migration artifacts
Migration callers can also run the shared read-only
scripts/validate-migration-artifacts.py against their complete migration
directory:
python3 "$PLUGIN_ROOT/skills/tf-best-practices/scripts/validate-migration-artifacts.py" \
"$MIGRATION_DIR" --json "$MIGRATION_DIR/artifact-validation-status.json"This produces ARTIFACTS_OK, ARTIFACTS_FAIL, or ARTIFACTS_ERROR, separately
from the Terraform policy verdict. The caller must inspect the real exit code
and report; it must not synthesize success. Supported checks cover PostgreSQL
verification control flow, EB/database security-group wiring, GitHub Actions
step references and deployment operations, and literal RDS time windows.
Unsupported structures require review. This is not a general Bash safety proof,
provider validation, or proof that a deployment succeeds.
Heroku callers add --require-postgres-script when PostgreSQL is in the design,
and --require-eb-workflow when GitHub Actions is the selected EB deployment
method. Other callers must not impose those Heroku-specific requirements.
The checker never executes a generated migration script or changes input files
or phase state; only the explicit JSON report path may be written.
For RDS/Aurora generation, scripts/rds_windows.py resolves independent daily
backup and weekly maintenance windows from caller preferences. It rejects
invalid or explicitly conflicting choices rather than silently changing them.
Callers use its actual JSON values when authoring Terraform.
Terraform policy rules
Every rule is fail-open on ambiguity — it fires only on unambiguous, in-block literal
evidence, so a valid stack is never falsely blocked (a POLICY_FAIL is a hard completion gate
for the caller, so a false positive would block a real migration).
Internet-facing ALB TLS posture (an ALB is internet-facing when internal is absent,
false, or variable-driven — fail-safe):
alb_https_listener— must have an HTTPS listener on443withcertificate_arnand aforwardaction.alb_http_redirect— an HTTP:80listener mustredirectto HTTPS, neverforwardto targets. Internal ALBs (internal = true) are exempt.
Elastic Beanstalk ALBs are invisible to these rules. The ALB rules inspect standalone
aws_lb_listenerblocks. An EB LoadBalanced environment provisions its ALB fromaws_elastic_beanstalk_environmentsettingblocks, which the static checker does not read — so a pure-EB design passes the ALB rules vacuously (no listener to inspect). EB listener/TLS posture is therefore authoring-only, not gate-enforced. (Fixturesgood-heroku-eb-onlyandgood-heroku-eb-singleinstancedocument this;good-heroku-eb-loadbalancedcarries a standalone ALB so the listener rules are exercised on real blocks.)
Managed database exposure & encryption (aws_db_instance, aws_rds_cluster):
rds_not_public— must not setpublicly_accessible = true(absent/variable → fail-open).rds_encryption_at_rest— must setstorage_encrypted = true; missing or literalfalsefires (RDS defaults to unencrypted), variable-driven fails open. S3 is not checked (default SSE-S3 since Jan 2023).
ElastiCache encryption (aws_elasticache_replication_group, Redis aws_elasticache_cluster):
elasticache_encryption_at_rest— a replication group must setat_rest_encryption_enabled = true; missing or literalfalsefires, variable-driven fails open.elasticache_cluster_encryption— a Redis-engineaws_elasticache_cluster(single-node:engine = "redis", noreplication_group_id) must set BOTHat_rest_encryption_enabled = trueandtransit_encryption_enabled = true; missing or literalfalseon either fires, variable-driven fails open.engine = "memcached"clusters (and variable-driven/absent engine) are exempt — Memcached does not support these attributes.
Security group ingress:
db_sg_no_public_ingress— an inlineaws_security_groupingress covering5432/3306must not allow0.0.0.0/0or::/0.sg_no_public_admin_ingress— an inline ingress must not open a curated never-public admin/datastore port (22,3389,6379,11211,27017,9200/9300,5601) to0.0.0.0/0or::/0. Web (80/443) and app/game ports are not flagged; DB ports are handled by the rule above. Both checkcidr_blocksandipv6_cidr_blocksindependently, so a benign IPv4 list does not mask an open IPv6 one. Both: separateaws_security_group_rule/aws_vpc_security_group_ingress_ruleresources fail open (not correlated).
IAM least-privilege (aws_iam_policy, aws_iam_role_policy, aws_iam_group_policy,
aws_iam_user_policy):
no_wildcard_iam— anAllowstatement must not useAction/Resource"*". The one narrow exception is an isolatedelasticbeanstalk:CreateStorageLocationstatement withResource = "*"because AWS does not support resource-level permissions for that action.aws_iam_policy_documentdata sources and assume-role trust policies fail open.
The checker is a zero-dependency static HCL reader (no
terraform init, no provider download) — it runs even when the registry is unreachable. It uses brace-depth matching for nested blocks, so a valid HTTPS listener written with a nestedforward { ... }block is not a false failure.
Fixtures (also the checker's regression suite)
fixtures/terraform-policy/ holds intentionally-shaped Terraform used by
scripts/test_validate_terraform_policy.py:
bad-http-forward/— internet-facing ALB that forwards plaintext HTTP → MUSTPOLICY_FAIL.internal-alb-only/— internal ALB on HTTP → MUSTPOLICY_OK(HTTP allowed internally).good-https-redirect/— the correct pattern →POLICY_OK.
These are deliberately non-compliant test data (never deployed). They are excluded from the
repo-wide checkov scan via .checkov.yaml skip-path; do not "harden" them — doing so
breaks the tests that assert the failure paths.
Verification
# from skills/tf-best-practices/
uv run --python 3.12 --with pytest python -m pytest scripts/test_validate_terraform_policy.py -qFiles
- .gitignore51 B
- ATTRIBUTION.mdAdded by AutoGineer915 B
- LICENSELicence file added by AutoGineer9.9 KiB
- NOTICELicence file added by AutoGineer67 B
- SKILL.md14.1 KiB
- fixtures/terraform-policy/bad-db-sg-public-quoted-port/vpc.tf514 B
- fixtures/terraform-policy/bad-db-sg-public/vpc.tf356 B
- fixtures/terraform-policy/bad-elasticache-cluster-redis-unencrypted/cache.tf389 B
- fixtures/terraform-policy/bad-elasticache-unencrypted/cache.tf422 B
- fixtures/terraform-policy/bad-heroku-eb-elasticache/cache.tf834 B
- fixtures/terraform-policy/bad-http-forward/compute.tf556 B
- fixtures/terraform-policy/bad-rds-public-brace-in-comment/main.tf690 B
- fixtures/terraform-policy/bad-rds-public-closing-brace/main.tf692 B
- fixtures/terraform-policy/bad-rds-public-interpolated-brace/rds.tf903 B
- fixtures/terraform-policy/bad-rds-public-unencrypted/database.tf372 B
- fixtures/terraform-policy/bad-sg-public-ipv6/vpc.tf1.1 KiB
- fixtures/terraform-policy/bad-sg-public-ssh/vpc.tf537 B
- fixtures/terraform-policy/bad-wildcard-iam-listform/security.tf470 B
- fixtures/terraform-policy/bad-wildcard-iam/security.tf381 B
- fixtures/terraform-policy/good-db-sg-scoped/vpc.tf986 B
- fixtures/terraform-policy/good-elasticache-cluster-memcached/cache.tf372 B
- fixtures/terraform-policy/good-elasticache-cluster-redis-encrypted/cache.tf601 B
- fixtures/terraform-policy/good-elasticache-encrypted/cache.tf749 B
- fixtures/terraform-policy/good-heroku-eb-codepipeline/pipeline.tf295 B
- fixtures/terraform-policy/good-heroku-eb-loadbalanced/compute.tf2.6 KiB
- fixtures/terraform-policy/good-heroku-eb-loadbalanced/database.tf839 B
- fixtures/terraform-policy/good-heroku-eb-loadbalanced/security.tf899 B
- fixtures/terraform-policy/good-heroku-eb-only/compute.tf1.5 KiB
- fixtures/terraform-policy/good-heroku-eb-singleinstance/compute.tf1.8 KiB
- fixtures/terraform-policy/good-https-redirect/compute.tf1008 B
- fixtures/terraform-policy/good-iam-scoped-list/security.tf573 B
- fixtures/terraform-policy/good-internet-nlb/compute.tf621 B
- fixtures/terraform-policy/good-quoted-port-https/compute.tf1.3 KiB
- fixtures/terraform-policy/good-rds-private-encrypted/database.tf607 B
- fixtures/terraform-policy/good-scoped-iam/security.tf744 B
- fixtures/terraform-policy/good-sg-ipv6-scoped/vpc.tf1.0 KiB
- fixtures/terraform-policy/good-sg-public-webapp/vpc.tf989 B
- fixtures/terraform-policy/internal-alb-only/compute.tf555 B
- references/security-posture-rules.md17.3 KiB
- references/terraform-validation.md9.8 KiB
- scripts/rds_windows.pyScript10.1 KiB
- scripts/test_validate_terraform_policy.pyScript33.6 KiB
- scripts/validate-migration-artifacts.pyScript89.3 KiB
- scripts/validate-terraform-policy.pyScript43.6 KiB
- scripts/validate-terraform-report.pyScript4.1 KiB
scripts/rds_windows.py
#!/usr/bin/env python3
"""Resolve RDS backup and maintenance windows without overlapping UTC ranges.
AWS requires a daily ``hh:mm-hh:mm`` backup window and a weekly
``ddd:hh:mm-ddd:hh:mm`` maintenance window, each at least 30 minutes long.
Ranges are half-open: one window can start exactly when the other ends.
Explicit windows are never moved; day names are normalized to lowercase.
Absent preferences use Sunday 04:00-04:30 UTC for maintenance and prefer
03:00-03:30 UTC for backup. These are deterministic defaults, not a claim
about the customer's off-peak hours. If necessary, an unspecified window
is moved to the first available 30-minute range. If no such range exists,
resolution fails instead of shortening or overlapping a window.
The CLI can read the skill's preferences.json. Its existing broad day
choices select the first permitted day (Tuesday for Tuesday-Thursday and
Saturday for Saturday-Sunday) and a 30-minute window at hour_utc.
"""
from __future__ import annotations
import argparse
import json
from pathlib import Path
import re
from typing import Any, Sequence
MINUTES_PER_DAY = 24 * 60
MINUTES_PER_WEEK = 7 * MINUTES_PER_DAY
MINIMUM_WINDOW_MINUTES = 30
DEFAULT_MAINTENANCE_WINDOW = "sun:04:00-sun:04:30"
DEFAULT_BACKUP_WINDOW = "03:00-03:30"
_DAYS = ("mon", "tue", "wed", "thu", "fri", "sat", "sun")
_CLOCK = r"(?:[01][0-9]|2[0-3]):[0-5][0-9]"
_BACKUP_PATTERN = re.compile(rf"(?P<start>{_CLOCK})-(?P<end>{_CLOCK})")
_MAINTENANCE_PATTERN = re.compile(
rf"(?P<start_day>mon|tue|wed|thu|fri|sat|sun):(?P<start>{_CLOCK})"
rf"-(?P<end_day>mon|tue|wed|thu|fri|sat|sun):(?P<end>{_CLOCK})",
re.IGNORECASE,
)
_PREFERENCE_DAYS = {
"monday": "mon",
"tuesday": "tue",
"wednesday": "wed",
"thursday": "thu",
"friday": "fri",
"saturday": "sat",
"sunday": "sun",
"tuesday-thursday": "tue",
"saturday-sunday": "sat",
**{day: day for day in _DAYS},
}
def _clock_minutes(clock: str) -> int:
hour, minute = clock.split(":")
return int(hour) * 60 + int(minute)
def _clock_text(minutes: int) -> str:
hour, minute = divmod(minutes % MINUTES_PER_DAY, 60)
return f"{hour:02d}:{minute:02d}"
def _parse_backup(window: str) -> tuple[str, int, int]:
if not isinstance(window, str) or not (
match := _BACKUP_PATTERN.fullmatch(window)
):
raise ValueError(
"backup_window must be a UTC range in hh:mm-hh:mm format"
)
start = _clock_minutes(match["start"])
end = _clock_minutes(match["end"])
duration = (end - start) % MINUTES_PER_DAY
if duration < MINIMUM_WINDOW_MINUTES:
raise ValueError("backup_window must last at least 30 minutes")
return window, start, duration
def _parse_maintenance(window: str) -> tuple[str, int, int]:
if not isinstance(window, str) or not (
match := _MAINTENANCE_PATTERN.fullmatch(window)
):
raise ValueError(
"maintenance_window must be a UTC range in "
"ddd:hh:mm-ddd:hh:mm format"
)
start_day = match["start_day"].lower()
end_day = match["end_day"].lower()
start = _DAYS.index(start_day) * MINUTES_PER_DAY + _clock_minutes(
match["start"]
)
end = _DAYS.index(end_day) * MINUTES_PER_DAY + _clock_minutes(match["end"])
duration = (end - start) % MINUTES_PER_WEEK
if duration < MINIMUM_WINDOW_MINUTES:
raise ValueError("maintenance_window must last at least 30 minutes")
return window.lower(), start, duration
def _overlap(
backup_start: int,
backup_duration: int,
maintenance_start: int,
maintenance_duration: int,
) -> bool:
maintenance_end = maintenance_start + maintenance_duration
# Include the previous day's backup because it can cross midnight into
# maintenance. Unrolling the maintenance week also handles Sunday wrap.
first_day = maintenance_start // MINUTES_PER_DAY - 1
last_day = (maintenance_end - 1) // MINUTES_PER_DAY
for day in range(first_day, last_day + 1):
start = day * MINUTES_PER_DAY + backup_start
if start < maintenance_end and start + backup_duration > maintenance_start:
return True
return False
def windows_overlap(backup_window: str, maintenance_window: str) -> bool:
"""Return whether recurring daily backup and weekly maintenance overlap.
Invalid windows raise ValueError; they are never interpreted as a pass.
"""
_, backup_start, backup_duration = _parse_backup(backup_window)
_, maintenance_start, maintenance_duration = _parse_maintenance(
maintenance_window
)
return _overlap(
backup_start, backup_duration, maintenance_start, maintenance_duration
)
def resolve_windows(
maintenance_window: str | None = None,
backup_window: str | None = None,
) -> dict[str, str]:
"""Validate explicit windows and fill absent windows deterministically.
Two explicit overlapping windows raise ValueError. An absent window can
move, but every explicitly supplied window keeps the requested timing.
"""
maintenance_explicit = maintenance_window is not None
backup_explicit = backup_window is not None
maintenance, maintenance_start, maintenance_duration = _parse_maintenance(
DEFAULT_MAINTENANCE_WINDOW
if maintenance_window is None
else maintenance_window
)
backup, backup_start, backup_duration = _parse_backup(
DEFAULT_BACKUP_WINDOW if backup_window is None else backup_window
)
if not _overlap(
backup_start, backup_duration, maintenance_start, maintenance_duration
):
return {"backup_window": backup, "maintenance_window": maintenance}
if maintenance_explicit and backup_explicit:
raise ValueError("explicit backup_window and maintenance_window overlap")
if not backup_explicit:
for offset in range(1, MINUTES_PER_DAY):
candidate = (backup_start + offset) % MINUTES_PER_DAY
if not _overlap(
candidate,
MINIMUM_WINDOW_MINUTES,
maintenance_start,
maintenance_duration,
):
backup = (
f"{_clock_text(candidate)}-"
f"{_clock_text(candidate + MINIMUM_WINDOW_MINUTES)}"
)
return {
"backup_window": backup,
"maintenance_window": maintenance,
}
raise ValueError(
"maintenance_window leaves no non-overlapping daily "
"30-minute backup window"
)
# Only maintenance is absent. Keep its preferred day and move the
# default's start around that day without changing the explicit backup.
day_start = maintenance_start // MINUTES_PER_DAY * MINUTES_PER_DAY
preferred_start = maintenance_start % MINUTES_PER_DAY
for offset in range(1, MINUTES_PER_DAY):
candidate = day_start + (preferred_start + offset) % MINUTES_PER_DAY
if not _overlap(
backup_start, backup_duration, candidate, MINIMUM_WINDOW_MINUTES
):
end = (candidate + MINIMUM_WINDOW_MINUTES) % MINUTES_PER_WEEK
maintenance = (
f"{_DAYS[candidate // MINUTES_PER_DAY]}:{_clock_text(candidate)}-"
f"{_DAYS[end // MINUTES_PER_DAY]}:{_clock_text(end)}"
)
return {"backup_window": backup, "maintenance_window": maintenance}
raise ValueError(
"backup_window leaves no non-overlapping weekly "
"30-minute maintenance window"
)
def _maintenance_preference(value: Any) -> str | None:
if value is None or value == "flexible":
return None
if isinstance(value, str):
return _parse_maintenance(value)[0]
if not isinstance(value, dict) or set(value) != {"day", "hour_utc"}:
raise ValueError(
"global.maintenance_window must be 'flexible', an AWS weekly "
"range, or an object containing day and hour_utc"
)
day = value["day"]
hour = value["hour_utc"]
if not isinstance(day, str) or day.lower() not in _PREFERENCE_DAYS:
raise ValueError("global.maintenance_window.day is not supported")
if type(hour) is not int or not 0 <= hour <= 23:
raise ValueError(
"global.maintenance_window.hour_utc must be an integer from 0 to 23"
)
selected_day = _PREFERENCE_DAYS[day.lower()]
return f"{selected_day}:{hour:02d}:00-{selected_day}:{hour:02d}:30"
def _load_preferences(path: Path) -> tuple[str | None, str | None]:
preferences = json.loads(path.read_text(encoding="utf-8"))
if not isinstance(preferences, dict):
raise ValueError("preferences.json must contain a JSON object")
global_preferences = preferences.get("global", {})
if not isinstance(global_preferences, dict):
raise ValueError("preferences.json.global must contain a JSON object")
return (
_maintenance_preference(global_preferences.get("maintenance_window")),
global_preferences.get("backup_window"),
)
def main(argv: Sequence[str] | None = None) -> int:
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument(
"--preferences",
type=Path,
help="read global maintenance_window and optional backup_window from JSON",
)
parser.add_argument(
"--maintenance-window",
help="explicit weekly UTC range, e.g. sun:04:00-sun:04:30",
)
parser.add_argument(
"--backup-window",
help="explicit daily UTC range, e.g. 03:00-03:30",
)
args = parser.parse_args(argv)
if args.preferences is not None and (
args.maintenance_window is not None or args.backup_window is not None
):
parser.error("--preferences cannot be combined with explicit window flags")
try:
maintenance, backup = (
_load_preferences(args.preferences)
if args.preferences is not None
else (args.maintenance_window, args.backup_window)
)
result = resolve_windows(maintenance, backup)
except (OSError, UnicodeError, ValueError) as error:
parser.error(str(error))
print(json.dumps(result, sort_keys=True))
return 0
if __name__ == "__main__":
raise SystemExit(main())
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs Python, Needs Node.js
Security
What our scanner noticed· Low risk
- Scripts that your agent may run
This skill includes scripts that your agent may run. Read them before you use it.
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- AWS
- Publisher
- AWS (Official)
- Source
- aws/agent-toolkit-for-aws · plugins/aws-startup-advisor/skills/tf-best-practices · commit 0a218f8
- Licence
- Apache License 2.0 (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- NOTICE (added by AutoGineer from NOTICE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by AWS.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download tf-best-practices.zip