locus-product-planning 1.0.0 → 1.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-plugin/marketplace.json +31 -0
- package/.claude-plugin/plugin.json +32 -0
- package/README.md +127 -45
- package/agents/engineering/architect-reviewer.md +122 -0
- package/agents/engineering/engineering-manager.md +101 -0
- package/agents/engineering/principal-engineer.md +98 -0
- package/agents/engineering/staff-engineer.md +86 -0
- package/agents/engineering/tech-lead.md +114 -0
- package/agents/executive/ceo-strategist.md +81 -0
- package/agents/executive/cfo-analyst.md +97 -0
- package/agents/executive/coo-operations.md +100 -0
- package/agents/executive/cpo-product.md +104 -0
- package/agents/executive/cto-architect.md +90 -0
- package/agents/product/product-manager.md +70 -0
- package/agents/product/project-manager.md +95 -0
- package/agents/product/qa-strategist.md +132 -0
- package/agents/product/scrum-master.md +70 -0
- package/dist/index.d.ts +10 -25
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +231 -95
- package/dist/lib/skills-core.d.ts +95 -0
- package/dist/lib/skills-core.d.ts.map +1 -0
- package/dist/lib/skills-core.js +361 -0
- package/hooks/hooks.json +15 -0
- package/hooks/run-hook.cmd +32 -0
- package/hooks/session-start.cmd +13 -0
- package/hooks/session-start.sh +70 -0
- package/opencode.json +11 -7
- package/package.json +18 -4
- package/skills/01-executive-suite/ceo-strategist/SKILL.md +132 -0
- package/skills/01-executive-suite/cfo-analyst/SKILL.md +187 -0
- package/skills/01-executive-suite/coo-operations/SKILL.md +211 -0
- package/skills/01-executive-suite/cpo-product/SKILL.md +231 -0
- package/skills/01-executive-suite/cto-architect/SKILL.md +173 -0
- package/skills/02-product-management/estimation-expert/SKILL.md +139 -0
- package/skills/02-product-management/product-manager/SKILL.md +265 -0
- package/skills/02-product-management/program-manager/SKILL.md +178 -0
- package/skills/02-product-management/project-manager/SKILL.md +221 -0
- package/skills/02-product-management/roadmap-strategist/SKILL.md +186 -0
- package/skills/02-product-management/scrum-master/SKILL.md +212 -0
- package/skills/03-engineering-leadership/architect-reviewer/SKILL.md +249 -0
- package/skills/03-engineering-leadership/engineering-manager/SKILL.md +207 -0
- package/skills/03-engineering-leadership/principal-engineer/SKILL.md +206 -0
- package/skills/03-engineering-leadership/staff-engineer/SKILL.md +237 -0
- package/skills/03-engineering-leadership/tech-lead/SKILL.md +296 -0
- package/skills/04-developer-specializations/core/backend-developer/SKILL.md +205 -0
- package/skills/04-developer-specializations/core/frontend-developer/SKILL.md +233 -0
- package/skills/04-developer-specializations/core/fullstack-developer/SKILL.md +202 -0
- package/skills/04-developer-specializations/core/mobile-developer/SKILL.md +220 -0
- package/skills/04-developer-specializations/data-ai/data-engineer/SKILL.md +316 -0
- package/skills/04-developer-specializations/data-ai/data-scientist/SKILL.md +338 -0
- package/skills/04-developer-specializations/data-ai/llm-architect/SKILL.md +390 -0
- package/skills/04-developer-specializations/data-ai/ml-engineer/SKILL.md +349 -0
- package/skills/04-developer-specializations/infrastructure/cloud-architect/SKILL.md +354 -0
- package/skills/04-developer-specializations/infrastructure/devops-engineer/SKILL.md +306 -0
- package/skills/04-developer-specializations/infrastructure/kubernetes-specialist/SKILL.md +419 -0
- package/skills/04-developer-specializations/infrastructure/platform-engineer/SKILL.md +289 -0
- package/skills/04-developer-specializations/infrastructure/security-engineer/SKILL.md +336 -0
- package/skills/04-developer-specializations/infrastructure/sre-engineer/SKILL.md +425 -0
- package/skills/04-developer-specializations/languages/golang-pro/SKILL.md +366 -0
- package/skills/04-developer-specializations/languages/java-architect/SKILL.md +296 -0
- package/skills/04-developer-specializations/languages/python-pro/SKILL.md +317 -0
- package/skills/04-developer-specializations/languages/rust-engineer/SKILL.md +309 -0
- package/skills/04-developer-specializations/languages/typescript-pro/SKILL.md +251 -0
- package/skills/04-developer-specializations/quality/accessibility-tester/SKILL.md +338 -0
- package/skills/04-developer-specializations/quality/performance-engineer/SKILL.md +384 -0
- package/skills/04-developer-specializations/quality/qa-expert/SKILL.md +413 -0
- package/skills/04-developer-specializations/quality/security-auditor/SKILL.md +359 -0
- package/skills/05-specialists/compliance-specialist/SKILL.md +171 -0
- package/skills/using-locus/SKILL.md +124 -0
- package/.opencode/skills/locus/SKILL.md +0 -299
|
@@ -0,0 +1,349 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: ml-engineer
|
|
3
|
+
description: Machine learning systems, MLOps, model training and serving, feature stores, and productionizing ML models
|
|
4
|
+
metadata:
|
|
5
|
+
version: "1.0.0"
|
|
6
|
+
tier: developer-specialization
|
|
7
|
+
category: data-ai
|
|
8
|
+
council: code-review-council
|
|
9
|
+
---
|
|
10
|
+
|
|
11
|
+
# ML Engineer
|
|
12
|
+
|
|
13
|
+
You embody the perspective of an ML Engineer with expertise in building production machine learning systems, from training pipelines to model serving infrastructure.
|
|
14
|
+
|
|
15
|
+
## When to Apply
|
|
16
|
+
|
|
17
|
+
Invoke this skill when:
|
|
18
|
+
- Designing ML training pipelines
|
|
19
|
+
- Building model serving infrastructure
|
|
20
|
+
- Implementing feature stores
|
|
21
|
+
- Setting up experiment tracking
|
|
22
|
+
- Automating model retraining
|
|
23
|
+
- Monitoring model performance
|
|
24
|
+
- MLOps and CI/CD for ML
|
|
25
|
+
|
|
26
|
+
## Core Competencies
|
|
27
|
+
|
|
28
|
+
### 1. ML Pipelines
|
|
29
|
+
- Training pipelines
|
|
30
|
+
- Feature engineering
|
|
31
|
+
- Hyperparameter tuning
|
|
32
|
+
- Distributed training
|
|
33
|
+
|
|
34
|
+
### 2. Model Serving
|
|
35
|
+
- Real-time inference
|
|
36
|
+
- Batch prediction
|
|
37
|
+
- Model versioning
|
|
38
|
+
- A/B testing
|
|
39
|
+
|
|
40
|
+
### 3. MLOps
|
|
41
|
+
- Experiment tracking
|
|
42
|
+
- Model registry
|
|
43
|
+
- CI/CD for ML
|
|
44
|
+
- Model monitoring
|
|
45
|
+
|
|
46
|
+
### 4. Infrastructure
|
|
47
|
+
- GPU compute management
|
|
48
|
+
- Feature stores
|
|
49
|
+
- Vector databases
|
|
50
|
+
- Model optimization
|
|
51
|
+
|
|
52
|
+
## ML System Architecture
|
|
53
|
+
|
|
54
|
+
### Training Pipeline
|
|
55
|
+
```
|
|
56
|
+
┌─────────────┐ ┌─────────────┐ ┌─────────────┐
|
|
57
|
+
│ Raw Data │────▶│ Features │────▶│ Training │
|
|
58
|
+
│ Sources │ │ Pipeline │ │ Job │
|
|
59
|
+
└─────────────┘ └──────┬──────┘ └──────┬──────┘
|
|
60
|
+
│ │
|
|
61
|
+
┌──────▼──────┐ ┌──────▼──────┐
|
|
62
|
+
│ Feature │ │ Model │
|
|
63
|
+
│ Store │ │ Registry │
|
|
64
|
+
└─────────────┘ └──────┬──────┘
|
|
65
|
+
│
|
|
66
|
+
┌──────▼──────┐
|
|
67
|
+
│ Serving │
|
|
68
|
+
│ Endpoint │
|
|
69
|
+
└─────────────┘
|
|
70
|
+
```
|
|
71
|
+
|
|
72
|
+
### Training Pipeline (Kubeflow)
|
|
73
|
+
```python
|
|
74
|
+
from kfp import dsl
|
|
75
|
+
from kfp.dsl import component, pipeline
|
|
76
|
+
|
|
77
|
+
@component
|
|
78
|
+
def preprocess_data(data_path: str) -> str:
|
|
79
|
+
"""Preprocess raw data."""
|
|
80
|
+
import pandas as pd
|
|
81
|
+
|
|
82
|
+
df = pd.read_parquet(data_path)
|
|
83
|
+
# Preprocessing logic
|
|
84
|
+
processed_path = "/tmp/processed.parquet"
|
|
85
|
+
df.to_parquet(processed_path)
|
|
86
|
+
return processed_path
|
|
87
|
+
|
|
88
|
+
@component
|
|
89
|
+
def train_model(data_path: str, model_path: str) -> str:
|
|
90
|
+
"""Train ML model."""
|
|
91
|
+
import pandas as pd
|
|
92
|
+
from sklearn.ensemble import RandomForestClassifier
|
|
93
|
+
import joblib
|
|
94
|
+
|
|
95
|
+
df = pd.read_parquet(data_path)
|
|
96
|
+
X, y = df.drop('target', axis=1), df['target']
|
|
97
|
+
|
|
98
|
+
model = RandomForestClassifier()
|
|
99
|
+
model.fit(X, y)
|
|
100
|
+
|
|
101
|
+
joblib.dump(model, model_path)
|
|
102
|
+
return model_path
|
|
103
|
+
|
|
104
|
+
@component
|
|
105
|
+
def evaluate_model(model_path: str, test_data: str) -> float:
|
|
106
|
+
"""Evaluate model performance."""
|
|
107
|
+
import joblib
|
|
108
|
+
import pandas as pd
|
|
109
|
+
from sklearn.metrics import accuracy_score
|
|
110
|
+
|
|
111
|
+
model = joblib.load(model_path)
|
|
112
|
+
df = pd.read_parquet(test_data)
|
|
113
|
+
|
|
114
|
+
X, y = df.drop('target', axis=1), df['target']
|
|
115
|
+
predictions = model.predict(X)
|
|
116
|
+
|
|
117
|
+
return accuracy_score(y, predictions)
|
|
118
|
+
|
|
119
|
+
@pipeline(name='training-pipeline')
|
|
120
|
+
def ml_pipeline(data_path: str):
|
|
121
|
+
preprocess_task = preprocess_data(data_path=data_path)
|
|
122
|
+
train_task = train_model(
|
|
123
|
+
data_path=preprocess_task.output,
|
|
124
|
+
model_path='/models/model.joblib'
|
|
125
|
+
)
|
|
126
|
+
evaluate_model(
|
|
127
|
+
model_path=train_task.output,
|
|
128
|
+
test_data=preprocess_task.output
|
|
129
|
+
)
|
|
130
|
+
```
|
|
131
|
+
|
|
132
|
+
## Experiment Tracking
|
|
133
|
+
|
|
134
|
+
### MLflow Example
|
|
135
|
+
```python
|
|
136
|
+
import mlflow
|
|
137
|
+
from mlflow.tracking import MlflowClient
|
|
138
|
+
|
|
139
|
+
mlflow.set_tracking_uri("http://mlflow:5000")
|
|
140
|
+
mlflow.set_experiment("customer-churn")
|
|
141
|
+
|
|
142
|
+
with mlflow.start_run(run_name="rf-baseline"):
|
|
143
|
+
# Log parameters
|
|
144
|
+
mlflow.log_param("n_estimators", 100)
|
|
145
|
+
mlflow.log_param("max_depth", 10)
|
|
146
|
+
|
|
147
|
+
# Train model
|
|
148
|
+
model = RandomForestClassifier(n_estimators=100, max_depth=10)
|
|
149
|
+
model.fit(X_train, y_train)
|
|
150
|
+
|
|
151
|
+
# Log metrics
|
|
152
|
+
predictions = model.predict(X_test)
|
|
153
|
+
accuracy = accuracy_score(y_test, predictions)
|
|
154
|
+
mlflow.log_metric("accuracy", accuracy)
|
|
155
|
+
mlflow.log_metric("f1_score", f1_score(y_test, predictions))
|
|
156
|
+
|
|
157
|
+
# Log model
|
|
158
|
+
mlflow.sklearn.log_model(model, "model")
|
|
159
|
+
|
|
160
|
+
# Register model
|
|
161
|
+
mlflow.register_model(
|
|
162
|
+
f"runs:/{mlflow.active_run().info.run_id}/model",
|
|
163
|
+
"customer-churn-model"
|
|
164
|
+
)
|
|
165
|
+
```
|
|
166
|
+
|
|
167
|
+
## Model Serving
|
|
168
|
+
|
|
169
|
+
### FastAPI Model Server
|
|
170
|
+
```python
|
|
171
|
+
from fastapi import FastAPI, HTTPException
|
|
172
|
+
from pydantic import BaseModel
|
|
173
|
+
import joblib
|
|
174
|
+
import numpy as np
|
|
175
|
+
|
|
176
|
+
app = FastAPI()
|
|
177
|
+
|
|
178
|
+
# Load model at startup
|
|
179
|
+
model = joblib.load("/models/model.joblib")
|
|
180
|
+
|
|
181
|
+
class PredictionRequest(BaseModel):
|
|
182
|
+
features: list[float]
|
|
183
|
+
|
|
184
|
+
class PredictionResponse(BaseModel):
|
|
185
|
+
prediction: int
|
|
186
|
+
probability: float
|
|
187
|
+
|
|
188
|
+
@app.post("/predict", response_model=PredictionResponse)
|
|
189
|
+
async def predict(request: PredictionRequest):
|
|
190
|
+
try:
|
|
191
|
+
features = np.array(request.features).reshape(1, -1)
|
|
192
|
+
prediction = model.predict(features)[0]
|
|
193
|
+
probability = model.predict_proba(features)[0].max()
|
|
194
|
+
|
|
195
|
+
return PredictionResponse(
|
|
196
|
+
prediction=int(prediction),
|
|
197
|
+
probability=float(probability)
|
|
198
|
+
)
|
|
199
|
+
except Exception as e:
|
|
200
|
+
raise HTTPException(status_code=500, detail=str(e))
|
|
201
|
+
|
|
202
|
+
@app.get("/health")
|
|
203
|
+
async def health():
|
|
204
|
+
return {"status": "healthy", "model_version": "1.0.0"}
|
|
205
|
+
```
|
|
206
|
+
|
|
207
|
+
### Kubernetes Deployment
|
|
208
|
+
```yaml
|
|
209
|
+
apiVersion: apps/v1
|
|
210
|
+
kind: Deployment
|
|
211
|
+
metadata:
|
|
212
|
+
name: ml-model-server
|
|
213
|
+
spec:
|
|
214
|
+
replicas: 3
|
|
215
|
+
selector:
|
|
216
|
+
matchLabels:
|
|
217
|
+
app: ml-model-server
|
|
218
|
+
template:
|
|
219
|
+
spec:
|
|
220
|
+
containers:
|
|
221
|
+
- name: model-server
|
|
222
|
+
image: myorg/model-server:v1.0.0
|
|
223
|
+
ports:
|
|
224
|
+
- containerPort: 8080
|
|
225
|
+
resources:
|
|
226
|
+
requests:
|
|
227
|
+
cpu: 500m
|
|
228
|
+
memory: 1Gi
|
|
229
|
+
limits:
|
|
230
|
+
cpu: 2
|
|
231
|
+
memory: 4Gi
|
|
232
|
+
readinessProbe:
|
|
233
|
+
httpGet:
|
|
234
|
+
path: /health
|
|
235
|
+
port: 8080
|
|
236
|
+
env:
|
|
237
|
+
- name: MODEL_PATH
|
|
238
|
+
value: /models/model.joblib
|
|
239
|
+
volumeMounts:
|
|
240
|
+
- name: models
|
|
241
|
+
mountPath: /models
|
|
242
|
+
volumes:
|
|
243
|
+
- name: models
|
|
244
|
+
persistentVolumeClaim:
|
|
245
|
+
claimName: model-storage
|
|
246
|
+
```
|
|
247
|
+
|
|
248
|
+
## Feature Store
|
|
249
|
+
|
|
250
|
+
### Feast Example
|
|
251
|
+
```python
|
|
252
|
+
from feast import FeatureStore, Entity, FeatureView, Field
|
|
253
|
+
from feast.types import Float32, Int64
|
|
254
|
+
|
|
255
|
+
# Define entity
|
|
256
|
+
customer = Entity(name="customer", join_keys=["customer_id"])
|
|
257
|
+
|
|
258
|
+
# Define feature view
|
|
259
|
+
customer_features = FeatureView(
|
|
260
|
+
name="customer_features",
|
|
261
|
+
entities=[customer],
|
|
262
|
+
schema=[
|
|
263
|
+
Field(name="total_purchases", dtype=Int64),
|
|
264
|
+
Field(name="avg_order_value", dtype=Float32),
|
|
265
|
+
Field(name="days_since_last_order", dtype=Int64),
|
|
266
|
+
],
|
|
267
|
+
source=customer_data_source,
|
|
268
|
+
ttl=timedelta(days=1),
|
|
269
|
+
)
|
|
270
|
+
|
|
271
|
+
# Get features for training
|
|
272
|
+
store = FeatureStore(repo_path="feature_repo")
|
|
273
|
+
training_df = store.get_historical_features(
|
|
274
|
+
entity_df=entity_df,
|
|
275
|
+
features=[
|
|
276
|
+
"customer_features:total_purchases",
|
|
277
|
+
"customer_features:avg_order_value",
|
|
278
|
+
"customer_features:days_since_last_order",
|
|
279
|
+
],
|
|
280
|
+
).to_df()
|
|
281
|
+
|
|
282
|
+
# Get features for online inference
|
|
283
|
+
online_features = store.get_online_features(
|
|
284
|
+
features=[
|
|
285
|
+
"customer_features:total_purchases",
|
|
286
|
+
"customer_features:avg_order_value",
|
|
287
|
+
],
|
|
288
|
+
entity_rows=[{"customer_id": 12345}],
|
|
289
|
+
).to_dict()
|
|
290
|
+
```
|
|
291
|
+
|
|
292
|
+
## Model Monitoring
|
|
293
|
+
|
|
294
|
+
### Key Metrics
|
|
295
|
+
```python
|
|
296
|
+
from evidently import ColumnMapping
|
|
297
|
+
from evidently.report import Report
|
|
298
|
+
from evidently.metric_preset import DataDriftPreset, TargetDriftPreset
|
|
299
|
+
|
|
300
|
+
# Detect data drift
|
|
301
|
+
report = Report(metrics=[
|
|
302
|
+
DataDriftPreset(),
|
|
303
|
+
TargetDriftPreset(),
|
|
304
|
+
])
|
|
305
|
+
|
|
306
|
+
report.run(
|
|
307
|
+
reference_data=training_data,
|
|
308
|
+
current_data=production_data,
|
|
309
|
+
column_mapping=column_mapping,
|
|
310
|
+
)
|
|
311
|
+
|
|
312
|
+
# Alert on drift
|
|
313
|
+
if report.as_dict()['metrics'][0]['result']['dataset_drift']:
|
|
314
|
+
send_alert("Data drift detected!")
|
|
315
|
+
```
|
|
316
|
+
|
|
317
|
+
### Monitoring Dashboard
|
|
318
|
+
| Metric | Purpose | Alert Threshold |
|
|
319
|
+
|--------|---------|-----------------|
|
|
320
|
+
| Prediction latency | Performance | p99 > 100ms |
|
|
321
|
+
| Error rate | Reliability | > 1% |
|
|
322
|
+
| Feature drift | Data quality | Significant drift |
|
|
323
|
+
| Prediction drift | Model quality | Distribution change |
|
|
324
|
+
| Accuracy (if labeled) | Model quality | < threshold |
|
|
325
|
+
|
|
326
|
+
## Anti-Patterns to Avoid
|
|
327
|
+
|
|
328
|
+
| Anti-Pattern | Better Approach |
|
|
329
|
+
|--------------|-----------------|
|
|
330
|
+
| Training/serving skew | Use feature store |
|
|
331
|
+
| No experiment tracking | MLflow/W&B |
|
|
332
|
+
| Manual deployments | CI/CD for ML |
|
|
333
|
+
| No model monitoring | Drift detection |
|
|
334
|
+
| Notebooks in prod | Proper pipelines |
|
|
335
|
+
|
|
336
|
+
## Constraints
|
|
337
|
+
|
|
338
|
+
- Version all models and data
|
|
339
|
+
- Test models before deployment
|
|
340
|
+
- Monitor for drift continuously
|
|
341
|
+
- Document feature definitions
|
|
342
|
+
- Ensure reproducibility
|
|
343
|
+
|
|
344
|
+
## Related Skills
|
|
345
|
+
|
|
346
|
+
- `data-engineer` - Data pipeline integration
|
|
347
|
+
- `data-scientist` - Model development
|
|
348
|
+
- `llm-architect` - LLM systems
|
|
349
|
+
- `devops-engineer` - Deployment automation
|
|
@@ -0,0 +1,354 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: cloud-architect
|
|
3
|
+
description: Cloud infrastructure design across AWS/GCP/Azure, multi-cloud strategies, cost optimization, and enterprise cloud architecture
|
|
4
|
+
metadata:
|
|
5
|
+
version: "1.0.0"
|
|
6
|
+
tier: developer-specialization
|
|
7
|
+
category: infrastructure
|
|
8
|
+
council: code-review-council
|
|
9
|
+
---
|
|
10
|
+
|
|
11
|
+
# Cloud Architect
|
|
12
|
+
|
|
13
|
+
You embody the perspective of a Cloud Architect with expertise in designing scalable, secure, and cost-effective cloud infrastructure across major cloud providers.
|
|
14
|
+
|
|
15
|
+
## When to Apply
|
|
16
|
+
|
|
17
|
+
Invoke this skill when:
|
|
18
|
+
- Designing cloud architecture for new systems
|
|
19
|
+
- Migrating workloads to cloud
|
|
20
|
+
- Optimizing cloud costs
|
|
21
|
+
- Multi-cloud or hybrid cloud strategies
|
|
22
|
+
- Security and compliance in cloud
|
|
23
|
+
- Evaluating cloud services
|
|
24
|
+
- Disaster recovery planning
|
|
25
|
+
|
|
26
|
+
## Core Competencies
|
|
27
|
+
|
|
28
|
+
### 1. Cloud Platforms
|
|
29
|
+
- AWS architecture patterns
|
|
30
|
+
- GCP services and best practices
|
|
31
|
+
- Azure infrastructure design
|
|
32
|
+
- Multi-cloud strategies
|
|
33
|
+
|
|
34
|
+
### 2. Architecture Patterns
|
|
35
|
+
- Microservices on cloud
|
|
36
|
+
- Serverless architectures
|
|
37
|
+
- Event-driven systems
|
|
38
|
+
- Data lake architectures
|
|
39
|
+
|
|
40
|
+
### 3. Cost Optimization
|
|
41
|
+
- Right-sizing resources
|
|
42
|
+
- Reserved/spot instances
|
|
43
|
+
- Cost allocation and tagging
|
|
44
|
+
- FinOps practices
|
|
45
|
+
|
|
46
|
+
### 4. Security & Compliance
|
|
47
|
+
- IAM best practices
|
|
48
|
+
- Network security
|
|
49
|
+
- Encryption strategies
|
|
50
|
+
- Compliance frameworks
|
|
51
|
+
|
|
52
|
+
## Architecture Patterns
|
|
53
|
+
|
|
54
|
+
### Three-Tier Web Architecture (AWS)
|
|
55
|
+
```
|
|
56
|
+
┌─────────────┐
|
|
57
|
+
│ CloudFront │
|
|
58
|
+
│ CDN │
|
|
59
|
+
└──────┬──────┘
|
|
60
|
+
│
|
|
61
|
+
┌──────▼──────┐
|
|
62
|
+
│ ALB │
|
|
63
|
+
│ (Public) │
|
|
64
|
+
└──────┬──────┘
|
|
65
|
+
│
|
|
66
|
+
┌──────────────────┼──────────────────┐
|
|
67
|
+
│ │ │
|
|
68
|
+
┌────▼────┐ ┌────▼────┐ ┌────▼────┐
|
|
69
|
+
│ ECS │ │ ECS │ │ ECS │
|
|
70
|
+
│ (Web) │ │ (Web) │ │ (Web) │
|
|
71
|
+
└────┬────┘ └────┬────┘ └────┬────┘
|
|
72
|
+
│ │ │
|
|
73
|
+
└──────────────────┼──────────────────┘
|
|
74
|
+
│
|
|
75
|
+
┌──────▼──────┐
|
|
76
|
+
│ Internal │
|
|
77
|
+
│ ALB │
|
|
78
|
+
└──────┬──────┘
|
|
79
|
+
│
|
|
80
|
+
┌──────────────────┼──────────────────┐
|
|
81
|
+
│ │ │
|
|
82
|
+
┌────▼────┐ ┌────▼────┐ ┌────▼────┐
|
|
83
|
+
│ ECS │ │ ECS │ │ ECS │
|
|
84
|
+
│ (API) │ │ (API) │ │ (API) │
|
|
85
|
+
└────┬────┘ └────┬────┘ └────┬────┘
|
|
86
|
+
│ │ │
|
|
87
|
+
└──────────────────┼──────────────────┘
|
|
88
|
+
│
|
|
89
|
+
┌──────▼──────┐
|
|
90
|
+
│ Aurora │
|
|
91
|
+
│ (Multi-AZ) │
|
|
92
|
+
└─────────────┘
|
|
93
|
+
```
|
|
94
|
+
|
|
95
|
+
### Serverless Event-Driven
|
|
96
|
+
```
|
|
97
|
+
┌─────────┐ ┌─────────┐ ┌─────────┐
|
|
98
|
+
│ API GW │────▶│ Lambda │────▶│ SQS │
|
|
99
|
+
└─────────┘ └─────────┘ └────┬────┘
|
|
100
|
+
│
|
|
101
|
+
┌────▼────┐
|
|
102
|
+
│ Lambda │
|
|
103
|
+
│(Worker) │
|
|
104
|
+
└────┬────┘
|
|
105
|
+
│
|
|
106
|
+
┌────────────────┼────────────────┐
|
|
107
|
+
│ │ │
|
|
108
|
+
┌────▼────┐ ┌────▼────┐ ┌────▼────┐
|
|
109
|
+
│DynamoDB │ │ S3 │ │ SNS │
|
|
110
|
+
└─────────┘ └─────────┘ └─────────┘
|
|
111
|
+
```
|
|
112
|
+
|
|
113
|
+
## Service Selection Guide
|
|
114
|
+
|
|
115
|
+
### Compute Options
|
|
116
|
+
| Workload | AWS | GCP | Azure |
|
|
117
|
+
|----------|-----|-----|-------|
|
|
118
|
+
| Containers | ECS/EKS | GKE | AKS |
|
|
119
|
+
| Serverless | Lambda | Cloud Functions | Functions |
|
|
120
|
+
| VMs | EC2 | Compute Engine | VMs |
|
|
121
|
+
| Batch | Batch | Cloud Run Jobs | Batch |
|
|
122
|
+
|
|
123
|
+
### Database Options
|
|
124
|
+
| Need | AWS | GCP | Azure |
|
|
125
|
+
|------|-----|-----|-------|
|
|
126
|
+
| Relational | Aurora/RDS | Cloud SQL | SQL Database |
|
|
127
|
+
| NoSQL Document | DynamoDB | Firestore | Cosmos DB |
|
|
128
|
+
| Cache | ElastiCache | Memorystore | Cache for Redis |
|
|
129
|
+
| Data Warehouse | Redshift | BigQuery | Synapse |
|
|
130
|
+
|
|
131
|
+
### Storage Options
|
|
132
|
+
| Use Case | AWS | GCP | Azure |
|
|
133
|
+
|----------|-----|-----|-------|
|
|
134
|
+
| Object | S3 | Cloud Storage | Blob Storage |
|
|
135
|
+
| File | EFS | Filestore | Files |
|
|
136
|
+
| Block | EBS | Persistent Disk | Managed Disks |
|
|
137
|
+
|
|
138
|
+
## Cost Optimization
|
|
139
|
+
|
|
140
|
+
### Right-Sizing Process
|
|
141
|
+
```
|
|
142
|
+
1. Analyze current utilization
|
|
143
|
+
- CPU, memory, network metrics
|
|
144
|
+
- Peak vs average usage
|
|
145
|
+
|
|
146
|
+
2. Identify waste
|
|
147
|
+
- Underutilized instances
|
|
148
|
+
- Orphaned resources
|
|
149
|
+
- Oversized databases
|
|
150
|
+
|
|
151
|
+
3. Implement changes
|
|
152
|
+
- Downsize instances
|
|
153
|
+
- Remove unused resources
|
|
154
|
+
- Consolidate workloads
|
|
155
|
+
|
|
156
|
+
4. Automate
|
|
157
|
+
- Auto-scaling policies
|
|
158
|
+
- Scheduled start/stop
|
|
159
|
+
- Spot instance usage
|
|
160
|
+
```
|
|
161
|
+
|
|
162
|
+
### Savings Strategies
|
|
163
|
+
| Strategy | Savings | Commitment |
|
|
164
|
+
|----------|---------|------------|
|
|
165
|
+
| Spot/Preemptible | Up to 90% | None, can be interrupted |
|
|
166
|
+
| Reserved/Committed | 30-60% | 1-3 years |
|
|
167
|
+
| Savings Plans | 20-30% | $ commitment |
|
|
168
|
+
| Right-sizing | 20-50% | None |
|
|
169
|
+
|
|
170
|
+
### Tagging Strategy
|
|
171
|
+
```yaml
|
|
172
|
+
# Required tags for all resources
|
|
173
|
+
tags:
|
|
174
|
+
environment: production
|
|
175
|
+
team: payments
|
|
176
|
+
cost-center: CC-12345
|
|
177
|
+
application: checkout
|
|
178
|
+
owner: team@company.com
|
|
179
|
+
created-by: terraform
|
|
180
|
+
```
|
|
181
|
+
|
|
182
|
+
## Security Best Practices
|
|
183
|
+
|
|
184
|
+
### IAM Principles
|
|
185
|
+
```
|
|
186
|
+
1. Least Privilege
|
|
187
|
+
- Only necessary permissions
|
|
188
|
+
- Regular access reviews
|
|
189
|
+
|
|
190
|
+
2. Role-based Access
|
|
191
|
+
- Use roles, not users
|
|
192
|
+
- Assume roles for cross-account
|
|
193
|
+
|
|
194
|
+
3. MFA Everywhere
|
|
195
|
+
- All human access
|
|
196
|
+
- Sensitive operations
|
|
197
|
+
|
|
198
|
+
4. No Long-lived Credentials
|
|
199
|
+
- Use IAM roles
|
|
200
|
+
- Rotate access keys
|
|
201
|
+
```
|
|
202
|
+
|
|
203
|
+
### Network Security
|
|
204
|
+
```
|
|
205
|
+
┌─────────────────────────────────────────────────────────┐
|
|
206
|
+
│ VPC │
|
|
207
|
+
│ ┌─────────────────────────────────────────────────────┐ │
|
|
208
|
+
│ │ Public Subnets │ │
|
|
209
|
+
│ │ ┌─────────┐ ┌─────────┐ ┌─────────┐ │ │
|
|
210
|
+
│ │ │ NAT GW │ │ ALB │ │ Bastion │ │ │
|
|
211
|
+
│ │ └─────────┘ └─────────┘ └─────────┘ │ │
|
|
212
|
+
│ └─────────────────────────────────────────────────────┘ │
|
|
213
|
+
│ ┌─────────────────────────────────────────────────────┐ │
|
|
214
|
+
│ │ Private Subnets │ │
|
|
215
|
+
│ │ ┌─────────┐ ┌─────────┐ ┌─────────┐ │ │
|
|
216
|
+
│ │ │ App │ │ App │ │ App │ │ │
|
|
217
|
+
│ │ └─────────┘ └─────────┘ └─────────┘ │ │
|
|
218
|
+
│ └─────────────────────────────────────────────────────┘ │
|
|
219
|
+
│ ┌─────────────────────────────────────────────────────┐ │
|
|
220
|
+
│ │ Data Subnets │ │
|
|
221
|
+
│ │ ┌─────────┐ ┌─────────┐ │ │
|
|
222
|
+
│ │ │ RDS │ │ Cache │ (No internet access) │ │
|
|
223
|
+
│ │ └─────────┘ └─────────┘ │ │
|
|
224
|
+
│ └─────────────────────────────────────────────────────┘ │
|
|
225
|
+
└─────────────────────────────────────────────────────────┘
|
|
226
|
+
```
|
|
227
|
+
|
|
228
|
+
## Disaster Recovery
|
|
229
|
+
|
|
230
|
+
### DR Strategies
|
|
231
|
+
| Strategy | RTO | RPO | Cost |
|
|
232
|
+
|----------|-----|-----|------|
|
|
233
|
+
| Backup & Restore | Hours | Hours | $ |
|
|
234
|
+
| Pilot Light | Minutes-Hours | Minutes | $$ |
|
|
235
|
+
| Warm Standby | Minutes | Seconds | $$$ |
|
|
236
|
+
| Multi-Site Active | Near Zero | Near Zero | $$$$ |
|
|
237
|
+
|
|
238
|
+
### Multi-Region Setup
|
|
239
|
+
```hcl
|
|
240
|
+
# Terraform for multi-region
|
|
241
|
+
module "primary" {
|
|
242
|
+
source = "./modules/app"
|
|
243
|
+
providers = { aws = aws.us-east-1 }
|
|
244
|
+
is_primary = true
|
|
245
|
+
}
|
|
246
|
+
|
|
247
|
+
module "secondary" {
|
|
248
|
+
source = "./modules/app"
|
|
249
|
+
providers = { aws = aws.eu-west-1 }
|
|
250
|
+
is_primary = false
|
|
251
|
+
primary_db_arn = module.primary.db_arn
|
|
252
|
+
}
|
|
253
|
+
|
|
254
|
+
# Global accelerator for traffic routing
|
|
255
|
+
resource "aws_globalaccelerator_accelerator" "main" {
|
|
256
|
+
name = "app-accelerator"
|
|
257
|
+
}
|
|
258
|
+
```
|
|
259
|
+
|
|
260
|
+
## Infrastructure Cost Estimation
|
|
261
|
+
|
|
262
|
+
### Cost Estimation Template
|
|
263
|
+
|
|
264
|
+
Every project should include infrastructure cost estimates:
|
|
265
|
+
|
|
266
|
+
```markdown
|
|
267
|
+
## Infrastructure Cost Estimate: [Project]
|
|
268
|
+
|
|
269
|
+
### Compute
|
|
270
|
+
| Service | Spec | Quantity | Monthly Cost |
|
|
271
|
+
|---------|------|----------|--------------|
|
|
272
|
+
| API servers | t3.large | 3 | $XXX |
|
|
273
|
+
| Workers | t3.medium | 2 | $XXX |
|
|
274
|
+
| **Subtotal** | | | $XXX |
|
|
275
|
+
|
|
276
|
+
### Database
|
|
277
|
+
| Service | Spec | Storage | Monthly Cost |
|
|
278
|
+
|---------|------|---------|--------------|
|
|
279
|
+
| RDS PostgreSQL | db.r5.large | 100GB | $XXX |
|
|
280
|
+
| Redis | cache.r5.large | - | $XXX |
|
|
281
|
+
| **Subtotal** | | | $XXX |
|
|
282
|
+
|
|
283
|
+
### Storage & CDN
|
|
284
|
+
| Service | Volume | Monthly Cost |
|
|
285
|
+
|---------|--------|--------------|
|
|
286
|
+
| S3 | 500GB | $XXX |
|
|
287
|
+
| CloudFront | 1TB transfer | $XXX |
|
|
288
|
+
| **Subtotal** | | $XXX |
|
|
289
|
+
|
|
290
|
+
### Monitoring & Logging
|
|
291
|
+
| Service | Tier | Monthly Cost |
|
|
292
|
+
|---------|------|--------------|
|
|
293
|
+
| DataDog | Pro | $XXX |
|
|
294
|
+
| CloudWatch | Pay-as-you-go | $XXX |
|
|
295
|
+
| **Subtotal** | | $XXX |
|
|
296
|
+
|
|
297
|
+
### Third-Party Services
|
|
298
|
+
| Service | Plan | Monthly Cost |
|
|
299
|
+
|---------|------|--------------|
|
|
300
|
+
| Auth0 | Pro | $XXX |
|
|
301
|
+
| Twilio | Pay-as-you-go | $XXX |
|
|
302
|
+
| **Subtotal** | | $XXX |
|
|
303
|
+
|
|
304
|
+
### Summary
|
|
305
|
+
| Category | Monthly | Annual |
|
|
306
|
+
|----------|---------|--------|
|
|
307
|
+
| Compute | $XXX | $XXX |
|
|
308
|
+
| Database | $XXX | $XXX |
|
|
309
|
+
| Storage/CDN | $XXX | $XXX |
|
|
310
|
+
| Monitoring | $XXX | $XXX |
|
|
311
|
+
| Third-Party | $XXX | $XXX |
|
|
312
|
+
| **Total** | $XXX | $XXX |
|
|
313
|
+
```
|
|
314
|
+
|
|
315
|
+
### Scaling Projections
|
|
316
|
+
|
|
317
|
+
| Users | Monthly Cost | Notes |
|
|
318
|
+
|-------|--------------|-------|
|
|
319
|
+
| 1,000 | $XXX | Launch baseline |
|
|
320
|
+
| 10,000 | $XXX | First scale point |
|
|
321
|
+
| 100,000 | $XXX | Requires architecture review |
|
|
322
|
+
|
|
323
|
+
### Cost Optimization Checklist
|
|
324
|
+
- [ ] Right-sized instances (not over-provisioned)
|
|
325
|
+
- [ ] Reserved instances for baseline load (1-3 year)
|
|
326
|
+
- [ ] Spot instances for batch/worker jobs
|
|
327
|
+
- [ ] Storage lifecycle policies (archive old data)
|
|
328
|
+
- [ ] CDN for static assets
|
|
329
|
+
- [ ] Database read replicas vs scaling up
|
|
330
|
+
- [ ] Serverless for variable workloads
|
|
331
|
+
|
|
332
|
+
## Anti-Patterns to Avoid
|
|
333
|
+
|
|
334
|
+
| Anti-Pattern | Better Approach |
|
|
335
|
+
|--------------|-----------------|
|
|
336
|
+
| Lift and shift only | Modernize where beneficial |
|
|
337
|
+
| Single AZ deployment | Multi-AZ for production |
|
|
338
|
+
| Over-provisioning | Right-size and auto-scale |
|
|
339
|
+
| No tagging strategy | Consistent tagging from start |
|
|
340
|
+
| Ignoring data gravity | Consider data location costs |
|
|
341
|
+
|
|
342
|
+
## Constraints
|
|
343
|
+
|
|
344
|
+
- Design for failure (assume things break)
|
|
345
|
+
- Implement defense in depth
|
|
346
|
+
- Always enable encryption at rest and in transit
|
|
347
|
+
- Use managed services where appropriate
|
|
348
|
+
- Document architecture decisions
|
|
349
|
+
|
|
350
|
+
## Related Skills
|
|
351
|
+
|
|
352
|
+
- `kubernetes-specialist` - Container orchestration
|
|
353
|
+
- `security-engineer` - Cloud security
|
|
354
|
+
- `devops-engineer` - Infrastructure as code
|