diff --git a/README.md b/README.md index eb0727f..ac2c42e 100644 --- a/README.md +++ b/README.md @@ -200,6 +200,7 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's | Skill | Description | |-------|-------------| | [prometheus-grafana](devops/observability/prometheus-grafana/) | Metrics and dashboards | +| [opentelemetry](devops/observability/opentelemetry/) | Vendor-neutral traces, metrics, and logs | | [elk-stack](devops/observability/elk-stack/) | Elasticsearch, Logstash, Kibana | | [loki-logging](devops/observability/loki-logging/) | Grafana Loki log aggregation | | [datadog](devops/observability/datadog/) | Datadog monitoring and APM | @@ -233,6 +234,7 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's | [dast-scanning](security/scanning/dast-scanning/) | OWASP ZAP, Nuclei | | [dependency-scanning](security/scanning/dependency-scanning/) | Snyk, Dependabot | | [container-scanning](security/scanning/container-scanning/) | Image vulnerability scanning | +| [sbom-supply-chain](security/scanning/sbom-supply-chain/) | SBOM generation, signing, and provenance verification | ### Secrets Management | Skill | Description | @@ -292,6 +294,7 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's | [aws-s3](infrastructure/cloud-aws/aws-s3/) | Object storage | | [aws-vpc](infrastructure/cloud-aws/aws-vpc/) | Networking | | [aws-iam](infrastructure/cloud-aws/aws-iam/) | Identity and access | +| [aws-cost-optimization](infrastructure/cloud-aws/aws-cost-optimization/) | FinOps cost reduction and spend governance | ### Cloudflare | Skill | Description | diff --git a/devops/observability/alerting-oncall/SKILL.md b/devops/observability/alerting-oncall/SKILL.md index 0a600c2..4febdd1 100644 --- a/devops/observability/alerting-oncall/SKILL.md +++ b/devops/observability/alerting-oncall/SKILL.md @@ -495,4 +495,4 @@ fatigue_reduction: - [prometheus-grafana](../prometheus-grafana/) - Monitoring setup - [incident-response](../../../security/operations/incident-response/) - Incident handling -- [runbook-automation](../../../compliance/continuity/runbook-automation/) - Runbook creation +- [runbook-creation](../../../compliance/continuity/runbook-creation/) - Runbook creation diff --git a/devops/observability/opentelemetry/SKILL.md b/devops/observability/opentelemetry/SKILL.md new file mode 100644 index 0000000..52c46b6 --- /dev/null +++ b/devops/observability/opentelemetry/SKILL.md @@ -0,0 +1,81 @@ +--- +name: opentelemetry +description: Instrument applications and infrastructure with OpenTelemetry for unified traces, metrics, and logs. Use when implementing distributed tracing, service-level troubleshooting, or vendor-neutral observability. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# OpenTelemetry + +Adopt vendor-neutral telemetry with consistent instrumentation across services. + +## When to Use This Skill + +Use this skill when: +- Debugging latency across microservices +- Standardizing observability data model and naming +- Sending telemetry to Prometheus, Grafana, Datadog, or OTLP backends +- Building SLO dashboards with trace-to-log correlation + +## Core Workflow + +1. Define semantic conventions for services, environments, and versions. +2. Add SDK or auto-instrumentation in each service. +3. Run an OpenTelemetry Collector to receive, transform, and export telemetry. +4. Validate cardinality and sampling to control cost. +5. Create golden signals dashboards and alerting from collected data. + +## Collector Starter Config + +```yaml +# otel-collector.yaml +receivers: + otlp: + protocols: + grpc: + http: + +processors: + batch: + memory_limiter: + check_interval: 1s + limit_mib: 512 + attributes: + actions: + - key: deployment.environment + value: production + action: upsert + +exporters: + debug: {} + otlp: + endpoint: observability-backend:4317 + tls: + insecure: true + +service: + pipelines: + traces: + receivers: [otlp] + processors: [memory_limiter, batch, attributes] + exporters: [otlp, debug] + metrics: + receivers: [otlp] + processors: [memory_limiter, batch, attributes] + exporters: [otlp] +``` + +## Best Practices + +- Use tail-based sampling for high-volume production traces. +- Tag telemetry with `service.name`, `service.version`, and `deployment.environment`. +- Drop noisy attributes early in the collector. +- Keep metric label cardinality low for stable query performance. + +## Related Skills + +- [prometheus-grafana](../prometheus-grafana/) - Dashboarding and alerting +- [datadog](../datadog/) - Managed observability backend +- [alerting-oncall](../alerting-oncall/) - On-call routing and escalation diff --git a/infrastructure/cloud-aws/aws-cost-optimization/SKILL.md b/infrastructure/cloud-aws/aws-cost-optimization/SKILL.md new file mode 100644 index 0000000..2b3dffc --- /dev/null +++ b/infrastructure/cloud-aws/aws-cost-optimization/SKILL.md @@ -0,0 +1,57 @@ +--- +name: aws-cost-optimization +description: Reduce AWS spend with rightsizing, autoscaling, commitment planning, and storage lifecycle policies. Use when running FinOps reviews, lowering cloud bills, or improving cost-per-request metrics. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# AWS Cost Optimization + +Apply practical FinOps controls without sacrificing reliability. + +## When to Use This Skill + +Use this skill when: +- Monthly AWS cost spikes unexpectedly +- Preparing cost reviews with engineering and finance +- Rightsizing EC2, RDS, and EKS workloads +- Choosing Savings Plans or Reserved Instances + +## Cost Review Workflow + +1. Tag resources by team, service, and environment. +2. Use Cost Explorer and CUR to identify top spend drivers. +3. Rightsize underutilized compute and storage. +4. Apply commitment discounts for stable baseline usage. +5. Set budgets, anomaly alerts, and KPI reporting. + +## High-Impact Actions + +- Move bursty non-prod compute to Spot where safe. +- Configure S3 lifecycle rules for infrequent access and archive tiers. +- Reduce NAT Gateway and inter-AZ data transfer surprises. +- Schedule dev/test shutdown windows outside business hours. +- Tune log retention (CloudWatch, OpenSearch) to policy requirements. + +## Useful Commands + +```bash +# Cost Explorer rightsizing recommendations (example) +aws ce get-rightsizing-recommendation \ + --service "AmazonEC2" \ + --configuration file://rightsizing-config.json + +# List unattached EBS volumes +aws ec2 describe-volumes --filters Name=status,Values=available + +# Retrieve budget alerts +aws budgets describe-budgets --account-id 123456789012 +``` + +## Related Skills + +- [aws-ec2](../aws-ec2/) - EC2 operations and sizing +- [aws-s3](../aws-s3/) - S3 storage and lifecycle controls +- [terraform-aws](../terraform-aws/) - Codifying cost guardrails diff --git a/security/ai/ai-agent-security/SKILL.md b/security/ai/ai-agent-security/SKILL.md index 780da71..177b9fa 100644 --- a/security/ai/ai-agent-security/SKILL.md +++ b/security/ai/ai-agent-security/SKILL.md @@ -35,4 +35,4 @@ Protect agentic systems from adversarial input and unsafe tool execution. ## Related Skills - [llm-app-security](../llm-app-security/) - Application-layer LLM defenses -- [threat-modeling](../operations/threat-modeling/) - Structured risk analysis +- [threat-modeling](../../operations/threat-modeling/) - Structured risk analysis diff --git a/security/ai/llm-app-security/SKILL.md b/security/ai/llm-app-security/SKILL.md index 888c5b8..6f1d344 100644 --- a/security/ai/llm-app-security/SKILL.md +++ b/security/ai/llm-app-security/SKILL.md @@ -29,4 +29,4 @@ Harden chatbots and AI features embedded in web and mobile products. ## Related Skills - [ai-agent-security](../ai-agent-security/) - Agent-specific controls -- [sast-scanning](../scanning/sast-scanning/) - Secure coding checks +- [sast-scanning](../../scanning/sast-scanning/) - Secure coding checks diff --git a/security/scanning/sbom-supply-chain/SKILL.md b/security/scanning/sbom-supply-chain/SKILL.md new file mode 100644 index 0000000..a087180 --- /dev/null +++ b/security/scanning/sbom-supply-chain/SKILL.md @@ -0,0 +1,57 @@ +--- +name: sbom-supply-chain +description: Generate, sign, and verify SBOMs and provenance attestations to secure the software supply chain. Use when implementing SLSA controls, artifact trust policies, or compliance evidence for releases. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# SBOM & Supply Chain Security + +Improve release trust with reproducible metadata and verification gates. + +## When to Use This Skill + +Use this skill when: +- Producing SBOMs for container images or application builds +- Verifying dependencies before deploy +- Enforcing signed artifact and provenance policies +- Preparing for SOC2, ISO 27001, or customer security reviews + +## Recommended Tooling + +- SBOM generation: Syft, CycloneDX tools +- Vulnerability matching: Grype, Trivy +- Signing and attestations: Cosign, Sigstore +- Policy enforcement: OPA, Kyverno, admission controllers + +## Baseline Workflow + +1. Generate SBOM in SPDX or CycloneDX format during CI builds. +2. Create provenance attestations for build steps and source commit. +3. Sign image digests and SBOM artifacts with keyless or managed keys. +4. Verify signatures and attestations before deployment. +5. Archive evidence for audits and incident response. + +## Example Commands + +```bash +# Generate SBOM for an image +syft registry:ghcr.io/acme/api:1.2.3 -o cyclonedx-json > sbom.json + +# Sign container image digest +cosign sign ghcr.io/acme/api@sha256:abc123... + +# Attach SBOM attestation +cosign attest --predicate sbom.json --type cyclonedx ghcr.io/acme/api@sha256:abc123... + +# Verify signatures +cosign verify ghcr.io/acme/api@sha256:abc123... +``` + +## Related Skills + +- [dependency-scanning](../dependency-scanning/) - Library vulnerability triage +- [container-scanning](../container-scanning/) - Container CVE scanning +- [policy-as-code](../../../compliance/governance/policy-as-code/) - Policy enforcement