- Home
- Skills
- DevOps & Cloud
- AWS Cloud Starter Kit
Works with the AI Agents you already use
AWS Cloud Starter Kit
Modular AWS prompts for startup teams: security, cost control and deployment
$1
AWS Cloud Starter Kit
Example session with this skill installed
I just created a brand-new AWS account for my startup. Set up a production security baseline and keep my monthly bill under control. Give me the code, how to deploy it, and how to verify it.
- Read your context and instructions
- Compiled the aws cloud starter
Goal restated
Harden a fresh AWS account and add cost guardrails. Services created: CloudTrail, GuardDuty, AWS Config, IAM password policy, an encrypted S3 log bucket, AWS Budgets, Cost Anomaly Detection, and an SNS topic for notifications.
What gets deployed
CloudTrail — multi-region trail, log file validation on, delivery to a dedicated S3 bucket with SSE-KMS and access logging enabled.
2. GuardDuty — enabled in every region, with auto-enable for new regions.
3.
AWS Config — recording all resource types, delivering to a centralized S3 bucket, with the baseline rule s3-bucket-public-read-prohibited.
4.
IAM — account password policy: 14 characters minimum, rotation at 90 days, reuse prevention of 24, MFA required for console users.
5.
Budgets — $200 monthly cost budget with SNS email alerts at 50%, 80% and 100%; CloudWatch cost anomaly detection wired to the same topic.
6. Tagging — every resource tagged Project=StartupBackend and Environment=Prod.
Deliverables
- main.tf, variables.tf, outputs.tf — full Terraform, no placeholders. The account ID and alert email are variables, never hardcoded.
- DEPLOY.md — terraform init, plan, apply, plus the prerequisite of confirming the SNS subscription email or alerts silently never arrive.
- VALIDATE.md — CLI checks: aws cloudtrail get-trail-status, aws guardduty list-detectors, aws configservice describe-configuration-recorders, aws budgets describe-budget.
- TROUBLESHOOT.md — the three failures that actually happen: S3 bucket policy rejecting CloudTrail in a locked-down org, GuardDuty failing in opt-in regions, and Config recorder stalling on unsupported resource types.
Why it matters
Order of operations is the whole trick here: CloudTrail and the log bucket must exist before Config, or the recorder has nowhere to deliver. Each control is explained once, in plain language, so you can defend it in a security review.
Connects securely to your tools. The creator never sees your data.
About this skill
Cloud Starter Kit is a set of ten modular, production-grade prompts for putting a startup on AWS properly — instead of one giant unmaintainable block of instructions.
The problem it solves
A startup founder opens a fresh AWS account and immediately faces two expensive mistakes: an account with no security baseline, and a bill nobody is watching. Most prompt collections answer this with a single wall of text that the agent half-follows. This kit is modular: you load only the bricks your workload needs.
What's inside (10 prompts)
- Security — new-account security baseline (CloudTrail, GuardDuty, Config, IAM password policy), least-privilege IAM policy generator with no wildcard resources, security group change audit trail
- Cost — budget alerts plus cost anomaly detection, ECS Fargate Spot migration for 60-70% savings, S3 + CloudFront static hosting
- Deployment — one-click serverless backend (API Gateway + Lambda + DynamoDB), centralized multi-account logging, RDS backup with automated restore testing, a RAG chatbot on Bedrock + OpenSearch Serverless
How every prompt is structured (CLEAR)
Context, List of AWS services, Expect (the deliverable), Action (step-by-step), Recover (troubleshooting). Each one asks the agent for four artifacts: the infrastructure code, a DEPLOY.md, a VALIDATE.md, and a TROUBLESHOOT.md.
Guardrails baked in
S3 public access blocked, encryption on, secrets in Secrets Manager, least-privilege IAM with a permission boundary on every service role, explicit log retention, and consistent resource tagging. The skill also instructs the agent never to run terraform apply or cdk deploy without explicit confirmation.
Who it's for
Startup founders and solo developers who need enterprise-grade cloud hygiene without an enterprise-grade platform team. MIT licensed; original prompts are open on GitHub and this skill packages them into the SKILL.md standard.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scanned
Verified clean 2 days ago
- Passed all security checks, Safe to install
Requires