Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Cloud Infrastructure · aiskillstore | DecimalAI

aiskillstore/cloud-infrastructure

SkillScore41Maintained

Cloud infrastructure design and deployment patterns for AWS, Azure, and GCP. Use when designing cloud architectures, implementing IaC with Terraform, optimizing costs, or setting up multi-region deployments.

DevOpsby aiskillstore

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

DevOps & SRE pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/aiskillstore-cloud-infrastructure/SKILL.md

decimalai skills pull aiskillstore-cloud-infrastructure --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/aiskillstore-cloud-infrastructure/SKILL.md https://app.decimal.ai/s/aiskillstore-cloud-infrastructure/SKILL.md

Raw file: /s/aiskillstore-cloud-infrastructure/SKILL.md ↗ · machine-readable summary at /s/aiskillstore-cloud-infrastructure.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 8d ago

Yes — +23% lift · at higher cost+48% tokens0% turns41% of whole cases pass with skill (9/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	29%	0%
case-08	✗→✓	▲ Improved	39%	0%
case-11	✗→✓	▲ Improved	157%	0%
case-15	✗→✓	▲ Improved	42%	0%
case-19	✗→✓	▲ Improved	50%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

aiskillstore / marketplace

skills/89jobrien/cloud-infrastructure/SKILL.md

View on GitHub ↗

Imported 8/3/2026Version v1

Skill contents

SKILL.md

Cloud Infrastructure

Comprehensive cloud infrastructure skill covering multi-cloud architecture, Infrastructure as Code, cost optimization, and production deployment patterns.

When to Use This Skill

Designing cloud architecture for new applications
Implementing Infrastructure as Code (Terraform, CloudFormation, Pulumi)
Cost optimization and resource right-sizing
Multi-region and high-availability deployments
Cloud migration planning
Security and compliance implementation
Auto-scaling and performance optimization

Cloud Architecture Patterns

Compute Patterns

| Pattern | AWS | Azure | GCP | Use Case | |---------|-----|-------|-----|----------| | Serverless | Lambda | Functions | Cloud Functions | Event-driven, variable load | | Containers | ECS/EKS | AKS | GKE | Microservices, consistent env | | VMs | EC2 | Virtual Machines | Compute Engine | Legacy apps, full control | | Batch | Batch | Batch | Batch | Large-scale processing |

Storage Patterns

| Type | AWS | Azure | GCP | Use Case | |------|-----|-------|-----|----------| | Object | S3 | Blob Storage | Cloud Storage | Static files, backups | | Block | EBS | Managed Disks | Persistent Disk | Database storage | | File | EFS | Azure Files | Filestore | Shared file systems | | Archive | Glacier | Archive | Coldline | Long-term retention |

Database Patterns

| Type | AWS | Azure | GCP | Use Case | |------|-----|-------|-----|----------| | Relational | RDS, Aurora | SQL Database | Cloud SQL | ACID transactions | | NoSQL | DynamoDB | Cosmos DB | Firestore | Flexible schema | | Cache | ElastiCache | Cache for Redis | Memorystore | Session, caching | | Data Warehouse | Redshift | Synapse | BigQuery | Analytics |

Infrastructure as Code

Terraform Best Practices

Project Structure:

infrastructure/
├── modules/
│   ├── networking/
│   ├── compute/
│   └── database/
├── environments/
│   ├── dev/
│   ├── staging/
│   └── prod/
├── main.tf
├── variables.tf
├── outputs.tf
└── versions.tf

State Management:

Use remote state (S3, Azure Blob, GCS)
Enable state locking (DynamoDB, Blob lease)
Separate state per environment
Never commit state files

Module Design:

Single responsibility per module
Expose minimal required variables
Document inputs/outputs
Version modules with git tags

Cost Optimization

Compute Savings:

Reserved Instances (1-3 year commitment): 30-60% savings
Spot/Preemptible instances: 60-90% savings for interruptible workloads
Right-sizing: Match instance size to actual usage
Auto-scaling: Scale down during low usage

Storage Savings:

Lifecycle policies: Auto-transition to cheaper tiers
Compression: Reduce storage footprint
Deduplication: Eliminate redundant data
Delete unused resources: Orphaned volumes, snapshots

Network Savings:

Use CDN for static content
Optimize data transfer paths
Use private endpoints
Compress API responses

High Availability Patterns

Multi-AZ Deployment

Deploy across 2-3 availability zones
Use load balancers for distribution
Database replication across AZs
Automatic failover configuration

Multi-Region Deployment

Active-active or active-passive
DNS-based routing (Route53, Traffic Manager)
Data replication strategy
Disaster recovery procedures

Resilience Patterns

Circuit breakers for external dependencies
Retry with exponential backoff
Bulkhead isolation
Graceful degradation

Security Best Practices

Identity & Access

Principle of least privilege
Use IAM roles, not long-term credentials
Enable MFA for privileged accounts
Regular access reviews

Network Security

VPC/VNet isolation
Security groups as firewalls
Private subnets for backend services
VPN/Direct Connect for hybrid

Data Protection

Encryption at rest (KMS)
Encryption in transit (TLS)
Key rotation policies
Backup and recovery testing

Monitoring & Observability

Key Metrics

CPU, Memory, Disk utilization
Network throughput and latency
Error rates and types
Cost per service/team

Alerting Strategy

Set thresholds based on baselines
Alert on symptoms, not causes
Runbooks for each alert
Escalation paths defined

Reference Files

references/terraform_patterns.md - IaC patterns and examples
references/cost_optimization.md - Detailed cost reduction strategies

Integration with Other Skills

security-engineering - For security architecture
network-engineering - For network design
performance - For optimization strategies
devops-runbooks - For operational procedures

Want to see if aiskillstore/cloud-infrastructure would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/21/2026, 19:48 UTC · 22 cases

Lift

+23%

41% vs 18%

Agent turns

1.0 vs 1.0

Tokens

+48%

3,189.95 vs 2,163.36

fail → pass · 5pass → pass · 4fail → fail · 13

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-02 We are configuring Terraform with an AWS S3 remote state backend. To prevent concurrent state updates, a team member suggested relying solely on S3 object versioning. How should state locking be properly configured for an AWS backend?	pass→pass	14,051	13,081	-7%	1	1	0%	2,433	3,383	+39%	0	0	—
case-03 Our development team wants to commit `terraform.tfstate` files directly to our git repository so everyone has instant access to the latest deployed state. What is the standard security and operational practice regarding state files in git?	pass→pass	12,556	14,399	+15%	1	1	0%	1,981	2,581	+30%	0	0	—
case-04 We currently run event-driven background processing jobs using AWS Lambda. We are expanding to Google Cloud Platform and need the matching GCP compute pattern for running short-lived event-driven code without managing servers. Which GCP service should we adopt?	fail→fail	12,113	5,857	-52%	1	1	0%	1,806	2,075	+15%	0	0	—
case-10 We are deploying an application across AWS us-east-1 and eu-west-1 for global disaster recovery and multi-region availability. How should client traffic be dynamically routed between regions based on health and location?	fail→fail	18,389	14,542	-21%	1	1	0%	3,043	3,306	+9%	0	0	—
case-01 I am setting up a Terraform project for our team's cloud deployment. To keep things simple and avoid extra files, I plan to put all dev, staging, and prod resource definitions directly into a single root `main.tf` file without subdirectories or custom modules. Provide a structured repository organization strategy for this IaC codebase.	fail→pass	16,133	16,014	-1%	1	1	0%	2,968	3,820	+29%	0	0	—
case-05 We are migrating a database server to Microsoft Azure. The database requires persistent block storage attached directly to the virtual machine for high IOPS database files. A colleague suggested using Azure Blob Storage. What Azure storage service should be selected for attached VM block storage?	fail→fail	8,348	8,207	-2%	1	1	0%	1,362	2,378	+75%	0	0	—
case-06 Our application requires a managed NoSQL document/key-value database with flexible schemas across AWS, Azure, and GCP. Which database service should be selected for each of the three cloud providers?	fail→fail	13,246	8,747	-34%	1	1	0%	1,697	2,344	+38%	0	0	—
case-07 We run large batch data processing jobs every night that take 3 hours and can safely resume from checkpoints if a worker node shuts down unexpectedly. To minimize costs, should we purchase 3-year Reserved Instances or use spot compute capabilities?	fail→fail	11,904	11,844	-1%	1	1	0%	1,888	3,023	+60%	0	0	—
case-08 Our monthly cloud storage bill on AWS has inflated significantly. A review showed many unattached EBS volumes and unneeded historical EBS snapshots remaining after test VMs were terminated. What specific storage cost reduction actions should be taken?	fail→pass	13,789	12,677	-8%	1	1	0%	2,242	3,123	+39%	0	0	—
case-09 We are deploying a critical database application on AWS and want to protect against single data center outages. A junior engineer suggested running a single database instance in one availability zone with nightly backups. What architecture strategy should be implemented for high availability?	fail→fail	14,145	11,940	-16%	1	1	0%	2,199	2,843	+29%	0	0	—
case-11 An application running on an EC2 instance needs to read and write objects in an S3 bucket. A developer suggested creating an IAM user with programmatic API keys and hardcoding the access key and secret key into the application's config file. What is the recommended IAM mechanism?	fail→pass	6,794	9,207	+36%	1	1	0%	1,099	2,819	+157%	0	0	—
case-12 We are designing an AWS VPC layout for a three-tier web application consisting of web servers, application backend microservices, and a relational database. Should the backend microservices and database instances be assigned public IP addresses in public subnets for easier administration?	fail→fail	12,921	11,092	-14%	1	1	0%	2,155	2,931	+36%	0	0	—
case-13 We must meet compliance requirements for protecting customer database records stored in cloud storage and transmitted over networks. What standard encryption mechanisms should be specified for data at rest and data in transit?	fail→fail	14,668	16,269	+11%	1	1	0%	2,472	3,889	+57%	0	0	—
case-14 Our SRE team receives hundreds of false-positive PagerDuty alerts every week because alerts trigger whenever CPU utilization briefly spikes above 70% on any single host. How should we overhaul our alerting strategy to focus on meaningful operational impact?	fail→fail	17,602	18,230	+4%	1	1	0%	2,613	3,951	+51%	0	0	—
case-15 When a third-party payment API experiences high latency or outages, our backend application threads freeze while waiting, causing cascading system crashes. What resiliency design patterns should be applied to protect our services?	fail→pass	15,553	15,394	-1%	1	1	0%	2,371	3,369	+42%	0	0	—
case-16 We need an in-memory caching layer to store session state and frequent query results in AWS and GCP to achieve sub-millisecond response times. Which managed caching services should be selected for each cloud?	fail→fail	11,069	12,821	+16%	1	1	0%	1,699	3,018	+78%	0	0	—
case-17 We store gigabytes of raw audit log files daily in cloud object storage for regulatory compliance. These logs are rarely accessed after 30 days but must be retained for 7 years. How can we minimize long-term storage costs?	fail→fail	16,359	13,520	-17%	1	1	0%	2,597	3,303	+27%	0	0	—
case-18 Multiple engineering teams import our central core networking Terraform module directly from the `main` branch of its git repository. Recently, an untested commit to `main` broke several dev deployments. How should Terraform module references be managed across teams?	pass→pass	12,944	14,652	+13%	1	1	0%	2,117	3,525	+67%	0	0	—
case-19 Our AWS bill shows high data transfer charges due to microservices in a private VPC calling internal backend endpoints over public IP addresses across the internet. What networking solution reduces these data transfer costs while keeping traffic private?	fail→pass	12,946	13,435	+4%	1	1	0%	2,220	3,333	+50%	0	0	—
case-20 Below is a Node.js Express route handler that runs a database query: `app.get('/user', (req, res) => { db.query('SELECT * FROM users WHERE id = ' + req.query.id); })`. Write the Terraform IaC code needed to fix the SQL injection vulnerability in this query string.	pass→pass	9,305	11,961	+29%	1	1	0%	1,786	3,425	+92%	0	0	—
case-21 We are installing physical Cisco Catalyst 9300 network switches in our physical datacenter server rack. Please provide the Terraform HCL resource definitions to flash the router firmware and configure physical BGP AS numbers on these hardware switches.	fail→fail	12,807	16,380	+28%	1	1	0%	2,231	3,934	+76%	0	0	—
case-22 Our production PostgreSQL database container is currently suffering from severe lock contention during a live incident. Provide step-by-step shell commands to inspect active pg_stat_activity locks and execute psql termination commands for blocking PIDs during this outage.	fail→fail	13,996	13,600	-3%	1	1	0%	2,615	3,806	+46%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +23 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 18.2%
Pass rate with the skill: 40.9%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/21/2026, 19:48 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

I am setting up a Terraform project for our team's cloud deployment. To keep things simple and avoid extra files, I plan to put all dev, staging, and prod resource definitions directly into a single root `main.tf` file without subdirectories or custom modules. Provide a structured repository organization strategy for this IaC codebase.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run41

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+55% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 7 days ago

Other measured skills in the registry, with their headline benchmark lift.