Add aws-backup-coverage-review skill

cloudformation/devops-agent-skill-policies.yaml

@@ -27,6 +27,7 @@ Metadata:
           - EnableMskOperations
           - EnableServiceQuotaCheck
           - EnableDmsOperationReview
+          - EnableAwsBackupCoverageReview
           - EnableAgentCoreObservabilitySetup
       - Label:
           default: Optional Resource Scoping
@@ -112,6 +113,14 @@ Parameters:
     AllowedValues: ['true', 'false']
     Default: 'true'
 
+  EnableAwsBackupCoverageReview:
+    Type: String
+    Description: >
+      AWS Backup Coverage Review skill (adds backup:GetSupportedResourceTypes,
+      config:SelectResourceConfig, dsql:ListClusters, storagegateway:List*).
+    AllowedValues: ['true', 'false']
+    Default: 'true'
+
   EnableAgentCoreObservabilitySetup:
     Type: String
     Description: AgentCore Observability Setup skill (adds read-only bedrock-agentcore, X-Ray, log-delivery, and Lambda/ECS/EKS host-config permissions).
@@ -127,6 +136,7 @@ Conditions:
   SkillMskOperations: !Equals [!Ref EnableMskOperations, 'true']
   SkillServiceQuotaCheck: !Equals [!Ref EnableServiceQuotaCheck, 'true']
   SkillDmsOperationReview: !Equals [!Ref EnableDmsOperationReview, 'true']
+  SkillAwsBackupCoverageReview: !Equals [!Ref EnableAwsBackupCoverageReview, 'true']
   SkillAgentCoreObservabilitySetup: !Equals [!Ref EnableAgentCoreObservabilitySetup, 'true']
   HasRegionRestriction: !Not [!Equals [!Join ['', !Ref AllowedRegions], '']]
 
@@ -310,6 +320,39 @@ Resources:
               - dms:TestConnection
             Resource: '*'
 
+  # aws-backup-coverage-review: only the read actions NOT already granted by
+  # AIDevOpsAgentAccessPolicy. Verified with iam:SimulatePrincipalPolicy against a
+  # live agent role — 45 of the 52 actions the skill uses are already allowed by
+  # the managed policy, including every backup:List*/Describe* call. Strictly
+  # read-only; no Start*, Put*, Create*, Update*, or Delete* is granted, and the
+  # managed policy already implicitly denies backup:StartBackupJob and
+  # backup:DeleteRecoveryPoint.
+  # sts:GetCallerIdentity is intentionally omitted: it requires no IAM permission.
+  PolicyAwsBackupCoverageReview:
+    Type: AWS::IAM::Policy
+    Condition: SkillAwsBackupCoverageReview
+    Properties:
+      PolicyName: DevOpsAgentSkill-AwsBackupCoverageReview
+      Roles:
+        - !If [CreateNewRole, !Ref DevOpsAgentRole, !Ref ExistingRoleName]
+      PolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Sid: BackupCoverageReviewDelta
+            Effect: Allow
+            Action:
+              # Not covered by backup:List*/backup:Describe* in the managed policy
+              - backup:GetSupportedResourceTypes
+              # Managed policy grants SelectAggregateResourceConfig but not the
+              # single-account variant the skill uses when no aggregator exists
+              - config:SelectResourceConfig
+              # Resource types with no inventory read in the managed policy
+              - dsql:ListClusters
+              - storagegateway:ListFileShares
+              - storagegateway:ListGateways
+              - storagegateway:ListVolumes
+            Resource: '*'
+
   # agentcore-observability-setup: adds read-only AgentCore control-plane, X-Ray Transaction Search,
   # log-delivery/resource-policy describes, and Lambda/ECS/EKS host-config reads (Tier 2 + Tier 3).
   # Tier 1 (CloudWatch Logs/Metrics telemetry-arrival reads) is covered by AIDevOpsAgentAccessPolicy.
@@ -395,6 +438,7 @@ Outputs:
         - msk-operations: ${EnableMskOperations} (kafka:GetBootstrapBrokers)
         - service-quota-check: ${EnableServiceQuotaCheck} (servicequotas:*, cloudwatch:GetMetricData/GetMetricStatistics)
         - database-migration-service-expertise: ${EnableDmsOperationReview} (dms:TestConnection)
+        - aws-backup-coverage-review: ${EnableAwsBackupCoverageReview} (backup:GetSupportedResourceTypes, config:SelectResourceConfig, dsql:ListClusters, storagegateway:List*)
         - agentcore-observability-setup: ${EnableAgentCoreObservabilitySetup} (bedrock-agentcore:Get/ListAgentRuntime, xray:GetTraceSegmentDestination, logs:DescribeDeliveries/DeliverySources/DeliveryDestinations/ResourcePolicies, lambda:GetFunctionConfiguration, ecs:DescribeTaskDefinition/DescribeServices/ListTasks, eks:DescribeCluster)
       Skills covered by AIDevOpsAgentAccessPolicy (no extra policy needed):
         - eks-operation-review, enrich-with-aws-security-agent, crm-production-investigation-guidelines

llms.txt

@@ -32,6 +32,7 @@ Skills can be used with these AWS DevOps Agent types:
 - [Analytics OpenSearch Expertise Skill](skills/analytics-opensearch-expertise/SKILL.md): Performs read-only health assessments of Amazon OpenSearch Service domains through 24 deterministic checks across cluster health, storage and shards, performance, security, and cost optimization, producing a structured findings report with prioritized remediation guidance
 - [AI/ML Access Diagnostics Skill](skills/aiml-access-diagnostics/SKILL.md): Diagnoses IAM and access failures for Amazon Bedrock and SageMaker calls by tracing the authorization chain from caller identity through iam:PassRole, role trust policy, role permissions, resource policies, and SCPs to identify which hop denied the call
 - [AgentCore Observability Setup Skill](skills/agentcore-observability-setup/SKILL.md): Validates and bootstraps Amazon Bedrock AgentCore observability across runtime agents, Memory and Gateway resources, built-in tools, and agents hosted outside the runtime, verifying telemetry wiring via read-only CloudWatch, X-Ray, and AgentCore APIs and prescribing exact remediation for gaps it cannot directly read
+- [AWS Backup Coverage Review Skill](skills/aws-backup-coverage-review/SKILL.md): Determines which backup-eligible resources are protected by AWS Backup and which are not across all enabled Regions, using read-only APIs and an independent resource inventory, then evaluates plan frequency and retention, cross-Region and cross-account copies, vault encryption and Vault Lock, and per-Region resource type opt-in through 23 fixed checks
 
 ## Key Concepts
 

skills/aws-backup-coverage-review/.skilleval.yaml

@@ -0,0 +1,3 @@
+audit:
+  ignore:
+    - STR-016    # README alongside SKILL.md is intentional