wa-guardrails
Generate preventive Well-Architected guardrails — AWS Config rules, Service Control Policies, permission boundaries, CloudWatch alarms, and IaC policy checks (CDK Aspects, cfn-guard, OPA/Sentinel) — plus an optional governance steering doc, so a workload stays aligned with Well-Architected best practices over time instead of being assessed once. Use when the user wants to enforce best practices in CI, prevent insecure or non-compliant configurations from shipping, detect configuration drift, codify the fixes from a Well-Architected review as ongoing controls, or capture standards as an always-
Profile →npx skills add aws-samples/sample-well-architected-skills-and-steering --skill wa-guardrails --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Well-Architected Guardrails This skill generates **preventive and detective controls** that keep a workload Well-Architected over time. Unlike the assessment skills (which find gaps) or remediation (which fixes a specific finding once), guardrails codify best practices so non-compliant changes are blocked or flagged automatically — in CI, at deploy time, and continuously in the account. **What you'll produce:** ready-to-commit control files (Config rules, SCPs, CI policy checks, alarms), each tied to the WA Question/Best Practice ID it enforces, with a note on whether the control is **preventive** (blocks the bad change) or **detective** (flags it after the fact). ## Step 1: Gather context Ask the user (skip any already provided or inferable from the codebase): > I can generate guardrails to keep your workload Well-Architected. Let me know: > - **Workload name** and code packages/directories (IaC, CI/CD configs) > - **IaC dialect**: CDK (which language), CloudFormation, Terraform, SAM, or mixed > - **Source of controls**: a prior `/wa-review` or assessment output, specific concerns, or "scan and propose" > - **Enforcement points available**: CI pipeline (which one), AWS Organizat
- Step 1: Gather context
- Step 2: Discovery — what to enforce
- Step 3: Select preventive vs. detective for each control
- Step 4: Generate the controls
- Step 5: Produce the guardrails plan
- Step 6: Offer a governance steering doc
- Step 7: Offer follow-up
- Calibration Guidance
What does the wa-guardrails skill do?
Generate preventive Well-Architected guardrails — AWS Config rules, Service Control Policies, permission boundaries, CloudWatch alarms, and IaC policy checks (CDK Aspects, cfn-guard, OPA/Sentinel) — plus an optional governance steering doc, so a workload stays aligned with Well-Architected best practices over time instead of being assessed once. Use when the user wants to enforce best practices in CI, prevent insecure or non-compliant configurations from shipping, detect configuration drift, codify the fixes from a Well-Architected review as ongoing controls, or capture standards as an always-
How do I install it?
Run `npx skills add aws-samples/sample-well-architected-skills-and-steering --skill wa-guardrails --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From aws-samples/sample-well-architected-skills-and-steering, a repository with 233 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.