Platform strategy, segmentation, IAM design, and landing zone design skills
Define the core IAM groups and roles for the platform team itself — the groups that govern access to platform-owned sectors (e.g., Platform, Security). Produces a machine-readable IAM definition document covering `Role("operator")`, `Role("admin")`, `Role("contributor")`, and `Role("reader")` groups per (Sector, Tier) combination, with JIT escalation policies and Workload Identity requirements. Use before provisioning cloud IAM resources or configuring a JIT tool.
Define the resource naming pattern and mandatory tagging schema for the platform, derived from the Platform Notation. Produces a naming-convention.md document that all subsequent skills (landing zone, networking, compute, IaC modules) use as their authoritative source of truth for names and tags. Use after design-segmentation and before any provisioning skill.
Define a platform vision, strategy, and OKRs for an Internal Developer Platform. Use when starting a new platform initiative, aligning stakeholders on direction, or formalizing an existing platform's purpose. Produces a platform charter document with vision statement, strategic pillars, OKRs, capability priorities, and a Now/Next/Later roadmap outline.
Define the standard IAM groups and roles for a platform tenant — covering the groups that developers use to access their own workloads across all sectors and tiers (e.g., "payments-sandbox-contributors", "payments-readers"). Produces a tenant.yaml file (the platform's source of truth for membership) and an IAM group matrix. Use when onboarding a new tenant or formalizing an existing team's access model.
Design the Kubernetes cluster topology — cluster placement per coordinate, node pool strategy, multi-tenancy model, and ResourceQuota tier templates — from the Platform Coordinate System. Produces a compute-design.md document used as input for manage-k8s-namespaces and cluster provisioning IaC modules. Use after design-segmentation, design-networking, and define-naming-convention.
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Build and train AI agents to architect internal developer platforms. This repository contains reusable skills, commands, agents, and configurations for major AI platforms (Claude Code, GitHub Copilot, Cursor). Closely related to the Crafting Platforms book — but open to any platform engineering or AI best practice.
Instead of manually architecting your platform, teach an AI agent to do it. This repository provides pre-built, production-ready artifacts that guide AI through platform engineering tasks: designing segmentation strategies, scaffolding infrastructure, auditing security, automating CI/CD, and more.
Many artifacts here relate to chapters in Crafting Platforms, bridging human guidance (the book) and machine execution (the code). Others are grounded in platform engineering or AI best practices — the repository grows with the community.
By Ezequiel Foncubierta
A practical guide to building opinionated, made-to-measure internal developer platforms that fit your organization's unique DNA.
Platform craftsmanship, not platform manufacturing.
The book teaches humans the principles and patterns for building platforms. This repository teaches AI agents how to implement them. Together, they form a complete system: strategic guidance for people, executable instructions for machines.
| Chapter | Topic |
|---|---|
| 0 | Preface |
| 1 | Introduction |
| 2 | Internal Developer Platform |
| 3 | Platform Notation |
| 4 | Segmentation |
| 5 | Identity and Access Management |
| 6 | Infrastructure |
| 7 | CI/CD |
| 8 | Observability |
| 9 | Security and Compliance |
| 10 | Developer Experience |
Artifacts tied to book chapters will be added as the book is completed. Community contributions grounded in platform engineering best practices are also welcome.
Skills are distributed as Claude Code plugins, grouped by cloud provider and domain.
platform-designPlatform strategy, segmentation, IAM design, and landing zone design.
| Skill | Chapter | Status |
|---|---|---|
define-platform-vision | Chapter 2 | Published |
design-segmentation | Chapter 4 | Published |
define-core-iam | Chapter 5 | Published |
define-tenant-iam | Chapter 5 | Published |
design-landing-zone | Chapter 6 | Published |
define-naming-convention | Chapter 6 | Published |
design-networking | Chapter 6 | Published |
design-compute | Chapter 6 | Published |
awsAWS platform engineering — IAM, landing zones, and networking management.
| Skill | Chapter | Status |
|---|---|---|
manage-aws-iam | Chapter 5 | Published |
manage-aws-landing-zone | Chapter 6 | Published |
manage-aws-networking | Chapter 6 | Published |
azureAzure platform engineering — IAM, landing zones, and networking management.
| Skill | Chapter | Status |
|---|---|---|
manage-azure-iam | Chapter 5 | Published |
manage-azure-landing-zone | Chapter 6 | Published |
manage-azure-networking | Chapter 6 | Published |
gcpGCP platform engineering — IAM, landing zones, and networking management.
| Skill | Chapter | Status |
|---|---|---|
manage-gcp-iam | Chapter 5 | Published |
manage-gcp-landing-zone | Chapter 6 | Published |
manage-gcp-networking | Chapter 6 | Published |
kubernetesKubernetes platform engineering — IAM and namespace management.
npx claudepluginhub craftingplatforms/ai --plugin platform-designGCP platform engineering — IAM, landing zones, and networking management
AWS platform engineering — IAM, landing zones, and networking management
Kubernetes platform engineering — IAM and namespace management
Azure platform engineering — IAM, landing zones, and networking management
Research-backed, opinionated guidance for building cloud infrastructure that doesn't rot — multi-account governance, naming conventions, IaC organization, security, deployment pipelines, and operational hygiene, distilled from production experience across multiple cloud migrations
DevsForge cloud architecture specialist for AWS, Azure, GCP multi-cloud solutions and optimization.
Cloud and infrastructure security including cloud posture assessment, network segmentation, container security, Kubernetes hardening, IAM policy design, and zero-trust architecture.
Practical guidance for platform engineers across Claude, Codex, Cursor, and Copilot: Kubernetes, Kyverno, Helm, Terraform, Flux CD (Flux Operator, FluxInstance, gitless OCI delivery, cluster debug, repo audit), Argo CD, GitHub Actions (composite actions, SHA pinning, OIDC, 11 production examples), AWS (CloudFront, WAF, Lambda@Edge, IAM, IRSA), Azure (AKS workload identity), GKE (Workload Identity Federation), Linkerd, Linux, networking, MCP development, observability, SOC 2 compliance, PR review, PR triage, KEDA autoscaling, Karpenter node autoscaling, supply chain security (Cosign, SBOM, SLSA), Falco runtime security, Chaos Engineering, DORA Metrics, LLM Observability (Datadog LLMObs), and animated docs. Every answer includes blast radius, validation steps, and rollback plan.
Security engineer — IAM, secrets, compliance, threat modeling
Platform engineering agents providing expertise in developer platforms, IaC, and tooling