From vanguard-frontier-agentic
Audits AWS ACM Private CA issuer configurations for cert-manager, checking CA hierarchy, certificate templates, IRSA permissions, CRL reachability, and cross-account risks.
How this skill is triggered — by the user, by Claude, or both
Slash command
/vanguard-frontier-agentic:aws-private-ca-issuer-reviewThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Review AWS ACM Private Certificate Authority configurations used by the cert-manager `aws-privateca-issuer` plugin. Identify CA hierarchy misconfigurations, overly permissive certificate templates, excessive IRSA permissions, unsafe validity periods, CRL reachability gaps, and cross-account PCA setup risks.
Review AWS ACM Private Certificate Authority configurations used by the cert-manager aws-privateca-issuer plugin. Identify CA hierarchy misconfigurations, overly permissive certificate templates, excessive IRSA permissions, unsafe validity periods, CRL reachability gaps, and cross-account PCA setup risks.
AWSPCAIssuer referencing a ROOT CA ARN directly as CRITICAL — only a SUBORDINATE CA should be active for cert-manager issuance.spec.template.arn: flag any SubordinateCACertificate template as CRITICAL (allows cert-manager to mint sub-CAs). Correct template is EndEntityCertificate/V1.acm-pca:IssueCertificate, acm-pca:GetCertificate, acm-pca:DescribeCertificateAuthority. Flag acm-pca:DeleteCertificateAuthority or acm-pca:CreateCertificateAuthority as HIGH.spec.duration in Certificate resources; flag durations > 365d for workload certs as MEDIUM; best practice is <= 90d.Load these only when needed:
npx claudepluginhub raishin/vanguard-frontier-agentic --plugin vanguard-frontier-agenticReviews cert-manager PKI configuration for Kubernetes clusters: Issuer/ClusterIssuer scope, CertificateRequestPolicy coverage, certificate SAN/duration risks, trust-manager bundle distribution, and cloud CA auth methods.
Manages X.509 certificates for TLS, PKI, and mTLS. Automates ACME/Let's Encrypt renewal, monitors Certificate Transparency logs, and handles revocation.
Manage digital certificates for HTTPS, mutual TLS, code signing, and infrastructure security.