feat: add acm-certificate-ops-review skill

llms.txt

@@ -23,13 +23,13 @@ Skills can be used with these AWS DevOps Agent types:
 - [Enrich with AWS Security Agent Skill](skills/enrich-with-aws-security-agent/SKILL.md): Queries AWS Security Agent CloudWatch logs to retrieve code-level security findings (file, line number, vulnerability type) during incident investigations with potential security root causes
 - [Wiz Security Context Skill](skills/wiz-security-context/SKILL.md): Queries the Wiz MCP server for a resource's security context (vulnerabilities, misconfigurations, secrets, active threats, malware, toxic combinations) to determine whether an operational anomaly is an operational issue or a security incident
 - [Service Quota Check Skill](skills/service-quota-check/SKILL.md): Checks AWS service quota utilization during investigations and before provisioning resources, flags quotas at 85%+ utilization, and requests increases via the Service Quotas API or recommends support cases
+- [ACM Certificate Ops Review Skill](skills/acm-certificate-ops-review/SKILL.md): Performs comprehensive ACM and ACM Private CA certificate health reviews covering expiry, failed renewals, validation failures, imported certificates, weak key algorithms, missing monitoring, Private CA issues, and CA/Browser Forum validity reduction readiness
 - [DMS Operational Review Skill](skills/database-migration-service-expertise/SKILL.md): Conducts AWS Database Migration Service operational reviews with 5-category health scoring, task failure troubleshooting, migration cutover runbooks, version deprecation tracking, and cost optimization
 - [Redshift Support Specialist Skill](skills/redshift-support-specialist/SKILL.md): Amazon Redshift domain expertise for query optimization, operational reviews, and cost optimization on provisioned clusters and Serverless workgroups, via the awslabs.redshift-mcp-server MCP server
 - [S3 Resiliency Review Skill](skills/storage-s3-resiliency-expertise/SKILL.md): Reviews one or many S3 buckets across nine resiliency, security, and data-protection dimensions using read-only control-plane calls, producing a rated report with prioritized findings and remediation guidance
 - [VPC DNS Investigation Skill](skills/aws-vpc-dns-investigation/SKILL.md): Diagnoses VPC DNS resolution failures and validates DNS control-plane changes before they are applied, driving the aws-vpc-dns-diagnostics MCP server to observe live resolution from inside the affected subnet and to simulate a proposed change
 - [Bedrock Adoption Readiness Skill](skills/bedrock-adoption-readiness/SKILL.md): Assesses an AWS account's readiness to run Amazon Bedrock at production scale across IAM governance, data retention (ZDR), quota and capacity headroom, and operational observability, covering both the standard Bedrock and bedrock-mantle (OpenAI-compatible) surfaces with multi-region discovery
 - [Analytics OpenSearch Expertise Skill](skills/analytics-opensearch-expertise/SKILL.md): Performs read-only health assessments of Amazon OpenSearch Service domains through 24 deterministic checks across cluster health, storage and shards, performance, security, and cost optimization, producing a structured findings report with prioritized remediation guidance
-
 ## Key Concepts
 
 - AWS DevOps Agent skills are structured instruction sets that teach the agent how to investigate specific operational scenarios

skills/acm-certificate-ops-review/.skilleval.yaml

@@ -0,0 +1,3 @@
+audit:
+  ignore:
+    - STR-016    # README alongside SKILL.md is intentional

skills/acm-certificate-ops-review/CHANGELOG.md

@@ -0,0 +1,20 @@
+# Changelog
+
+All notable changes to the `acm-certificate-ops-review` skill are documented
+in this file. The format is based on Keep a Changelog, and this project follows
+semantic versioning.
+
+## [1.0.0] - 2026-07-12
+
+Authors: Tejas Majamudar (majamuda), Manoj Gaddam (vmgaddam)
+
+### Added
+- Initial release of the ACM Certificate Operations Review skill.
+- Phase 1 operational investigation runbook: certificate inventory across
+  accounts/regions, issue detection (expiry, renewal health, validation
+  failures, imported-in-use, weak keys, unused certs, missing DaysToExpiry
+  monitoring, stale endpoints, ACM Private CA), risk classification, and a
+  prioritized findings report.
+- Reference files: `acm-thresholds.md`, `report-format.md`, and
+  `cab-forum-readiness.md` (Phase 2 CA/Browser Forum readiness).
+- Read-only IAM permission set documented in the README.

skills/acm-certificate-ops-review/README.md

@@ -0,0 +1,111 @@
+# ACM Certificate Operations Review
+
+## Purpose
+
+This skill gives AWS DevOps Agent a repeatable procedure for investigating and
+reviewing AWS Certificate Manager (ACM) and ACM Private CA certificate health
+across one or more accounts and regions. Certificate expiry is a leading cause
+of avoidable customer-facing outages, and the CA/Browser Forum is progressively
+shortening TLS certificate validity (398 to 47 days by March 2029), which makes
+manual certificate management increasingly risky. The skill helps the agent
+catch expiring, failing, and mismanaged certificates before they cause an
+incident, and prepare a strategic readiness view for the shorter validity
+windows.
+
+## Key Capabilities
+
+- Inventories ACM and ACM Private CA certificates across accounts and regions
+  (always including us-east-1 for CloudFront).
+- Detects expiring/expired certificates, failed or stuck managed renewals,
+  `PENDING_VALIDATION` and DNS/email validation failures, imported in-use
+  certificates that cannot auto-renew, weak/legacy key algorithms, unused
+  certificates, and missing CloudWatch `DaysToExpiry` monitoring.
+- Flags ACM Private CA problems (disabled, expired, or nearing expiry).
+- Classifies findings by risk (RED / AMBER / GREEN) and produces a prioritized
+  findings report with an executive summary and remediation list.
+- Optionally assesses CA/Browser Forum validity-reduction readiness, DV vs
+  OV/EV strategy, renewal automation options, and cost impact.
+
+## Prerequisites
+
+The skill is read-only. The DevOps Agent role for your Agent Space needs:
+
+- `acm:ListCertificates`
+- `acm:DescribeCertificate`
+- `acm-pca:ListCertificateAuthorities`
+- `acm-pca:DescribeCertificateAuthority`
+- `cloudwatch:DescribeAlarmsForMetric`
+- `organizations:ListAccounts` (only for org-wide scans, from the management or
+  delegated administrator account)
+
+Most of these may already be covered by the `AIDevOpsAgentAccessPolicy` managed
+policy attached to the DevOps Agent role; add any that are missing.
+
+## Limitations
+
+- Read-only: the skill inventories and assesses certificates but never creates,
+  imports, deletes, or renews them.
+- Public trust and validity-reduction dates change over time; the skill directs
+  the agent to confirm current CA/Browser Forum and ACM figures against
+  authoritative sources before quoting them.
+- GovCloud and China partitions are scanned only on explicit request and are
+  reported separately from commercial-partition findings.
+- Cost figures must be computed from current pricing at run time; the skill does
+  not embed pricing.
+- This is sample code (see disclaimer below).
+
+## Agent Types
+
+- **Chat tasks** - posture reviews and reports (for example "review the ACM
+  certificate posture for account 1111...").
+- **Incident RCA** and **Incident Triage** - certificate-related incidents (for
+  example "investigate why example.com is serving an expired certificate").
+
+Select these agent types when uploading the skill to your Agent Space.
+
+## Uploading to AWS DevOps Agent
+
+From the repository root, zip the skill (allowed extensions only, excluding
+non-skill files) and upload it to your Agent Space, selecting the agent types
+listed above:
+
+```bash
+cd skills
+zip -r acm-certificate-ops-review.zip acm-certificate-ops-review/ \
+  -i '*.md' '*.txt' '*.json' '*.yaml' '*.yml' '*.xml' '*.csv' '*.tsv' '*.html' '*.htm' '*.png' '*.jpg' '*.jpeg' '*.gif' '*.svg' '*.webp' '*.pdf' \
+  -x '*/.claude/*' '*/scripts/*' '*/README.md' '*/.skilleval.yaml' '*/.skilleval.yml' '*/CHANGELOG.md' '*/evals/*'
+```
+
+Then, in the Agent Space Operator Web App, go to Knowledge > Skills > upload the
+zip, and grant the role the IAM permissions listed under Prerequisites if they
+are not already present.
+
+## How to Use This Skill
+
+Operators do not need to name the skill; it activates from the description.
+Sample prompts:
+
+**Chat tasks**
+- "Review the ACM certificate posture for account 111122223333."
+- "Which certificates across my org expire in the next 30 days?"
+- "Are we ready for the CA/Browser Forum certificate validity reductions?"
+- "Do any of my in-use certificates lack an expiry alarm?"
+
+**Incident RCA / Incident Triage**
+- "Investigate why www.example.com is serving an expired certificate."
+- "A managed renewal failed for api.example.com; find the root cause."
+- "An endpoint is still presenting the old certificate after renewal."
+
+## Disclaimer
+
+This skill is **sample code**. It is **not intended for production use without
+additional review and testing**. Validate it in a **non-production
+environment** first, review the IAM permissions and behavior against your
+organization's security policies, and confirm the findings against your live
+environment before acting on them. Certificate validity dates and CA/Browser
+Forum timelines change over time - verify current values against the
+authoritative AWS and CA/Browser Forum sources before relying on them.
+
+## License
+
+Apache-2.0. See the repository `LICENSE` file.