AWS follow-up to the GCP-first enterprise hardening plan. Managed Postgres+pgvector (RDS ≥PG15.2, IAM auth, optional RDS Proxy), AWS Secrets Manager backend, single-instance compute (ECS Fargate desired=1 / App Runner), ALB+Cognito identity-aware edge (MCP server still does per-tool authz + audit), CloudWatch→SIEM. Ships a deploying-agent-brain-aws skill. Prereq: GCP phases 1–5 (secrets abstraction + Postgres SSL/IAM + MCP authn/authz + Dockerfile).
Follow-up from design doc docs/plans/2026-06-09-enterprise-hardening-and-cloud-deployment.md (enterprise hardening, GCP-first).
Local TODO: .planning/todos/pending/2026-06-09-enterprise-aws-reference-deployment-and-skill.md
AWS follow-up to the GCP-first enterprise hardening plan. Managed Postgres+pgvector (RDS ≥PG15.2, IAM auth, optional RDS Proxy), AWS Secrets Manager backend, single-instance compute (ECS Fargate desired=1 / App Runner), ALB+Cognito identity-aware edge (MCP server still does per-tool authz + audit), CloudWatch→SIEM. Ships a
deploying-agent-brain-awsskill. Prereq: GCP phases 1–5 (secrets abstraction + Postgres SSL/IAM + MCP authn/authz + Dockerfile).Follow-up from design doc
docs/plans/2026-06-09-enterprise-hardening-and-cloud-deployment.md(enterprise hardening, GCP-first).Local TODO:
.planning/todos/pending/2026-06-09-enterprise-aws-reference-deployment-and-skill.md