|
| 1 | +# Changelog |
| 2 | + |
| 3 | +All notable changes to this skill are documented here. New entries go at the top. |
| 4 | + |
| 5 | +## [1.0.0] - 2026-09-01 |
| 6 | + |
| 7 | +Initial release for AWS DevOps Agent. |
| 8 | + |
| 9 | +### Review scope |
| 10 | +- Read-only SLA-readiness and availability review of Amazon FSx for Windows File |
| 11 | + Server file systems across seven dimensions: deployment type (Single-AZ vs |
| 12 | + Multi-AZ), Active Directory health, throughput capacity sizing, storage capacity |
| 13 | + headroom, backups, maintenance window, and CloudWatch alarm coverage. |
| 14 | +- **SLA Readiness rating** (High / Medium / Low / Indeterminate) with per-dimension |
| 15 | + findings and remediation, grounded in AWS documentation thresholds (the 20% |
| 16 | + free-storage guidance, the read + 2 × write throughput sizing formula, the Multi-AZ |
| 17 | + recommendation from Security Hub control FSx.5, and the Misconfigured / Active |
| 18 | + Directory reachability model). Rating precedence: any Critical → Low; else any |
| 19 | + Warning or unverifiable dimension → Medium; else High. |
| 20 | +- Automatic single-file-system vs multi-file-system (fleet) routing by input count, |
| 21 | + including batched review with manifest tracking and resume for 21+ file systems. |
| 22 | + |
| 23 | +### Active Directory / Misconfigured handling |
| 24 | +- `MISCONFIGURED` lifecycle is a 🔴 Critical availability finding (AD unreachable). |
| 25 | +- Targeted AD root-cause matching: the finding matches the reported failure detail |
| 26 | + against known lifecycle codes and quotes a specific fix — |
| 27 | + `ACTIVE_DIRECTORY_INVALID_CREDENTIALS` (rotated/expired service-account password, |
| 28 | + plus the Protected Users / NTLM caveat), |
| 29 | + `ACTIVE_DIRECTORY_INSUFFICIENT_PERMISSIONS` (OU delegation), and |
| 30 | + `ACTIVE_DIRECTORY_COMP_ACC_REUSE_BLOCKED_BY_POLICY` (KB5020276 netjoin hardening → |
| 31 | + "Allow computer account re-use" GPO). |
| 32 | +- `MISCONFIGURED_UNAVAILABLE` (quarantined) recognized as the most severe AD state — |
| 33 | + data currently inaccessible after prolonged AD failure. |
| 34 | +- Names the read-only `AWSSupport-ValidateFSxWindowsADConfig` runbook as a follow-up |
| 35 | + diagnostic (never executes it). |
| 36 | + |
| 37 | +### Trend / usage-pattern analysis |
| 38 | +- Usage-pattern (trend) analysis on the throughput and storage dimensions, built on |
| 39 | + daily-aggregate CloudWatch metrics (`Period=86400`) over a configurable lookback |
| 40 | + (default 30 days; 14 / 21 / 30 / 60 accepted). |
| 41 | +- **Peak-aware throughput sizing:** evaluates provisioned capacity against measured |
| 42 | + **peak** demand (read + 2 × write at the highest 5-minute interval average), not |
| 43 | + just the window average, catching short demand peaks that a daily average hides. |
| 44 | + Peak figures are labeled approximate and use the FSx byte metrics' supported |
| 45 | + `Sum` statistic. |
| 46 | +- **Weekday/weekend usage profile** classification, used as evidence for the |
| 47 | + throughput cost note. |
| 48 | +- **Storage growth projection** to the 20%-full floor; a projection of ≤ 4 weeks is |
| 49 | + surfaced as at least a Warning even when current free % is healthy. |
| 50 | +- New file systems (< ~14 days of history) report `insufficient-data` and skip |
| 51 | + projections rather than extrapolating. |
| 52 | + |
| 53 | +### Cost optimization (advisory; never lowers the SLA rating) |
| 54 | +- Heavily over-provisioned throughput or storage flagged as 💰 right-sizing |
| 55 | + opportunities. |
| 56 | +- **Idle-file-system** signal (near-zero data I/O and operations across the window) — |
| 57 | + the strongest cost signal, surfaced first as a decommission candidate; supersedes |
| 58 | + the over-provisioned-throughput note. |
| 59 | +- Throughput cost note carries a caveat when the recommended tier is at or below |
| 60 | + 32 MBps: FSx emits throughput-utilization metrics only at ≥ 32 MBps, so the 8/16 |
| 61 | + MBps tiers cannot be validated from CloudWatch and require customer-side observation. |
| 62 | + |
| 63 | +### Availability nuances |
| 64 | +- **Multi-AZ client-side failover caveat:** Linux/macOS clients and DNS-caching |
| 65 | + runtimes (.NET on Linux, Lambda) do not auto-fail-over like Windows SMB clients; |
| 66 | + third-party DNS (e.g. Infoblox) needs two A records (one per file-system IP); a |
| 67 | + throughput-capacity update is a safe way to test failover. |
| 68 | +- **Single-AZ maintenance wording** is honest that the AWS "typically under ~20 |
| 69 | + minutes" figure is best-effort, not a guarantee; the whole window is treated as |
| 70 | + potentially unavailable. |
| 71 | +- **Storage-optimization sequencing:** a storage increase triggers a background |
| 72 | + optimization phase that can pin `FileServerDiskThroughputUtilization` near 100%, so |
| 73 | + throughput should be raised before storage (notes the 4-modifications-per-24h |
| 74 | + limit); an in-progress `STORAGE_OPTIMIZATION` action is surfaced as an ℹ️ info note |
| 75 | + so elevated throughput metrics are read as transient. |
| 76 | + |
| 77 | +### Safety & operations |
| 78 | +- Self-contained data collection via read-only control-plane API calls and CloudWatch |
| 79 | + metric reads (`use_aws`); no AWS profile or credentials requested from the user. The |
| 80 | + skill never reads file/share data over SMB and never performs a write, update, |
| 81 | + create, or delete. |
| 82 | +- Fully covered by the `AIDevOpsAgentAccessPolicy` managed policy — no additional IAM. |
| 83 | +- Pre-flight permissions/tooling handling reports unverifiable checks instead of |
| 84 | + inferring configuration, capping the rating at Medium. |
| 85 | +- Deployment-type remediation correctly states Single-AZ cannot be converted to |
| 86 | + Multi-AZ in place (create-new-and-migrate). |
| 87 | +- Final Delivery Contract: the report is emitted as a persisted artifact (when the |
| 88 | + runtime supports it) and returned verbatim, preventing the host agent from |
| 89 | + summarizing or reformatting it. |
| 90 | +- README documents out-of-scope FSx for Windows support themes (shadow copies/VSS, SMB |
| 91 | + over WAN, file-search indexing, NTFS/SYSTEM ACLs, GPOs not applying to FSx nodes, |
| 92 | + anti-malware) so the skill does not over-promise. |
| 93 | + |
| 94 | +### Notes |
| 95 | +- The frontmatter description uses the repository's standard plain multiline YAML |
| 96 | + style and remains within the AWS DevOps Agent 1024-character limit. |
0 commit comments