feature: add drift-detection custom agent and baseline skill

.gitignore

@@ -30,3 +30,6 @@ docs/custom-agents/*.md
 
 # Holmes
 .holmesignore
+
+# Kiro settings (may contain tokens)
+.kiro/settings/

custom-agents/drift-detection/CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+## 1.0.0
+
+- Initial version
+- System prompt with Goal/Approach/Constraints/Output structure
+- Uses `drift-detection-baseline` skill for expected state definitions
+- Requires `use_aws` tool for read-only resource inspection
+- Covers security posture, compliance, and lifecycle drift categories
+- Produces drift detection report artifact with findings table
+- Creates recommendations in improvements backlog for each deviation
+- Includes AWS Config rule coverage gap analysis

custom-agents/drift-detection/README.md

@@ -0,0 +1,78 @@
+# Drift Detection — Custom Agent
+
+## Purpose
+
+This custom agent performs production drift detection — comparing the current state of AWS resources against a defined baseline of expected standards. It identifies security posture drift (encryption, network isolation, public access), compliance drift (tagging, logging, backups), and lifecycle drift (deprecated runtimes, end-of-life engine versions). Findings are reported as a structured artifact and tracked as recommendations in the improvements backlog.
+
+Unlike a general best-practices review, this agent performs **true drift detection**: it loads a defined expected state, discovers what actually exists, and reports the delta. This makes it suitable for recurring scheduled runs where the goal is to catch configuration changes that deviate from your team's standards.
+
+## Key Capabilities
+
+- Compares current resource configurations against defined baseline policies
+- Detects security posture drift: encryption, network isolation, public access, exposed secrets
+- Detects compliance drift: missing tags, disabled logging, insufficient backups
+- Detects lifecycle drift: deprecated Lambda runtimes, end-of-support RDS engines, outdated EKS versions
+- Identifies AWS Config rule coverage gaps and suggests rules to codify enforcement
+- Produces a persisted drift detection report artifact
+- Creates or updates recommendations in the improvements backlog for each finding
+- Deduplicates findings across runs to keep the backlog clean
+
+## Prerequisites
+
+- An AWS DevOps Agent space
+- IAM permissions for read-only resource inspection (covered by `AIDevOpsAgentAccessPolicy`):
+  - S3, RDS, EC2, Lambda, EKS, DynamoDB, CloudTrail, AWS Config, Resource Groups Tagging API
+- The [drift-detection-baseline skill](../../skills/drift-detection-baseline/) uploaded to your Agent Space. Important note: for the skill to be used by the custom agent, choose "All agents" in the "Agent Type" field when importing the skill, even though the skill's README instructs to choose specific agent types
+
+## Creating the Agent
+
+1. In the DevOps Agent web app, go to the "Agents" menu (on the bottom left pane)
+2. Click "Create agent" (on the right side), then on the new menu that popped up, click "Form" (the left-most option)
+3. In the "Name" field, use "drift-detection"
+4. Copy the content of the "SYSTEM_PROMPT.md" file from this directory, and paste it into the "System prompt" field in the custom agent creation form
+5. In the "Skills" drop-down list, select the "drift-detection-baseline" skill, and click "Create agent"
+6. Now we need to add the `use_aws` tool — in the new custom agent's window, click "Edit"
+7. In the new popped up window, select "Chat". A new chat will start on the left side. Wait for DevOps Agent to finish thinking, and it'll ask you what would you like to change
+8. Type "Add the use_aws tool to this custom agent". Once the chat is finished, verify in the custom agent's page that `use_aws` is shown under "Tools" for this custom agent
+
+## Executing the Agent
+
+### First Run (Recommended: On-Demand)
+
+For the first run, execute the agent on-demand to review findings, tune the baseline, and confirm recommendations are routed correctly:
+
+1. Navigate to the custom agent's page and click "Run"
+2. Optionally provide a custom prompt to scope the review (see examples below)
+3. Review the drift detection report artifact and recommendations
+
+### Scheduled Execution (After Tuning)
+
+After confirming the output is useful and low-noise, configure the agent to run on a schedule:
+
+- **Daily** — before business hours, for production accounts with active deployments
+- **Weekly** — before operational reviews, for stable environments
+
+Follow the [Executing custom agents guide](https://docs.aws.amazon.com/devopsagent/latest/userguide/custom-agents-executing-custom-agents.html) for schedule configuration.
+
+### Custom Prompts
+
+You can scope the review with custom prompts:
+
+- "Focus only on S3 buckets and RDS instances"
+- "Check only resources tagged with Environment: production"
+- "Only report critical and high severity findings"
+- "Focus on the us-east-1 region only"
+- "Check for lifecycle drift only — deprecated runtimes and engines"
+
+## Output
+
+The agent produces:
+
+- **Drift Detection Report** — a Markdown artifact summarizing all resources scanned, deviations found, and Config rule coverage gaps
+- **Recommendations** — individual improvement items in the backlog for each drift finding, with severity, resource ARN, current vs. expected state, and remediation steps
+
+## Related
+
+- [drift-detection-baseline skill](../../skills/drift-detection-baseline/) — the baseline policies this agent evaluates against
+- [Blog post: Build bespoke operational workflows with AWS DevOps Agent custom SRE agents](https://aws.amazon.com/blogs/devops/build-bespoke-operational-workflows-with-aws-devops-agent-custom-sre-agents/)
+- [AWS DevOps Agent custom agents documentation](https://docs.aws.amazon.com/devopsagent/latest/userguide/working-with-devops-agent-custom-agents-index.html)

custom-agents/drift-detection/SYSTEM_PROMPT.md

@@ -0,0 +1,45 @@
+You are a drift detection agent specializing in identifying deviations between current production infrastructure state and defined operational standards.
+
+## Goal
+
+Review provisioned AWS resources in the production environment for drift from defined standards and best practices. Create recommendations for any deviations found, and identify opportunities to codify standards as AWS Config rules for automated enforcement.
+
+## Approach
+
+1. Load the `drift-detection-baseline` skill to understand the expected production state for security posture, compliance, and lifecycle standards.
+2. Load the `understanding-agent-space` skill to understand what resources exist in the production environment.
+3. Identify resources that should be checked against the baseline policies (e.g., S3 buckets, RDS instances, Lambda functions, EC2 instances, security groups, DynamoDB tables).
+4. Use `use_aws` to make read-only API calls and inspect the actual configuration state of each relevant resource, using the specific verification methods defined in the baseline skill.
+5. Compare each resource's current configuration against the defined expected state in the baseline.
+6. For each deviation found, classify severity using the baseline skill's severity framework and create a recommendation in the improvements backlog.
+7. Use `use_aws` to list existing AWS Config rules and their configurations.
+8. Compare the defined policies from `drift-detection-baseline` against existing Config rules to identify coverage gaps — standards that could be enforced via AWS Config but are not currently.
+
+## Constraints
+
+- Read-only access to infrastructure — do not make changes directly.
+- Only flag deviations that clearly violate the defined baseline policies.
+- Focus on provisioned resources, not code or deployment pipelines.
+- Use the severity classification from the baseline skill consistently.
+- If a resource cannot be found or accessed, report the access issue clearly rather than skipping silently.
+
+## Output
+
+Produce a single artifact titled "Drift Detection Report — [date]" containing:
+
+- A summary of resources scanned, organized by resource type, and total deviations found
+- A table listing each drift item: resource ARN, policy violated, current state vs. expected state, severity, and suggested remediation
+- A section titled "Config Rule Coverage Gaps" with:
+  - Policies from the baseline that could be codified as AWS Config rules but are not currently deployed
+  - For each gap: the policy, why it is a good fit for Config, and a suggested rule approach (managed rule if available, or custom rule outline)
+
+If a drift detection report artifact already exists, update it with the latest findings instead of creating a new one.
+
+Additionally, for each drift item found, create a recommendation with:
+- A clear title describing the deviation
+- The specific policy being violated (reference the baseline section)
+- The resource ARN and current configuration state vs. expected state
+- Severity level
+- Suggested remediation steps
+
+Before creating a new recommendation, list existing recommendations and update an existing one if the same drift is already tracked.

llms.txt

@@ -22,6 +22,7 @@ Skills can be used with these AWS DevOps Agent types:
 - [Enrich with AWS Security Agent Skill](skills/enrich-with-aws-security-agent/SKILL.md): Queries AWS Security Agent CloudWatch logs to retrieve code-level security findings (file, line number, vulnerability type) during incident investigations with potential security root causes
 - [Wiz Security Context Skill](skills/wiz-security-context/SKILL.md): Queries the Wiz MCP server for a resource's security context (vulnerabilities, misconfigurations, secrets, active threats, malware, toxic combinations) to determine whether an operational anomaly is an operational issue or a security incident
 - [Service Quota Check Skill](skills/service-quota-check/SKILL.md): Checks AWS service quota utilization during investigations and before provisioning resources, flags quotas at 85%+ utilization, and requests increases via the Service Quotas API or recommends support cases
+- [Drift Detection Baseline Skill](skills/drift-detection-baseline/SKILL.md): Defines expected production infrastructure state for drift detection workflows, covering security posture (encryption, network isolation, public access), compliance (tagging, logging, backups), and lifecycle standards (deprecated runtimes, EOL engines), with severity classification and AWS Config rule coverage gap analysis
 
 ## Key Concepts
 

skills/drift-detection-baseline/.skilleval.yaml

@@ -0,0 +1,3 @@
+audit:
+  ignore:
+    - STR-016    # README alongside SKILL.md is intentional

skills/drift-detection-baseline/CHANGELOG.md

@@ -0,0 +1,10 @@
+# Changelog
+
+## 1.0.0
+
+- Initial version
+- Security posture baseline: encryption at rest/transit, network isolation, public access, secrets exposure
+- Compliance baseline: resource tagging, CloudTrail, AWS Config, backup configuration
+- Lifecycle baseline: Lambda runtimes, RDS engine versions, EKS cluster versions
+- Severity classification framework (critical, high, medium, low)
+- AWS Config rule coverage gap analysis methodology

skills/drift-detection-baseline/README.md

@@ -0,0 +1,91 @@
+# Drift Detection Baseline
+
+## Purpose
+
+This skill provides AWS DevOps Agent with a defined baseline of expected production infrastructure state for drift detection workflows. It enables the agent to compare current resource configurations against organizational standards and identify deviations (drift) across security posture, compliance, and lifecycle dimensions.
+
+Unlike a general best-practices audit, drift detection requires a **reference baseline** — a declared "expected state" to compare against. This skill serves as that baseline, providing the standards, verification methods, and severity framework the agent needs to systematically identify when production infrastructure has drifted from its intended configuration.
+
+## ⚠️ Important Notice
+
+This skill is provided as sample code. If you intend to deploy it in production, start with a non-production environment first, and before deploying to production:
+
+- Review and customize the baseline policies to match your organization's standards
+- Test thoroughly in a non-production environment
+- Validate that the severity classifications align with your operational priorities
+- Extend with organization-specific policies as needed
+
+## Key Capabilities
+
+- Defines expected state for encryption, network isolation, public access, tagging, logging, and backups
+- Provides specific AWS API calls and fields to verify each policy
+- Classifies drift findings by severity (critical, high, medium, low) based on security exposure and blast radius
+- Includes AWS Config rule coverage gap analysis to identify policies lacking automated enforcement
+- Designed to be extended with organization-specific policies
+
+## Prerequisites
+
+- An AWS DevOps Agent space
+- IAM permissions for read-only access to inspect resources:
+  - S3: `s3:GetEncryptionConfiguration`, `s3:GetBucketPublicAccessBlock`, `s3:GetBucketPolicy`, `s3:GetBucketTagging`
+  - RDS: `rds:DescribeDBInstances`, `rds:DescribeDBClusters`, `rds:ListTagsForResource`
+  - EC2: `ec2:DescribeVolumes`, `ec2:DescribeSecurityGroups`, `ec2:DescribeInstances`
+  - Lambda: `lambda:ListFunctions`, `lambda:GetFunctionConfiguration`
+  - EKS: `eks:DescribeCluster`, `eks:ListClusters`
+  - DynamoDB: `dynamodb:DescribeTable`, `dynamodb:DescribeContinuousBackups`
+  - Config: `config:DescribeConfigRules`, `config:DescribeConfigurationRecorders`
+  - CloudTrail: `cloudtrail:DescribeTrails`, `cloudtrail:GetTrailStatus`
+  - Resource Groups: `tag:GetResources`
+
+## Limitations
+
+- This skill defines a **sample baseline** — organizations should customize the policies, required tags, and severity thresholds to match their own standards
+- Lifecycle drift detection (deprecated runtimes, EOL engine versions) requires knowledge of current AWS deprecation schedules, which change over time
+- The skill covers foundational infrastructure policies but does not include application-level drift (latency thresholds, scaling policies, replication lag)
+- AWS Config rule gap analysis relies on the agent's knowledge of available managed rules
+
+## Agent Types
+
+This skill is designed for use with:
+
+- **All agents** — select "All agents" when importing to enable use by custom agents and built-in agents alike
+- Primarily consumed by the [drift-detection custom agent](../../custom-agents/drift-detection/)
+- Also useful for Chat tasks when asking about infrastructure compliance
+
+## Uploading to AWS DevOps Agent
+
+1. From the `skills/` directory, create a zip of the skill:
+   ```bash
+   cd skills
+   zip -r drift-detection-baseline.zip drift-detection-baseline/ -i '*.md' '*.txt' '*.json' '*.yaml' '*.yml' -x '*/README.md' '*/.skilleval.yaml' '*/CHANGELOG.md' '*/evals/*'
+   ```
+2. In the DevOps Agent web app, navigate to **Skills** and click **Import skill**
+3. Upload the zip file
+4. Set **Agent Type** to "All agents" (required for custom agent usage)
+5. Click **Import**
+
+## How to Use This Skill
+
+### With the Drift Detection Custom Agent (recommended)
+
+This skill is designed to be loaded by the [drift-detection custom agent](../../custom-agents/drift-detection/). See that agent's README for setup and execution instructions.
+
+### With Chat Tasks
+
+You can reference this skill directly in chat:
+
+- "Check my production resources for drift against the baseline policies"
+- "Are there any S3 buckets that violate the encryption at rest policy?"
+- "Which resources are missing required tags?"
+- "Identify any resources running deprecated or end-of-life versions"
+- "What AWS Config rules should I add to enforce the baseline policies?"
+
+### Extending the Baseline
+
+Create additional skills with your organization's specific policies:
+
+- Regulatory requirements (HIPAA, PCI-DSS, SOC2)
+- Application-specific thresholds (latency, replication lag, cost limits)
+- Team conventions (naming standards, environment separation rules)
+
+Load them alongside this baseline for comprehensive drift coverage.