cloud

Data architecture patterns covering read-side optimization (replicas, materialized views, CQRS, CDC, event sourcing), domain-based decomposition, polyglot persistence, and caching strategies (cache-aside, read-through, write-through, write-around). Use when designing data flow architecture, choosing read scalability strategies, or implementing caching for enterprise systems. For microservices patterns (Saga, granularity), use architecting-infrastructure instead. For DDD domain modeling, use devkit:applying-clean-architecture instead. For database engine internals and relational DB schema design, use lang:developing-databases instead. For GCP-specific data services (BigQuery, Dataflow, Dataproc), lakehouse (BigLake, Dataplex), and BigQuery advanced operations (editions, HA/DR), use developing-google-cloud instead.

Vendor-neutral infrastructure and system architecture patterns. Infrastructure: 127 patterns for availability (HA, DR, backup), security, performance/scalability, operations, network/storage configuration, and cloud. Modernization: socio-technical strategy, domain redesign, trade-off analysis (code/API/system/meta levels). Microservices: CQRS, Event Sourcing, Saga, distributed transactions, service granularity, data ownership, resilience, messaging. Use when designing infrastructure, evaluating non-functional requirements, modernizing legacy systems, making architectural trade-offs, or designing microservices. For security-architecture design methodology (threat modeling, zero trust) use architecting-security instead.

Artifact-based methodology for designing security architecture for hybrid and multi-cloud systems across the solution lifecycle (Plan, Design, Build, Run, Close): artifact dependency framework, threat modeling (STRIDE, attack trees, LINDDUN), zero trust integration, data-centric security (data classification, information asset register), compliance and governance mapping, security requirements engineering, shared responsibility models, and architecture decision records. Use when designing an information system's security, threat modeling, planning zero trust, producing security architecture artifacts, or defining a security architect's deliverables. For infrastructure and microservices patterns use architecting-infrastructure; for secure-by- default coding use devkit:software-security; for OWASP code security use devkit:securing-code; for authorization models (ABAC/ReBAC/Cedar) use implementing-dynamic-authorization; for cloud-vendor security use developing-aws or developing-google-cloud instead.

Multi-tenant SaaS architecture covering control plane/application plane design, deployment models (silo, pool, hybrid, pod), tenant isolation, data partitioning, and container/serverless compute patterns. Use when designing SaaS platforms, evaluating silo vs pool strategies, or planning SaaS migration. Covers identity, onboarding, tenant context injection, tiering, and operations. For Next.js single-tenant SaaS (auth, payments), use web:developing-nextjs instead. For vendor-neutral infrastructure and microservices patterns, use architecting-infrastructure instead. For data-flow architecture and CQRS/polyglot persistence, use architecting-data instead.

AWS development guide covering serverless (Lambda, API Gateway, DynamoDB), CDK, EKS, ECS/Fargate, SRE, FinOps, security (IAM, VPC, KMS, GuardDuty), AI/ML (Bedrock, RAG, SageMaker), databases (Aurora, ElastiCache), data engineering (Glue, Athena, Redshift), 57 Cloud Design Patterns, VPC architecture, enterprise architecture (multi-account, Landing Zone, Cognito), cloud migration (7R, DMS), and HA/fault tolerance. Use when working with AWS services, CDK infrastructure, or serverless applications. MUST load when working with AWS services, detected by aws-cdk or @aws-sdk in package.json, cdk.json, samconfig.toml, serverless.yml, template.yaml (SAM), or eksctl configs. For vendor-neutral security architecture methodology use architecting-security instead.

Firebase platform development guide covering Authentication (email/social/session), Firestore & Realtime Database (modeling/queries/security rules), Cloud Storage, Cloud Functions (triggers/scheduling), Hosting, Emulator Suite (local dev/testing), Analytics (events/BigQuery), Crashlytics, FCM push notifications, Remote Config, Test Lab, Performance Monitoring, Dynamic Links, App Distribution, AdMob, and Extensions. MUST load when firebase, @firebase, or firebase-admin packages detected, or firebaseConfig/firebase.json/firestore.rules files present. For GCP infra→developing-google-cloud. For Next.js integration→web:developing-nextjs. For REST API design→web:developing-web-apis.

Google Cloud guide: Cloud Run, GCP security (IAM/VPC/KMS/Zero Trust), data engineering (BigQuery/Dataflow/pipelines/governance/lakehouse), networking (VPC/LB/CDN), Memorystore, enterprise architecture, compute selection (GCE/GKE/GAE/Run/Functions), GKE, GAE, monitoring (SLO/SLI), BigQuery analytics (SQL/window functions/GA4), BigQuery ops (editions/HA-DR/slots), workflow (Composer/Dataform/Data Fusion), BI (Looker/Looker Studio/BI Engine), ingestion (DTS/Datastream CDC/GA4), real-time (Pub/Sub/Dataflow streaming), ML (BigQuery ML/Vertex AI/GIS). MUST load when google-cloud packages, cloudbuild.yaml, BigQuery/Dataflow/Memorystore/Looker/Dataplex detected. For Docker→practicing-devops. For monitoring→implementing-observability. For OWASP→devkit:securing-code. For CQRS→architecting-data. For AWS→developing-aws. For GenAI→ai:designing-genai-patterns. For Firebase (Auth/Firestore/Storage/Functions/Hosting)→developing-firebase. For engine-agnostic SQL query-writing techniques→lang:writing-effective-sql.

Terraform IaC development with HCL syntax, module design, state management (S3/GCS remote backends, workspaces, drift handling), Terragrunt wrapper patterns, testing (Terratest, Terraform Testing Framework), CI/CD (GitHub Actions, GitOps, security scanning), custom provider development (Plugin Framework), and CDKTF. MUST load when .tf files or terragrunt.hcl are detected, or go.mod contains 'terraform'. Covers AWS/GCP infrastructure patterns and mise task automation. For Docker infrastructure, broader DevOps methodology, and IaC tool comparison, use practicing-devops instead. For AWS CDK (TypeScript/Python IaC), use developing-aws instead.

Dynamic authorization design covering authorization model selection (ACL, RBAC, ReBAC, ABAC, PBAC), Policy as Code vs Policy as Data, Cedar policy language (PARC model, type system, operators), policy language comparison (Cedar vs OPA/Rego vs OpenFGA/Zanzibar), XACML reference architecture (PEP/PDP/PAP/PIP), PEP deployment patterns (Embedded/API Gateway/Sidecar), centralized vs distributed PDP, policy governance lifecycle, and multi-tenant policy layering. Use when designing access control systems, choosing authorization models, writing Cedar policies, or selecting policy engines (Cedar, OPA, OpenFGA). For code-level security (input validation, OWASP), use devkit:securing-code instead. For Keycloak identity and access management (OIDC/SAML, SSO, authorization policies), use managing-keycloak instead. For end-to-end security architecture design use architecting-security instead. For applying authorization inside HTTP APIs (RBAC/scopes, JWT/OAuth enforcement), use web:securing-web-apis.

Unified observability guide covering monitoring system design (anti-patterns, 6-layer strategy, alerting, SLOs, telemetry pipelines, observability maturity model), OpenTelemetry implementation (tracing/metrics/logs API/SDK, Collector deployment, semantic conventions), logging design (structured logging, collection pipelines, analysis, anomaly detection, security compliance), and observability engineering practices (core analysis loop, debugging, ODD, build-vs-buy ROI, CI/CD observability, high-cardinality data). Use when designing monitoring strategy, implementing OpenTelemetry instrumentation, building log pipelines, setting up alerts, establishing SLO-based reliability, or adopting observability practices. Replaces: designing-monitoring, implementing-opentelemetry, implementing-logging.

Comprehensive Keycloak identity and access management guide covering OIDC/SAML protocols, SSO, Realms, Clients, Users, Roles, User Federation (LDAP/AD), Identity Brokering and social login, authentication flows, MFA, authorization policies (fine-grained permissions, UMA 2.0), JWT token management, application integration (Java/Node.js/Spring Boot), Docker/Kubernetes deployment, clustering, multi-tenant realm design (realm-per-tenant vs shared realm), large-scale user provisioning, observability and monitoring, migration/upgrade strategies, and SPI extensions. MUST load when keycloak.json, keycloak.conf, or Keycloak-related dependencies are detected. For general security practices, use devkit:securing-code instead. For Cedar/ABAC/ReBAC authorization models, use implementing-dynamic-authorization instead.

DevOps実践ガイド（進化3ステージ・IaCツール選定・オーケストレーション・CI/CD・コンテナ管理・プラットフォームエンジニアリング/IDP）。 Use when practicing DevOps, selecting IaC tools, designing CI/CD pipelines, or managing Docker/Podman containers. Docker/Podman、マルチステージビルド、Compose、rootless/Quadlet、セキュリティ強化を含む。 For continuous delivery philosophy, CD maturity assessment, and deployment pipeline design principles, see CONTINUOUS-DELIVERY.md subfile. For Terraform/OpenTofu HCL development and module design, use developing-terraform instead. For project foundations, team organization, and developer habits, use devkit:practicing-software-engineering instead. For monitoring and observability design, use implementing-observability instead. For GCP CI/CD and GKE container orchestration, use developing-google-cloud instead. For GPU-optimized Docker/Kubernetes environment tuning (NVIDIA Container Toolkit, MPS, MIG), use ai:designing-genai-patterns instead.

Vendor-neutral cloud security body of knowledge aligned with the six CCSP domains: cloud fundamentals (IaaS/PaaS/SaaS, shared responsibility), architecture and design principles (cryptography, IAM, network security, zero trust, BC/DR), data security (lifecycle, storage architectures, DLP, information rights management), platform and infrastructure security (data center, virtualization/hypervisor), application security (API security, WAF), secure development (SDLC, DevSecOps), security operations (SOC, SIEM/SOAR), governance/risk/compliance, legal and privacy (privacy regulations, SLA, forensics), and emerging trends (cloud-native, AI/ML security). Use when securing cloud workloads, designing cloud security controls, evaluating provider security, or studying cloud security certification topics. For security architecture methodology (threat modeling artifacts), use architecting-security. For code-level security, use devkit:securing-code. For AWS/GCP specifics, use developing-aws or developing-google-cloud.