resilience-hub-failure-mode-assessment

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Failure Mode Assessment

故障模式评估

Overview

概述

Domain expertise for running Resilience Hub v2 failure mode assessments, interpreting findings, triaging by severity and achievability, and driving remediation.

The AWS MCP server is recommended for executing this skill's AWS API calls, but it is not required — all operations also work with the AWS CLI directly.

本技能具备运行Resilience Hub v2故障模式评估、解读评估结果、按严重性和可实现性进行优先级排序，以及推动问题修复的领域专业知识。

建议使用AWS MCP服务器执行本技能的AWS API调用，但并非强制要求——所有操作也可直接通过AWS CLI完成。

Guardrail — where this skill's own files live (MCP vs local install)

防护规则——本技能文件的存储位置（MCP vs 本地安装）

Before reading a reference file, determine how this skill was loaded:

Loaded via the AWS MCP
retrieve_skill
tool: the skill's reference files are not on the local filesystem. Fetch each one through
```
retrieve_skill
```
with the
```
file
```
parameter (e.g.
```
file="references/assessment-workflow.md"
```
) — do NOT
```
file_read
```
these paths locally or search the filesystem for them.
Installed locally (e.g.
```
.kiro/skills/resilience-hub-failure-mode-assessment/
```
or
```
~/.claude/skills/resilience-hub-failure-mode-assessment/
```
): read reference files from the local skill directory using the relative paths shown here.

This applies only to the skill's own reference files; always read and write user or session data in the working directory, never through

retrieve_skill

在读取参考文件前，请先确定本技能的加载方式：

通过AWS MCP
retrieve_skill
工具加载：技能的参考文件不在本地文件系统中。请通过
```
retrieve_skill
```
工具并传入
```
file
```
参数来获取每个文件（例如
```
file="references/assessment-workflow.md"
```
）——请勿在本地使用
```
file_read
```
读取这些路径，也不要在文件系统中搜索它们。

本地安装（例如

.kiro/skills/resilience-hub-failure-mode-assessment/

或

~/.claude/skills/resilience-hub-failure-mode-assessment/

）：使用此处显示的相对路径从本地技能目录读取参考文件。

此规则仅适用于技能自身的参考文件；用户或会话数据始终在工作目录中读写，切勿通过

retrieve_skill

操作。

Run and interpret assessments

运行并解读评估

To run assessments and triage findings, follow the procedure exactly. See references/assessment-workflow.md.

要运行评估并对结果进行优先级排序，请严格遵循以下流程。详情请参阅references/assessment-workflow.md。

Troubleshooting

故障排除

Assessment fails with INVALID_PERMISSIONS

评估因INVALID_PERMISSIONS失败

The service's permission model (invokerRoleName / crossAccountRoles) doesn't have access to the resources. Verify the invoker role (and any cross-account roles) can describe resources in all configured regions.

服务的权限模型（invokerRoleName / crossAccountRoles）没有资源访问权限。请验证调用者角色（以及任何跨账户角色）能否在所有配置的区域中描述资源。

Too many findings — where to start?

评估结果过多——从何处入手？

Prioritize by finding severity, highest first (HIGH, then MEDIUM, then LOW). For HIGH-severity findings, check the service's achievability for the relevant policy component (from

get-service

list-failure-mode-assessments

): NOT_ACHIEVABLE means the architecture must change before testing; ACHIEVABLE means validate the fix with an FIS experiment. MEDIUM findings: plan remediation this sprint; LOW findings: track but don't block (see the priority matrix in references/assessment-workflow.md Step 5).

按结果严重性从高到低优先处理（HIGH > MEDIUM > LOW）。对于高严重性结果，请检查相关策略组件的服务可实现性（通过

get-service

list-failure-mode-assessments

获取）：NOT_ACHIEVABLE意味着在测试前必须更改架构；ACHIEVABLE表示可通过FIS实验验证修复方案。中等严重性结果：计划在当前迭代中修复；低严重性结果：跟踪但不阻塞（请参阅references/assessment-workflow.md步骤5中的优先级矩阵）。

AI-generated service functions are wrong

AI生成的服务函数有误

Update them:

aws resiliencehubv2 update-service-function

to rename or change criticality (there is no service-function "type" parameter). Reassign resources by calling

create-service-function-resources

with the desired resource set (see references/assessment-workflow.md for the service-function operations).

更新这些函数：使用

aws resiliencehubv2 update-service-function

命令重命名或更改关键程度（没有服务函数"类型"参数）。通过调用

create-service-function-resources

并传入所需资源集来重新分配资源（服务函数操作详情请参阅references/assessment-workflow.md）。

Security Considerations

安全注意事项

Least privilege: the invoker role should be scoped to read-only discovery of only the resource types in the service's input sources; avoid granting access beyond what assessment needs.
Encryption & access control: recommend that S3 buckets used for report output have server-side encryption (SSE-S3 or SSE-KMS) and block public access — assessment reports can contain sensitive architectural detail. If a bucket policy grants the Resilience Hub service principal write access, scope it with
```
aws:SourceArn
```
/
```
aws:SourceAccount
```
condition keys to prevent confused-deputy writes.
Further reading: see Security in AWS Resilience Hub and the AWS Well-Architected Security Pillar for securing assessment outputs and IAM configurations.

最小权限原则：调用者角色的权限范围应仅限于服务输入源中的资源类型的只读发现；避免授予超出评估需求的访问权限。
加密与访问控制：建议用于报告输出的S3存储桶启用服务器端加密（SSE-S3或SSE-KMS）并阻止公共访问——评估报告可能包含敏感的架构细节。如果存储桶策略授予Resilience Hub服务主体写入权限，请使用
```
aws:SourceArn
```
/
```
aws:SourceAccount
```
条件键限制范围，以防止混淆代理写入。
扩展阅读：请参阅Security in AWS Resilience Hub和AWS Well-Architected Security Pillar，了解如何保护评估输出和IAM配置。