resilience-hub-getting-started

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Getting Started with AWS Resilience Hub v2

AWS Resilience Hub v2 入门指南

Overview

概述

Domain expertise for first-time Resilience Hub v2 setup: policies, systems, user journeys, services, input sources, and failure mode assessments.

The AWS MCP server is recommended for executing this skill's AWS API calls, but it is not required — all operations also work with the AWS CLI directly.

针对首次设置Resilience Hub v2的领域专业知识：策略、系统、用户旅程、服务、输入源和故障模式评估。

建议使用AWS MCP服务器执行此技能的AWS API调用，但并非强制要求——所有操作也可直接通过AWS CLI完成。

Guardrail — where this skill's own files live (MCP vs local install)

防护规则——此技能文件的存储位置（MCP 与本地安装）

Before reading a reference file, determine how this skill was loaded:

Loaded via the AWS MCP
retrieve_skill
tool: the skill's reference files are not on the local filesystem. Fetch each one through
```
retrieve_skill
```
with the
```
file
```
parameter (e.g.
```
file="references/setup-procedure.md"
```
) — do NOT
```
file_read
```
these paths locally or search the filesystem for them.
Installed locally (e.g.
```
.kiro/skills/resilience-hub-getting-started/
```
or
```
~/.claude/skills/resilience-hub-getting-started/
```
): read reference files from the local skill directory using the relative paths shown here.

This applies only to the skill's own reference files; always read and write user or session data in the working directory, never through

retrieve_skill

在读取参考文件之前，请确定此技能的加载方式：

通过AWS MCP
retrieve_skill
工具加载：技能的参考文件不在本地文件系统中。请通过
```
retrieve_skill
```
工具并指定
```
file
```
参数（例如
```
file="references/setup-procedure.md"
```
）来获取每个文件——请勿在本地使用
```
file_read
```
读取这些路径，也不要在文件系统中搜索它们。
本地安装（例如
```
.kiro/skills/resilience-hub-getting-started/
```
或
```
~/.claude/skills/resilience-hub-getting-started/
```
）：使用此处显示的相对路径从本地技能目录读取参考文件。

此规则仅适用于技能自身的参考文件；用户或会话数据始终在工作目录中读写，切勿通过

retrieve_skill

操作。

Set up Resilience Hub v2

设置Resilience Hub v2

To configure Resilience Hub v2 from scratch, follow the procedure exactly. See references/setup-procedure.md.

要从零开始配置Resilience Hub v2，请严格遵循以下步骤。请参阅references/setup-procedure.md。

Troubleshooting

故障排除

Assessment stuck in IN_PROGRESS

评估卡在IN_PROGRESS状态

Poll with

aws resiliencehubv2 list-failure-mode-assessments

. If stuck >30 min, check the

errorCode

field — common causes are INVALID_PERMISSIONS or CMK_ACCESS_DENIED on cross-account roles.

使用

aws resiliencehubv2 list-failure-mode-assessments

命令轮询状态。如果卡住超过30分钟，请检查

errorCode

字段——常见原因是跨账户角色的INVALID_PERMISSIONS（权限无效）或CMK_ACCESS_DENIED（CMK访问被拒绝）。

Achievability shows NOT_ACHIEVABLE

可行性显示NOT_ACHIEVABLE

Your architecture cannot meet the policy targets. Fix infrastructure before running FIS experiments — testing won't help if the architecture is fundamentally insufficient.

您的架构无法满足策略目标。在运行FIS实验之前修复基础设施——如果架构本身存在缺陷，测试也无济于事。

No resources discovered

未发现任何资源

Verify input sources are correct: CFN stack ARN exists, Terraform state file is accessible, EKS cluster is in the specified regions, or resource tags match actual resources.

验证输入源是否正确：CFN堆栈ARN存在、Terraform状态文件可访问、EKS集群位于指定区域，或者资源标签与实际资源匹配。

Security Considerations

安全注意事项

Least privilege: scope the invoker role to read-only discovery of only the resource types in your input sources; attach the AWS managed
```
AWSResilienceHubAsssessmentExecutionPolicy
```
(AWS spells it with three s's) or a tighter custom policy.
Encryption at rest / in transit: recommend S3 buckets for Terraform state and assessment reports use server-side encryption (SSE-KMS) and a bucket policy enforcing TLS via
```
aws:SecureTransport
```
.
Condition keys (confused-deputy): add an
```
aws:SourceAccount
```
(and ideally
```
aws:SourceArn
```
scoped to the specific Resilience Hub service ARN) condition to the invoker role's trust policy so only your account's Resilience Hub can assume it.
Limit assessment exposure: restrict who can call
```
start-failure-mode-assessment
```
(it reads infrastructure state) and who can read assessment findings and reports — these can contain sensitive architecture detail.
Further reading: see Security in AWS Resilience Hub and IAM Best Practices (including cross-service confused-deputy prevention).

最小权限原则： 将调用者角色的权限范围限定为仅对输入源中的资源类型进行只读发现；附加AWS托管的
```
AWSResilienceHubAsssessmentExecutionPolicy
```
（AWS拼写中有三个s）或更严格的自定义策略。
静态/传输中加密： 建议用于存储Terraform状态和评估报告的S3存储桶使用服务器端加密（SSE-KMS），并通过
```
aws:SecureTransport
```
条件强制使用TLS的存储桶策略。
条件键（混淆代理问题）： 在调用者角色的信任策略中添加
```
aws:SourceAccount
```
（理想情况下还添加限定为特定Resilience Hub服务ARN的
```
aws:SourceArn
```
）条件，以便只有您账户的Resilience Hub可以扮演该角色。
限制评估暴露： 限制谁可以调用
```
start-failure-mode-assessment
```
（该命令会读取基础设施状态）以及谁可以读取评估结果和报告——这些内容可能包含敏感的架构细节。
扩展阅读： 请参阅AWS Resilience Hub 中的安全和IAM最佳实践（包括跨服务混淆代理问题的预防）。