| """Cloud Deploy Skill - Sinh cloud deployment templates. |
| |
| Hỗ trợ AWS (EC2/S3/Lambda), GCP (Cloud Run / Compute), Azure |
| (Container Apps / Functions). Tạo IaC + deploy command. |
| |
| Author: Hieu Louis (2026) |
| """ |
| from __future__ import annotations |
|
|
| from typing import Dict, List |
|
|
| from .base import Skill, SkillContext, SkillCategory, SkillPriority, SkillResult |
|
|
|
|
| class CloudDeploySkill(Skill): |
| """Sinh IaC + deploy command cho AWS / GCP / Azure.""" |
|
|
| category = SkillCategory.CLOUD |
| priority = SkillPriority.HIGH |
| keywords: List[str] = [ |
| "deploy", "deployment", "aws", "gcp", "azure", |
| "ec2", "s3", "lambda", "cloud run", "cloudrun", |
| "cloud functions", "ecs", "eks", "fargate", |
| "compute engine", "container apps", "app service", |
| "deploy command", "iac", "pulumi", "cdk", |
| ] |
| examples = [ |
| "Deploy FastAPI to AWS Lambda", |
| "Deploy container to GCP Cloud Run", |
| "Provision S3 bucket + CloudFront for static site", |
| ] |
|
|
| @property |
| def name(self) -> str: |
| return "cloud_deploy" |
|
|
| @property |
| def description(self) -> str: |
| return ( |
| "Sinh cloud deployment templates cho AWS / GCP / Azure: " |
| "Lambda (SAM), Cloud Run, ECS/Fargate, Container Apps, " |
| "S3+CloudFront static hosting, với IaC (Terraform / CDK / Pulumi) " |
| "và deploy commands (aws / gcloud / az)." |
| ) |
|
|
| def can_handle(self, prompt: str, context: SkillContext = None) -> float: |
| prompt_lower = prompt.lower() |
| score = 0.0 |
| for kw in self.keywords: |
| if kw in prompt_lower: |
| score += 0.15 |
| return min(1.0, score) |
|
|
| def _detect_target(self, prompt: str) -> str: |
| p = prompt.lower() |
| if "lambda" in p: |
| return "aws_lambda" |
| if "cloud run" in p or "cloudrun" in p: |
| return "gcp_cloudrun" |
| if "ecs" in p or "fargate" in p: |
| return "aws_ecs" |
| if "container apps" in p: |
| return "azure_containerapps" |
| if "app service" in p: |
| return "azure_appservice" |
| if "compute engine" in p or "gce" in p: |
| return "gcp_gce" |
| if "ec2" in p: |
| return "aws_ec2" |
| if "s3" in p and ("static" in p or "cloudfront" in p or "website" in p): |
| return "aws_s3_static" |
| return "gcp_cloudrun" |
|
|
| def execute(self, context: SkillContext) -> SkillResult: |
| target = self._detect_target(context.prompt) |
| artifact, deploy_cmd = self._build(target) |
|
|
| return SkillResult( |
| success=True, |
| output=f"[CloudDeploy/{target}] IaC + deploy command ready.", |
| artifacts=[artifact], |
| metadata={ |
| "skill": self.name, |
| "target": target, |
| "deploy_command": deploy_cmd, |
| "providers": { |
| "aws": ["aws-cli", "sam", "terraform", "cdk"], |
| "gcp": ["gcloud", "terraform", "pulumi"], |
| "azure": ["az", "terraform", "bicep"], |
| }, |
| "checklist": [ |
| "Pin runtime versions (Python 3.12, Node 20, ...)", |
| "Set least-privilege IAM role", |
| "Enable VPC flow logs / CloudTrail / Audit Logs", |
| "Configure autoscaling + health checks", |
| "Set up alarms on error rate / latency / cost", |
| "Store secrets in Secrets Manager / Secret Manager", |
| ], |
| }, |
| suggestions=[ |
| "Run `terraform plan` in CI before `apply`", |
| "Use blue/green or canary for production deploys", |
| "Tag resources with owner / cost-center / env", |
| "Enable WAF + rate-limiting on public endpoints", |
| ], |
| ) |
|
|
| def _build(self, target: str) -> tuple[Dict[str, str], str]: |
| if target == "aws_lambda": |
| return ({"path": "deploy/aws_lambda/template.yaml", "content": _AWS_LAMBDA_SAM}, |
| "sam build && sam deploy --guided") |
| if target == "aws_ecs": |
| return ({"path": "deploy/aws_ecs/main.tf", "content": _AWS_ECS_TF}, |
| "terraform apply -auto-approve") |
| if target == "aws_ec2": |
| return ({"path": "deploy/aws_ec2/main.tf", "content": _AWS_EC2_TF}, |
| "terraform apply -auto-approve") |
| if target == "aws_s3_static": |
| return ({"path": "deploy/aws_s3_static/main.tf", "content": _AWS_S3_STATIC_TF}, |
| "aws s3 sync ./dist s3://$BUCKET --delete") |
| if target == "azure_containerapps": |
| return ({"path": "deploy/azure_containerapps/main.bicep", "content": _AZURE_CONTAINERAPPS}, |
| "az deployment group create -g rg-prod -f main.bicep") |
| if target == "azure_appservice": |
| return ({"path": "deploy/azure_appservice/main.bicep", "content": _AZURE_APPSERVICE}, |
| "az webapp up --runtime PYTHON:3.12 --sku B1") |
| if target == "gcp_gce": |
| return ({"path": "deploy/gcp_gce/main.tf", "content": _GCP_GCE_TF}, |
| "terraform apply -auto-approve") |
| return ({"path": "deploy/gcp_cloudrun/main.tf", "content": _GCP_CLOUDRUN_TF}, |
| "gcloud run deploy nexus-api --source . --region asia-southeast1") |
|
|
|
|
| _AWS_LAMBDA_SAM = '''# AWS SAM template — Lambda + API Gateway |
| AWSTemplateFormatVersion: "2010-09-09" |
| Transform: AWS::Serverless-2016-10-31 |
| Globals: |
| Function: |
| Runtime: python3.12 |
| MemorySize: 512 |
| Timeout: 30 |
| Tracing: Active |
| Resources: |
| NexusApi: |
| Type: AWS::Serverless::Function |
| Properties: |
| CodeUri: ../src |
| Handler: app.handler |
| Policies: |
| - AWSLambdaBasicExecutionRole |
| - DynamoDBCrud: { TableName: !Ref NexusTable } |
| Environment: |
| Variables: { LOG_LEVEL: INFO } |
| Events: |
| Api: |
| Type: Api |
| Properties: |
| Path: /{proxy+} |
| Method: ANY |
| NexusTable: |
| Type: AWS::DynamoDB::Table |
| Properties: |
| BillingMode: PAY_PER_REQUEST |
| AttributeDefinitions: |
| - { AttributeName: pk, AttributeType: S } |
| KeySchema: |
| - { AttributeName: pk, KeyType: HASH } |
| Outputs: |
| ApiUrl: { Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod" } |
| ''' |
|
|
| _AWS_ECS_TF = '''# AWS ECS Fargate + ALB |
| terraform { |
| required_version = ">= 1.7" |
| required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } } |
| } |
| resource "aws_ecs_cluster" "nexus" { name = "nexus-cluster" } |
| resource "aws_ecs_task_definition" "nexus" { |
| family = "nexus-api" |
| requires_compatibilities = ["FARGATE"] |
| network_mode = "awsvpc" |
| cpu = "512" |
| memory = "1024" |
| container_definitions = jsonencode([{ |
| name = "api" |
| image = "ghcr.io/nexus/api:0.3.0" |
| portMappings = [{ containerPort = 8000 }] |
| logConfiguration = { logDriver = "awslogs", |
| options = { "awslogs-group" = "/ecs/nexus", "awslogs-region" = "ap-southeast-1" } } |
| }]) |
| } |
| resource "aws_ecs_service" "nexus" { |
| name = "nexus-api" |
| cluster = aws_ecs_cluster.nexus.id |
| task_definition = aws_ecs_task_definition.nexus.arn |
| desired_count = 2 |
| launch_type = "FARGATE" |
| network_configuration { |
| subnets = module.vpc.private_subnets |
| security_groups = [aws_security_group.nexus.id] |
| } |
| } |
| ''' |
|
|
| _AWS_EC2_TF = '''# AWS EC2 with EIP + user_data |
| terraform { |
| required_version = ">= 1.7" |
| required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } } |
| } |
| resource "aws_instance" "nexus" { |
| ami = "ami-0abc1234def56789" |
| instance_type = "t3.small" |
| vpc_security_group_ids = [aws_security_group.nexus.id] |
| iam_instance_profile = aws_iam_instance_profile.nexus.name |
| user_data = file("deploy/aws_ec2/userdata.sh") |
| tags = { Name = "nexus-api", Env = "prod" } |
| } |
| resource "aws_eip" "nexus" { |
| instance = aws_instance.nexus.id |
| domain = "vpc" |
| } |
| ''' |
|
|
| _AWS_S3_STATIC_TF = '''# S3 + CloudFront static website |
| terraform { |
| required_version = ">= 1.7" |
| required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } } |
| } |
| resource "aws_s3_bucket" "static" { bucket = "nexus-static-prod" } |
| resource "aws_s3_bucket_website_configuration" "static" { |
| bucket = aws_s3_bucket.static.id |
| index_document { suffix = "index.html" } |
| error_document { key = "404.html" } |
| } |
| resource "aws_cloudfront_distribution" "cdn" { |
| origin { |
| domain_name = aws_s3_bucket_website_configuration.static.website_endpoint |
| origin_id = "s3-nexus" |
| custom_origin_config { origin_protocol_policy = "http-only" } |
| } |
| enabled = true |
| is_ipv6_enabled = true |
| default_cache_behavior { |
| target_origin_id = "s3-nexus" |
| viewer_protocol_policy = "redirect-to-https" |
| allowed_methods = ["GET", "HEAD"] |
| cached_methods = ["GET", "HEAD"] |
| forwarded_values { query_string = false; cookies { forward = "none" } } |
| min_ttl = 0; default_ttl = 3600; max_ttl = 86400 |
| } |
| restrictions { geo_restriction { restriction_type = "none" } } |
| viewer_certificate { cloudfront_default_certificate = true } |
| } |
| ''' |
|
|
| _GCP_CLOUDRUN_TF = '''# GCP Cloud Run service |
| terraform { |
| required_version = ">= 1.7" |
| required_providers { google = { source = "hashicorp/google", version = "~> 5.0" } } |
| } |
| resource "google_cloud_run_service" "nexus" { |
| name = "nexus-api" |
| location = "asia-southeast1" |
| template { |
| spec { |
| container_concurrency = 80 |
| timeout_seconds = 300 |
| containers { |
| image = "gcr.io/PROJECT/nexus-api:0.3.0" |
| env { name = "LOG_LEVEL"; value = "INFO" } |
| resources { |
| limits = { cpu = "1000m", memory = "1Gi" } |
| } |
| } |
| } |
| } |
| traffic { percent = 100; latest_revision = true } |
| autogenerate_revision_name = true |
| } |
| resource "google_cloud_run_service_iam_member" "public" { |
| service = google_cloud_run_service.nexus.name |
| location = google_cloud_run_service.nexus.location |
| role = "roles/run.invoker" |
| member = "allUsers" |
| } |
| ''' |
|
|
| _GCP_GCE_TF = '''# GCP Compute Engine with startup script |
| terraform { |
| required_version = ">= 1.7" |
| required_providers { google = { source = "hashicorp/google", version = "~> 5.0" } } |
| } |
| resource "google_compute_instance" "nexus" { |
| name = "nexus-api" |
| machine_type = "e2-small" |
| zone = "asia-southeast1-a" |
| boot_disk { |
| initialize_params { image = "debian-cloud/debian-12" } |
| } |
| network_interface { |
| network = "default" |
| access_config {} # ephemeral IP |
| } |
| metadata = { startup-script = file("deploy/gcp_gce/startup.sh") } |
| tags = ["nexus", "http-server"] |
| service_account { |
| scopes = ["cloud-platform"] |
| } |
| } |
| ''' |
|
|
| _AZURE_CONTAINERAPPS = '''// Azure Container Apps (Bicep) |
| param location string = 'southeastasia' |
| param imageName string = 'ghcr.io/nexus/api:0.3.0' |
| |
| resource managedEnv 'Microsoft.App/managedEnvironments@2024-03-01' = { |
| name: 'nexus-env' |
| location: location |
| } |
| |
| resource containerApp 'Microsoft.App/containerApps@2024-03-01' = { |
| name: 'nexus-api' |
| location: location |
| properties: { |
| managedEnvironmentId: managedEnv.id |
| configuration: { |
| activeRevisionsMode: 'Single' |
| ingress: { |
| external: true |
| targetPort: 8000 |
| traffic: [{ weight: 100, latestRevision: true }] |
| allowInsecure: false |
| } |
| secrets: [ |
| { name: 'api-key', value: '@Microsoft.KeyVault(VaultName=nexus-kv;SecretName=ApiKey)' } |
| ] |
| } |
| template: { |
| containers: [ |
| { |
| name: 'api' |
| image: imageName |
| env: [ |
| { name: 'LOG_LEVEL', value: 'INFO' } |
| ] |
| resources: { cpu: json('1.0'), memory: '1.0Gi' } |
| } |
| ] |
| scale: { minReplicas: 1, maxReplicas: 10 } |
| } |
| } |
| } |
| ''' |
|
|
| _AZURE_APPSERVICE = '''// Azure App Service (Linux, Python) — Bicep |
| param location string = 'southeastasia' |
| param sku string = 'B1' |
| |
| resource plan 'Microsoft.Web/serverfarms@2023-12-01' = { |
| name: 'nexus-plan' |
| location: location |
| sku: { name: sku, tier: 'Basic' } |
| properties: { reserved: true } // Linux |
| } |
| |
| resource app 'Microsoft.Web/sites@2023-12-01' = { |
| name: 'nexus-api' |
| location: location |
| properties: { |
| serverFarmId: plan.id |
| siteConfig: { |
| linuxFxVersion: 'PYTHON|3.12' |
| appCommandLine: 'gunicorn -w 4 -b 0.0.0.0:8000 app:main' |
| alwaysOn: true |
| } |
| } |
| identity: { type: 'SystemAssigned' } |
| } |
| ''' |
|
|
