---
schema_version: "1.0"
type: eem
project_name: aws-expert
domain:
  - aws
  - cloud-infrastructure
  - devops
  - security
license: mit
base_network: null
source_repos: []
beliefs_total: 2775
beliefs_in: 2775
beliefs_out: 0
premises: 2615
derived: 160
nogoods: 0
generator: ftl-reasons/0.41.0
---

# AWS Expert

Expert knowledge base for **AWS service behavior, defaults, and operational pitfalls**. Contains 2,775 justified beliefs covering DynamoDB, CloudTrail, IAM, CloudFormation, RDS, S3, networking, compute, and cross-service interactions.

## What is this?

This is an **External Epistemic Memory** (EEM) — a model-agnostic knowledge base that any LLM can use via the `reasons` CLI or tool calling. Unlike a LoRA or fine-tune, this knowledge is not baked into model weights. It is external, inspectable, correctable, and works with any model.

## Stats

| Metric | Value |
|--------|-------|
| Total beliefs | 2,775 |
| Status | 2,775 IN / 0 OUT |
| Premises (observations) | 2,615 |
| Derived (justified conclusions) | 160 |
| Nogoods (contradictions) | 0 |
| Retraction rate | 0% |
| Max derivation depth | 8 |

## Top Topics

| Topic | Beliefs |
|-------|---------|
| dynamodb | 723 |
| cloudtrail | 416 |
| iam | 261 |
| account | 144 |
| rds | 134 |
| cfn | 132 |
| table | 128 |
| lake | 126 |
| default | 125 |
| max | 107 |
| region | 102 |
| backup | 98 |
| vpc | 95 |
| aws | 93 |
| ec2 | 89 |
| policy | 83 |
| data | 82 |
| cross | 80 |

## Domain Coverage

- **DynamoDB**: capacity billing, GSI behavior, autoscaling pitfalls, TTL audit gaps, global tables consistency modes, DAX caching, item size overhead, cross-region replication (692 beliefs)
- **CloudTrail**: audit blind spots, Lake configuration, KMS key irrevocability, event data stores, data event logging gaps, automated operation blind spots (354 beliefs)
- **IAM**: policy evaluation, cross-account access, permission boundaries, default security posture, resource policies (222 beliefs)
- **CloudFormation**: stack lifecycle, drift detection, resource dependencies, rollback behavior, nested stacks (128 beliefs)
- **RDS/Aurora**: backup strategies, PITR windows, parameter groups, Multi-AZ failover, read replicas, lifecycle state transitions (139 beliefs)
- **S3**: bucket policies, lifecycle rules, versioning, cross-region replication, access points (119 beliefs)
- **EC2 & Compute**: instance lifecycle, spot interruptions, AMI management, EBS volumes, ENI limits (113 beliefs)
- **Networking**: VPC design, security groups, NACLs, Route 53 health checks, CloudFront distributions, EIP management (129 beliefs)
- **Backup & DR**: AWS Backup, PITR, cross-region backup, lifecycle transitions that degrade DR posture (65 beliefs)
- **DAX**: caching behavior, consistency implications, cluster management (61 beliefs)
- **CloudWatch**: metrics, alarms, log groups, observability investment ceilings (54 beliefs)
- **API Gateway**: REST vs HTTP APIs, throttling, authorization, stage management (89 beliefs)
- **SQS**: visibility timeout, dead letter queues, FIFO ordering, message retention (43 beliefs)
- **AppSync**: GraphQL resolvers, caching, authorization modes (31 beliefs)
- **Lambda**: cold starts, concurrency, event source mappings, resource limits (25 beliefs)
- **Container Services**: ECS task definitions, EKS node groups, ECR lifecycle policies (52 beliefs)
- **Security**: default hardening, KMS key management, ACM certificates, FIS chaos engineering (53 beliefs)
- **Additional topics**: ElastiCache, SES, CDK, spot instances, NoSQL Workbench patterns (remaining beliefs)

## How to Use

### Import into a reasons database

```bash
reasons init
reasons import-json network.json
```

### Query beliefs

```bash
reasons search "DynamoDB capacity billing"
reasons explain lifecycle-transitions-silently-degrade-dr-posture
reasons show cloudtrail-eds-kms-key-irrevocable
```

### Use as an MCP tool or CLI

Any LLM agent that can call `reasons search`, `reasons show`, and `reasons explain` can use this knowledge base. The agent does not need to be told it is an expert — the knowledge base speaks for itself.

## Key Beliefs

| Node | Summary |
|------|---------|
| `lifecycle-transitions-silently-degrade-dr-posture` | Routine feature toggling and DR restores lose configuration state (PITR windows, audit settings) |
| `cloudtrail-eds-kms-key-irrevocable` | Once a KMS key is associated with a CloudTrail Lake event data store, it cannot be changed or removed |
| `dynamodb-ttl-deletions-not-logged-cloudtrail` | DynamoDB TTL data plane deletion actions are NOT logged by CloudTrail |
| `dynamodb-capacity-billing-penalizes-small-items-disproportionately` | DynamoDB capacity billing includes three hidden overhead mechanisms beyond raw item size |
| `aws-defaults-require-systematic-hardening-across-dimensions` | AWS default configurations systematically favor ease-of-use over security across operations |
| `full-observability-has-hard-ceiling-despite-investment` | Even after closing CloudTrail's configurable gaps, fundamental blind spots remain |
| `dynamodb-global-tables-consistency-mode-immutable` | DynamoDB Global Tables consistency mode is set at creation and cannot be changed afterward |
| `dynamodb-autoscaling-new-gsi-no-auto-scaling` | Creating a GSI on an existing DynamoDB table does not auto-enable scaling on the GSI |
| `cloudtrail-audit-blind-spots-exist-for-automated-operations` | Certain automated and system-initiated operations create audit gaps |
| `protocol-safety-unfalsifiable-under-current-testing` | Distributed protocol safety claims are unfalsifiable under the current testing methodology |

## Sources

Built from exploration of AWS documentation, API behavior, and operational experience across DynamoDB, CloudTrail, IAM, CloudFormation, RDS, S3, EC2, VPC, and 25+ additional AWS services.

## Files

| File | Description |
|------|-------------|
| `network.json` | Full belief network (machine-readable, portable) |
| `reasons.db` | SQLite database (gitignored, regenerate with `reasons import-json network.json`) |
| `CLAUDE.md` | Agent instructions for using this knowledge base |
| `entries/` | 655 exploration entries — raw observations behind the premises |

## Quality

- All 2,775 beliefs are IN (none retracted)
- 2,615 premises grounded in direct observations of AWS service behavior
- 160 derived beliefs justified from premises via SL justifications
- 0 nogoods — no contradictions detected
- Max derivation depth of 8, indicating multi-step reasoning chains
- Built and reviewed using ftl-reasons derive and review-beliefs pipeline

## Limitations

- Focused on AWS service behavior and defaults as of mid-2026
- AWS services evolve rapidly; some beliefs may become stale as features change
- Heavier coverage of DynamoDB and CloudTrail than other services
- Does not cover pricing in detail beyond capacity billing mechanics
- No ATMS or assumption-based beliefs (single-context TMS only)

## Authors

- Ben Thomasson ([@benthomasson](https://github.com/benthomasson))

## License

mit