DR Runbook Validator

What this skill does

Reads a disaster-recovery runbook and verifies that each named component (S3 bucket, RDS instance, Kubernetes service, IAM role) actually exists in the live infrastructure. Flags steps referencing components that have been renamed or retired.

Inputs

• runbook_path: markdown file containing the runbook.
• cloud: aws, gcp, or azure.
• Cloud credentials in env.
• Optional infra_state: a Terraform state file or terraform show -json output as a fallback inventory source.

Steps

1. Parse the runbook and extract candidate identifiers using regex:
   • S3: s3://[a-z0-9.\-]{3,63} and arn:aws:s3:::....
   • RDS: arn:aws:rds:... or db-identifier patterns.
   • K8s: service/<name>, deployment/<name>, namespace <ns>.
   • IAM roles: arn:aws:iam::*:role/....
2. For each identifier, run a probe:
   • S3: aws s3api head-bucket --bucket <name>.
   • RDS: aws rds describe-db-instances --db-instance-identifier <id>.
   • K8s: kubectl get <kind>/<name> -n <ns>.
   • IAM: aws iam get-role --role-name <name>.
3. Record exists or not-found per identifier, plus the step number where it appears.
4. Cross-check against infra_state if provided to disambiguate "not-found via API but expected to be created lazily".
5. Detect outdated commands: aws iam attach-role-policy flags exist; aws s3 deprecated forms; kubectl API versions removed in target cluster's K8s version.
6. Validate runbook prerequisites: any "you'll need access to..." line must reference a role or group reachable to the on-call.
7. Detect contact info staleness: phone numbers, on-call rotation links; mark as "validate manually" rather than auto-fix.
8. Emit a report.

Output

dr-runbook-validation.md with: a Pass/Warn/Fail verdict, table of identifiers and their status, deprecated-command list, and a "Manual Review" section for items the script can't validate automatically.

Verification

For each exists identifier, run a second non-destructive verification (e.g., aws s3api list-objects --max-keys 1) to confirm the bucket is not just present but accessible. For not-found identifiers, search Terraform state to determine whether the component was renamed; if so, suggest the new name. Re-run the validator after the runbook is updated; expected outcome is zero not-found rows.

Edge cases

• Runbooks referencing per-environment names with placeholders (<env>-bucket): substitute from a known env list and validate each substitution.
• Components living in another account / project: require a cross-account role; if not provided, mark unverified.
• Steps that intentionally create components ("Run terraform apply to provision X"): skip the existence check for those identifiers.
• Markdown runbook with embedded screenshots only (no parseable text): exit with "no parseable identifiers" warning.