Purpose
Produce a complete, environment-specific deployment readiness checklist — sequenced from pre-provisioning through post-go-live validation — so implementation engineers stop rebuilding checklists from memory and stop discovering missing prerequisites mid-deployment. The output is a runnable checklist calibrated to the specific cloud provider, compute type, and config management toolchain in play.
When to Use
Invoke this skill when the user asks to:
- Prepare a deployment checklist for a specific customer or environment
- Verify an environment is ready before a go-live or cutover
- Build a repeatable implementation runbook for a product deployment
- Identify prerequisites and blockers before provisioning infrastructure
- Standardize deployment steps across a services team
- Create a pre-flight or readiness gate for a release
Inputs Required
Before starting, collect:
- Cloud provider: AWS / Azure / GCP / on-prem / hybrid (name the target)
- Compute type: VM / managed Kubernetes / serverless / bare metal / container service (e.g., ECS, Cloud Run)
- Config management toolchain: Terraform, Ansible, Helm, CloudFormation, Pulumi, or manual — including CI/CD system if any
- Environment tier: Dev / staging / production (checklist rigor scales with tier)
- Deployment model: Single-tenant / multi-tenant / customer-hosted
- Compliance/security requirements: SOC 2, HIPAA, PCI, FedRAMP, or none stated
- Application dependencies: Databases, message queues, external APIs, secrets, or third-party services the app requires
If environment tier is not specified, default to production rigor and note the assumption. If compliance requirements are unstated, include a baseline security section and flag that compliance-specific controls were not applied.
Instructions
Step 1: Establish the Deployment Context Header
Open the checklist with a short context block confirming the target: cloud provider, compute type, toolchain, environment tier, deployment model, and compliance scope. This anchors every downstream item to the actual environment. Restate the assumptions made for any missing input.
Step 2: Pre-Provisioning Prerequisites
Items that must be true before any resource is created:
- Account/subscription/project access confirmed with correct permissions
- Service quotas and limits verified against expected resource footprint (name the resource types most likely to hit limits for the chosen compute type)
- Naming convention, tagging, and resource organization standard defined
- Cost estimate produced and budget/alerting approved
- Toolchain state backend configured (e.g., Terraform remote state with locking; Helm chart repository access)
- Base images, container registries, or artifacts identified and access verified
Step 3: Identity, Access, and Security Controls
Scale rigor to the environment tier and compliance scope:
- IAM roles/service accounts created with least-privilege scoping (name the specific role boundaries relevant to the compute type)
- Secrets management configured (KMS/Key Vault/Secret Manager) — no plaintext secrets in config
- Encryption at rest and in transit verified for data stores and traffic
- Network security groups / firewall rules defined and reviewed
- Audit logging enabled for control-plane and data-plane actions
- If compliance is in scope, list the specific controls that map to the stated framework
Step 4: Networking and Connectivity
- VPC/VNet, subnets, and routing defined and validated
- DNS records planned and TTLs appropriate for cutover
- Load balancer / ingress configuration and health check paths defined
- Egress requirements documented (external APIs, package repos, license servers)
- Private connectivity (VPC peering, PrivateLink, VPN, Direct Connect) confirmed if required
- Certificate provisioning and TLS termination point decided
Step 5: Configuration Management and Provisioning
Structure these items to the specific toolchain provided:
- Infrastructure-as-code validated (plan/dry-run reviewed; no unexpected destroys)
- Environment-specific variables and config separated from code
- Idempotency confirmed — re-running provisioning produces no drift
- Rollback path for infrastructure changes defined
- Pipeline stages and approval gates configured in the CI/CD system
- Config drift detection scheduled post-deployment
Step 6: Application Dependencies and Data
- Database provisioned, schema/migrations sequenced, and connection strings wired through secrets
- Message queues, caches, and stateful dependencies provisioned and reachable
- Data seeding, migration, or backfill plan defined with a validation step
- Third-party API keys, webhooks, and integrations configured and tested
- Backup and restore tested — not just enabled
Step 7: Observability and Operability
- Metrics, logs, and traces flowing to the monitoring stack
- Dashboards for the key SLIs of this compute type created
- Alerts defined with owners and escalation paths — no orphaned alerts
- Health check and readiness/liveness probes configured (critical for Kubernetes/serverless)
- Runbook links attached to each critical alert
Step 8: Deployment, Rollback, and Go-Live Validation
- Deployment strategy chosen (blue/green, canary, rolling) and appropriate for the compute type
- Rollback procedure documented and time-to-rollback estimated
- Smoke test suite defined for immediate post-deploy validation
- Cutover/DNS switch sequence with a defined rollback trigger
- Go/no-go criteria explicitly listed
- Post-go-live monitoring window and owner assigned
Step 9: Sign-Off Gate
Close with a sign-off block: named owners for infrastructure, security, and application readiness, plus a final go/no-go line. For production, require that every item in Steps 2–8 is checked or explicitly waived with a reason.
Output Format
- Structure: Context header → 8 sequenced checklist sections → sign-off gate, each item as a checkbox
- Length: 45–70 checklist items total, calibrated to environment tier
- Format: Structured checklist with
- [ ]items grouped under section headers; short context header in prose - Sections: Context Header → Pre-Provisioning → Identity/Access/Security → Networking → Config Management → Dependencies & Data → Observability → Deployment/Rollback/Go-Live → Sign-Off Gate
- Tone: Implementation engineer — precise, imperative, no filler; every item is actionable and verifiable
Quality Checklist
Before delivering output, verify:
- [ ] Every checklist item is specific to the provided cloud provider, compute type, and toolchain — not generic
- [ ] Config management items reference the actual toolchain named in inputs
- [ ] Security section rigor matches the stated environment tier and compliance scope (or notes the default assumption)
- [ ] Rollback and go/no-go criteria are explicitly defined, not implied
- [ ] Compute-type-specific items are present (e.g., readiness probes for Kubernetes, cold-start/timeout for serverless)
- [ ] Sign-off gate names owner roles for infrastructure, security, and application readiness
Notes
- The two most commonly skipped items in real deployments are quota verification (Step 2) and tested backup restore (Step 6) — never let these become checkboxes that get waived silently.
- For multi-tenant deployments, add explicit tenant isolation checks under Step 3; for customer-hosted, add a section confirming the customer's environment meets the documented minimum requirements.
- Serverless deployments should emphasize concurrency limits, cold-start behavior, and timeout ceilings; Kubernetes deployments should emphasize resource requests/limits, probes, and namespace RBAC.
- Treat dev-tier checklists as a lighter subset — but keep the security and rollback items, since dev environments are the most common source of leaked credentials.
How to use this skill
This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.
Installing in Claude Code:
~/.claude/skills/<folder-name>/SKILL.md— auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)<your-project>/.claude/skills/<folder-name>/SKILL.md— auto-loads only when working in that project (recommended for project-specific skills)
Restart Claude Code or open a new session to register.
Using in Claude.ai, ChatGPT, Gemini, or other AI tools:
- Drag this file into a new chat, or copy and paste its contents
- Send your task or request as your next message — the AI will apply the skill where it fits
For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills