feat(deploy-on-aws): improve EB skill with IAM scanning hint and doc links

Add guidance for agents to scan source code for AWS SDK usage to determine
instance profile permissions. Rewrite configuration.md to patterns + public
doc links for maintainability. Fix option settings precedence (remove platform
hooks), switch secrets example to native environmentsecrets namespace.

Author: azpaulp

plugins/deploy-on-aws/skills/elastic-beanstalk/SKILL.md

@@ -132,7 +132,10 @@ Apply these automatically:
 - Web server instances in private subnets behind ALB
 - Worker instances in private subnets with NAT Gateway for outbound
 - HTTPS via ACM certificate on ALB (web server environments)
-- IAM instance profile with least-privilege permissions
+- IAM instance profile with least-privilege permissions — scan source code for
+  AWS SDK client usage to determine required actions (e.g.,
+  `AmazonBedrockRuntimeClient` → `bedrock:InvokeModel`,
+  `AmazonS3Client` → `s3:GetObject`/`s3:PutObject` on specific buckets)
 - Enhanced health reporting enabled
 - Managed platform updates enabled
 - Security groups: ALB accepts 443, instances accept only from ALB

plugins/deploy-on-aws/skills/elastic-beanstalk/references/configuration.md

@@ -2,36 +2,22 @@
 
 ## Configuration Hierarchy
 
-Elastic Beanstalk configuration is applied in this order (later overrides earlier
-for option settings):
+Option settings are applied in this order (later overrides earlier):
 
 1. Platform defaults (managed by AWS)
 2. Saved configurations (reusable templates)
 3. `.ebextensions/*.config` files (in source bundle)
-4. Platform hooks (`/platform/hooks/prebuild/`, `predeploy/`, `postdeploy/`)
-5. Environment properties (set via console/CLI/API)
+4. Environment properties (set via console/CLI/API)
 
-For option settings, later sources override earlier ones. `.ebextensions` and
-platform hooks also support resource declarations and deploy-time commands that
-are not expressible as option settings.
+Platform hooks (`/platform/hooks/prebuild/`, `predeploy/`, `postdeploy/`) run
+shell scripts during deployment lifecycle but do not set option settings.
+They are the preferred customization mechanism on AL2023 for non-option-setting
+tasks. Use `.ebextensions/` for option settings and resource declarations.
 
-Platform hooks are the preferred customization mechanism on AL2023. Use
-`.ebextensions/` for option settings and resource declarations; use platform
-hooks for shell scripts that run during deployment lifecycle.
+See [Configuration options precedence](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options.html#configuration-options-precedence)
+for full details.
 
-## `.ebextensions/` Patterns
-
-Place YAML `.config` files in `.ebextensions/` at the source bundle root.
-Common patterns:
-
-### Install system packages
-
-```yaml
-packages:
-  yum:
-    ImageMagick: []
-    postgresql-devel: []
-```
+## Key Patterns
 
 ### Run commands on deploy
 
@@ -45,7 +31,7 @@ container_commands:
 Use `leader_only: true` for commands that should run on only one instance
 (database migrations, cache warmup).
 
-## Procfile
+### Procfile
 
 Define the process to run. EB uses this instead of platform defaults:
 
@@ -59,19 +45,23 @@ HTTP, not a message broker SDK).
 
 ## Environment Properties and Secrets
 
-Set application configuration as environment variables. Never hardcode secrets
-in `.ebextensions/` or source code. Reference secrets via Secrets Manager:
+Non-secret config uses `aws:elasticbeanstalk:application:environment`. For
+secrets, use the native secrets integration which injects Secrets Manager
+values as environment variables without application-side SDK calls:
 
 ```yaml
 option_settings:
   aws:elasticbeanstalk:application:environment:
-    DB_SECRET_ARN: arn:aws:secretsmanager:us-east-1:123456789:secret:myapp/db
     APP_ENV: production
+  aws:elasticbeanstalk:application:environmentsecrets:
+    DB_PASSWORD: arn:aws:secretsmanager:us-east-1:123456789:secret:myapp/db
 ```
 
-The application reads the secret value at runtime using the Secrets Manager SDK.
-Provision databases and secrets as separate resources (via CDK, Terraform, or
-console) — not coupled to the EB environment lifecycle.
+Never hardcode secrets in `.ebextensions/` or source code. Provision databases
+and secrets as separate resources — not coupled to the EB environment lifecycle.
+
+See [Environment secrets](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuration-envvars.html#configuration-envvars-secrets)
+for supported secret sources.
 
 ## Deployment Policies
 
@@ -84,21 +74,29 @@ console) — not coupled to the EB environment lifecycle.
 
 Default: All at once for dev, Rolling with additional batch for production.
 
-## Health Check Configuration
+See [Deployment policies and settings](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.rolling-version-deploy.html)
+for configuration details.
 
-```yaml
-option_settings:
-  aws:elasticbeanstalk:environment:process:default:
-    HealthCheckPath: /health
-    HealthCheckInterval: '15'
-    HealthyThresholdCount: '3'
-    UnhealthyThresholdCount: '5'
-```
+## Health Check
 
 Always configure a dedicated health check endpoint. Do not use `/` if it
 performs database queries or heavy computation.
 
-The agent should verify that the application exposes a health check endpoint
+The agent should verify that the application exposes a health endpoint
 (default: `/health`). If no health route exists, scaffold a minimal one that
 returns 200 OK. The ALB health check will fail without this, causing deployment
 to roll back.
+
+See [Health check setting](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/environments-cfg-alb.html#environments-cfg-alb-health)
+for ALB health check configuration.
+
+## Heroku Migration
+
+When migrating from Heroku/Render/Railway, audit for these patterns:
+
+- `DATABASE_URL` → Provision RDS/Aurora separately, pass via environment secrets
+- `REDIS_URL` → Provision ElastiCache, pass endpoint via environment properties
+- Add-on env vars (e.g., `SENDGRID_API_KEY`) → Store in Secrets Manager
+- `PORT` → EB sets this automatically, no change needed
+- `Procfile` → Works as-is (same format)
+- Explicit AWS credentials → Remove; use IAM instance profile instead