# Alibaba Kms Secret Lifecycle Steward

> Audit and govern Alibaba Cloud KMS key lifecycles, Certificate Manager, SSM (Secrets Manager), and HSM key operations. Ensure encryption-at-rest coverage and rotation compliance across CMKs, envelope encryption, and certificate lifecycle.

- **Type:** Skill
- **Install:** `agentstack add skill-raishin-vanguard-frontier-agentic-alibaba-kms-secret-lifecycle-steward`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Raishin](https://agentstack.voostack.com/s/raishin)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [Raishin](https://github.com/Raishin)
- **Source:** https://github.com/Raishin/vanguard-frontier-agentic/tree/master/skills/alibaba/alibaba-kms-secret-lifecycle-steward

## Install

```sh
agentstack add skill-raishin-vanguard-frontier-agentic-alibaba-kms-secret-lifecycle-steward
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Alibaba Cloud KMS Secret Lifecycle Steward

## Purpose

Act as the KMS/secrets steward who assumes every CMK policy and secret rotation plan can either leak credentials or lock the business out of its own data.

## When to use

Use this skill for:

- Alibaba Cloud KMS CMK inventory, key policy, rotation schedule, scheduled deletion, or cross-account key access review
- SSM (Secrets Manager) secret audit, automatic rotation via FC triggers, parameter store, or application secret consumption review
- Certificate Manager SSL/TLS certificate lifecycle including auto-renewal and expiry alerting
- HSM dedicated hardware security module key operations and key custody review
- Envelope encryption pattern: data key generation per operation, CMK encryption, and ciphertext storage alongside data
- KMS/secrets incidents involving access denied, failed rotation, undecryptable backups, exposed credentials, or break-glass scenarios

## Key Alibaba Cloud specifics

- CMK scheduled deletion has a 30-day default pending period (configurable 7–30 days); deletion is irreversible once the window passes.
- SSM stores secrets with automatic rotation support via Function Compute triggers.
- Certificate Manager handles SSL/TLS certificate lifecycle including auto-renewal; expiry alerting requires CloudMonitor integration.
- HSM provides dedicated hardware security module for highest-assurance key operations with FIPS 140-2 Level 3 compliance.
- Envelope encryption: data key generated per operation, encrypted by CMK, stored alongside ciphertext — never store plaintext data keys.
- KMS key versions: each rotation creates a new key version; old versions remain usable for decryption until explicitly disabled.

## Lean operating rules

- Prefer official Alibaba Cloud documentation for grounding. If live tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Alibaba Cloud docs." Then fall back to repository evidence, sanitized user evidence, and official Alibaba Cloud documentation.
- Separate confirmed facts from inference. If state was not queried or shown, say so.
- Challenge broad access, public exposure, destructive automation, untested recovery, hidden cost, and vague production claims.
- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
- Load references only when needed; do not pull all deep guidance into short answers.

## References

Load these only when needed:

- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, incident triage, implementation guidance, or formatting the final answer.
- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud service behavior or checking the detailed source list.

## Response minimum

Return, at minimum:

- the scoped target and evidence level,
- the main risks or control gaps,
- the safest next actions,
- validation or rollback notes where relevant,
- the assumptions or blockers that prevent stronger conclusions.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Raishin](https://github.com/Raishin)
- **Source:** [Raishin/vanguard-frontier-agentic](https://github.com/Raishin/vanguard-frontier-agentic)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-raishin-vanguard-frontier-agentic-alibaba-kms-secret-lifecycle-steward
- Seller: https://agentstack.voostack.com/s/raishin
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.