iac-cdklisted

# AWS CDK Discipline The operational discipline for AWS CDK as the active IaC tool. CDK synthesizes CloudFormation, so it inherits CloudFormation's behavior. Pairs with the `cloud-architecture-aws` pack (service-level detail) and the `aws-deployment-preflight` skill (the pre-deploy gate). Project file layout and account/region facts come from `CLAUDE.md`. ## Core stance - **Infrastructure is software** — and CDK makes that literal: it's real TypeScript/ Python. Apply the same discipline (types, tests, no copy-paste, narrow interfaces) you'd apply to app code. Resist the temptation to be "clever" in synth-time logic. - **CDK is a CloudFormation generator.** What deploys is the synthesized template. When in doubt, read `cdk synth` output — the abstraction is convenient, not magic. - **`cdk diff` is the contract.** Never `deploy` without reading the diff. It shows resource changes *and* IAM/security changes (the `--require-approval` gate) — review security deltas deliberately, never rubber-stamp. ## App & stack structure ``` bin/<app>.ts # the App: instantiates stacks, sets env (account/region) lib/ <x>-stack.ts # one stack per deployment unit / lifecycle boundary constructs/ # reusable L3 constructs (your own abstractions) cdk.json # app entry + context ``` - **Separate stacks by lifecycle and blast radius** — e.g. network / data / compute / edge / security. A stateful stack (databases, buckets) should be independently dep