Add storage-fsx-windows-sla-optimizer skill

[benlec]

Description

Adds a new read-only skill, storage-fsx-windows-sla-optimizer, that performs a
structured SLA-readiness and availability review of Amazon FSx for Windows File Server
file systems and surfaces cost-optimization opportunities.

Given one or more file-system IDs (or a region to discover them in), it evaluates each
file system across seven availability dimensions — deployment type (Single-AZ vs
Multi-AZ), Active Directory health, throughput capacity (peak-aware), storage headroom,
backups, maintenance window, and CloudWatch alarm coverage — and returns a rated report
(High / Medium / Low / Indeterminate) with prioritized findings and remediation. It adds
usage-pattern trend analysis (peak-aware throughput sizing, weekday/weekend profile, and
storage-growth projection) and flags heavily over-provisioned or idle capacity as 💰
advisory cost notes that never lower the SLA rating. Single- vs multi-file-system (fleet)
reviews route automatically by count.

The skill is strictly read-only: control-plane Describe*/GetMetricData calls only, no
SMB/data-plane access, no mutating operations. It is fully covered by the
AIDevOpsAgentAccessPolicy managed policy and needs no additional IAM.

Type of change

• New skill
• New custom agent
• Update to an existing skill or agent
• Documentation or infrastructure change

Testing

Validated two complementary ways.

1. Agent Skill Eval (aws-samples/sample-agent-skill-eval) — the skill ships
evals/ (16 functional cases + 8 trigger queries + mock fixtures) and a .skilleval.yaml.

• Audit: 100/100, Grade A (0 critical, 0 warning, 0 info).
• Functional: PASSED — with-skill vs without-skill delta +22.5% across 16 cases
  (with-skill ~92–98% across runs; without-skill ~70%). Includes fixture-based cases for
  the trend engine (weekday-peaker, idle, storage-filler) and a MISCONFIGURED / Critical
  AD case (with=100% / without=0%).
• Trigger: PASSED — 100% trigger precision and 100% no-trigger precision (8/8),
  including deliberate near-miss negatives (S3 cost question; FSx for NetApp ONTAP).
• Note: the eval was run with a local coding-agent CLI as the runner (the framework's
  default claude CLI was unavailable, so a pluggable runner was used). Token/tool-call
  metadata isn't emitted by that runner, so the eval's process/efficiency sub-scores read
  as 0; the outcome/style/trigger dimensions and the with/without delta are unaffected.

2. Manual AWS DevOps Agent testing — the skill was uploaded to an AgentSpace and run
against real FSx for Windows infrastructure (a purpose-built test fleet). Confirmed live:
a Medium multi-warning case, a High case (after adding alarm coverage), the 💰
cost-optimization lens on an over-provisioned file system, and a multi-file-system fleet
review (distribution summary + comparison matrix). The Critical/MISCONFIGURED path is
covered by the fixture-based eval case above (a live MISCONFIGURED state was not forced,
as FSx does not reliably flip lifecycle from network isolation alone).

llms.txt is updated with the skill entry. The auto-generated Skills Catalog picks the
skill up from its SKILL.md frontmatter (aws-devops-agent-skills.* metadata), so no
manual README table edit is required.

License confirmation

• By submitting this pull request, I confirm that my contribution is made under the terms of the Apache License 2.0.