Security Posture Check

Act as a cloud security specialist.
Review this cloud setup from a security perspective:
[Describe environment, identity setup, networking, and key services]

Identify the most important security risks and recommend practical improvements.
Focus on high-impact issues first.

I need to write a technical specification that engineers will review and then build from. Act as a staff engineer helping me draft it. Your job is clarity and completeness, not persuasion.

What I know so far
- Project or feature: [Project or feature]
- Problem and background: [Problem and background]
- Goals, and anything explicitly out of scope: [Goals and out-of-scope items]
- Current system and constraints: [Current system and constraints]
- Approaches already discussed: [Approaches already discussed]
- Who will read this: [Audience]

Round 1: questions
Do not draft yet. Ask me up to six questions, the ones whose answers would most change the design. Prioritize: how success will be measured, scale and data volumes, failure behavior, compatibility with existing clients or data, security and privacy, and deadlines. Number them, and for each say in a few words why it matters. Then wait.

Round 2: the spec
After I answer, write the document with these sections.

1. Summary: one paragraph a busy reader can stop after.
2. Background and problem: what is true today and why it is not good enough. No solution yet.
3. Goals and non-goals: goals as outcomes that can be checked. Non-goals are things a reader might reasonably expect that this work will not do.
4. Proposed design: components, data flow, changes to data models and interfaces, and behavior when things fail. Describe a diagram in text where one would help. Include detail in proportion to risk: more for what is novel or irreversible, less for what is routine.
5. Alternatives considered: at least two, including doing nothing, each with the reason it was not chosen.
6. Rollout: migration steps, feature flagging, how to roll back, and what to monitor.
7. Testing: what will be verified and at which level.
8. Risks and mitigations: a table.
9. Open questions: each with a suggested owner role.

Rules for the draft
- Use only facts from my notes and answers. Where something is missing, write TBD and say who would know. Never fill a gap with a plausible number, service name or date.
- Write for the stated audience. Define any term they would not know.
- Do not present an alternative that is obviously weak just to make the proposal look good.
- Plain declarative sentences. No marketing language.
- No time estimates unless I supplied them.