[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M699118XFHCBXE2MTXM5FEHC":3,"skill-same:01M699118XFHCBXE2MTXM5FEHC":117},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":52,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":6,"ownerHtmlUrl":57,"ownerBlogUrl":58,"ownerDescription":59,"updatedAt":60,"install":61,"resources":74},"01M699118XFHCBXE2MTXM5FEHC","cloud-monitoring-notification-channels-configuration",null,"Generates Terraform HCL configurations for Cloud Monitoring notification channels (`google_monitoring_notification_channel`) and adds notification channels to alerting policies (`google_monitoring_alert_policy`) in Google Cloud projects. Use when creating or configuring email, SMS, Slack, PagerDuty, Pub\u002FSub, or webhook notification channels, verifying Pub\u002FSub topic compatibility (including cross-project topics, message storage policies, and in-transit enforcement) and publishing permissions for the Cloud Monitoring Service Agent, or adding notification channels to existing alert policies. Don't use for authoring or editing alerting policy conditions, selecting metric descriptors, or writing PromQL or Monitoring Filter queries.","google\u002Fskills","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M698WR0H76ENHE587T9EJT89",23830,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-monitoring-notification-channels-configuration\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,9],"notification","cloud monitoring notification channels configuration","channels","monitoring","cloud","configuration","cloud monitoring","when","writing","promql","filter","webhook","project","message","pagerduty","projects","alerting","permissions","google cloud","slack","2026-11-10 10:12:30",false,"---\nname: cloud-monitoring-notification-channels-configuration\nmetadata:\n  version: \"1.0.2\"\n  category: CloudObservabilityAndMonitoring\ndescription: >-\n  Generates Terraform HCL configurations for Cloud Monitoring notification\n  channels (`google_monitoring_notification_channel`) and adds notification\n  channels to alerting policies (`google_monitoring_alert_policy`) in Google\n  Cloud projects. Use when creating or configuring email, SMS, Slack, PagerDuty,\n  Pub\u002FSub, or webhook notification channels, verifying Pub\u002FSub topic\n  compatibility (including cross-project topics, message storage policies, and\n  in-transit enforcement) and publishing permissions for the Cloud Monitoring\n  Service Agent, or adding notification channels to existing alert policies.\n  Don't use for authoring or editing alerting policy conditions, selecting\n  metric descriptors, or writing PromQL or Monitoring Filter queries.\n---\n\n# Cloud Monitoring Notification Channels Configuration\n\n## Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read [Usage Attribution](references\u002Fattribution.md). For commands executed\ndirectly in the terminal (never in generated scripts, Terraform, or user code),\nprefix `gcloud` with\n`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:cloud-monitoring-notification-channels-configuration)\"`\nand append `agent-skills\u002F1.0 (skill:cloud-monitoring-notification-channels-configuration)` to `User-Agent` headers.\n\n## Context Provided\n\n*   **Terraform Only**: Write the generated observability configuration ONLY as\n    Terraform (`.tf`) files (e.g., `notification_channels.tf`).\n    -   Install Terraform **ONLY** if you are asked to deploy the channels AND\n        there is no valid Terraform installation.\n    -   If you are **NOT** asked to deploy the channels, **DO NOT** install\n        Terraform.\n*   **Working Directory Inference**: Determine the target path for `.tf` files\n    using the following order:\n    1.  If the user provides a path, use that exact path for the `.tf` file.\n    2.  If a path is not provided, search the workspace for existing `.tf` files\n        (preferring files that already define\n        `google_monitoring_notification_channel` or\n        `google_monitoring_alert_policy` resources, or existing directories in\n        the strict preference order: `monitoring\u002F`, then `ops\u002F`, then `sre\u002F`).\n        If found, write `notification_channels.tf` in that directory (or update\n        the existing `.tf` file when modifying an existing resource).\n    3.  If a path is not provided and no `.tf` files or target directories exist\n        in the workspace, create and write to\n        `monitoring\u002Fnotification_channels.tf`.\n*   **Google Cloud Prerequisites**: When running `gcloud` CLI discovery commands\n    or deploying configurations with the `terraform` CLI against a Google Cloud\n    project, ensure the following prerequisites are met in order (do not execute\n    these commands if the user only asks to generate or print Terraform HCL):\n    1.  **Target Project ID & Project Number**:\n        *   Identify the target Google Cloud `{project_id}` from the user's\n            request or via `gcloud config get-value project`. If neither is\n            available, prompt the user to provide `{project_id}` before\n            continuing.\n        *   When the Google Cloud project number (`{project_number}`) is needed\n            (such as constructing the Cloud Monitoring Service Agent identity\n            for Pub\u002FSub channels):\n            *   **Method A (Standard)**: Run `gcloud projects describe\n                {project_id} --format='value(projectNumber)'`.\n            *   **Method B (Ask User)**: If the command fails or you cannot\n                retrieve the project number, ask the user to provide it.\n    2.  **Authentication**: Authenticate the `gcloud` CLI via `gcloud auth\n        login` and configure Application Default Credentials (ADC) for Terraform\n        via `gcloud auth application-default login`.\n    3.  **Project Configuration & Billing**: Configure the target Google Cloud\n        project via `gcloud config set project {project_id}` (and ensure the\n        project has an active billing account attached).\n        *   **Recovery Actions**: If `gcloud config set project {project_id}` or\n            `gcloud projects describe {project_id}` fails, verify active\n            credentials with `gcloud auth list`, list accessible projects with\n            `gcloud projects list`, or prompt the user to confirm the project ID\n            and access permissions. If deployment fails due to a missing or\n            inactive billing account, stop deployment and instruct the user to\n            link an active billing account (via `gcloud billing projects link\n            {project_id} --billing-account={account_id}` or in the Google Cloud\n            console) before retrying.\n    4.  **IAM Permissions**: Ensure the principal has permission to manage\n        notification channels—either via the predefined Monitoring\n        NotificationChannel Editor role\n        (`roles\u002Fmonitoring.notificationChannelEditor`, plus\n        `roles\u002Fmonitoring.alertPolicyEditor` when adding a channel to an\n        existing alert policy) **or via a custom IAM role** containing the\n        equivalent permissions (`monitoring.notificationChannels.get`,\n        `monitoring.notificationChannels.list`,\n        `monitoring.notificationChannels.create`,\n        `monitoring.notificationChannels.update`,\n        `monitoring.notificationChannels.delete`, and\n        `monitoring.alertPolicies.get` \u002F `monitoring.alertPolicies.update` when\n        updating an alert policy).\n        *   **Recovery Actions**: Users with a custom role granting these\n            permissions do not need the predefined role name. If a `gcloud` or\n            `terraform` command fails with `PERMISSION_DENIED` (HTTP 403), stop\n            execution, identify the missing `monitoring.notificationChannels.*`\n            or `monitoring.alertPolicies.*` permission, and instruct the user to\n            ask a project administrator to grant\n            `roles\u002Fmonitoring.notificationChannelEditor` (or a custom role with\n            the required permissions) to their principal.\n*   **Discovery Tips**:\n    *   **Listing Notification Channels**: You MUST use `gcloud beta monitoring\n        channels list --project={project_id}` to list notification channels. Do\n        **NOT** use any other `gcloud` commands to list notification channels.\n    *   **Verifying Pub\u002FSub Topics**: When configuring a Pub\u002FSub notification\n        channel, run\n        [`scripts\u002Fverify_pubsub_topic.sh`](scripts\u002Fverify_pubsub_topic.sh)\n        `{monitoring_project_id} {topic_name_or_path}` to verify that:\n        1.  The Pub\u002FSub API (`pubsub.googleapis.com`) is enabled in the topic's\n            project (supporting both same-project topics and cross-project\n            topics specified as\n            `projects\u002F{topic_project_id}\u002Ftopics\u002F{topic_name}`).\n        2.  The topic exists and the monitoring project's Cloud Monitoring\n            Service Agent\n            (`service-{monitoring_project_number}@gcp-sa-monitoring-notification.iam.gserviceaccount.com`)\n            holds `roles\u002Fpubsub.publisher` on the topic or topic project.\n        3.  The topic does **not** define a message storage policy\n            (`messageStoragePolicy` \u002F `message_storage_policy`) and does **not**\n            have in-transit enforcement (`enforceInTransit` \u002F\n            `enforce_in_transit`) enabled. **DO NOT** use a Pub\u002FSub topic that\n            defines a message storage policy or enforces in-transit restrictions\n            as a notification channel, because Cloud Monitoring cannot deliver\n            messages to such topics.\n*   **Attribution**: You MUST tag EVERY applicable command and Terraform\n    resource below that you create, modify, or suggest to the user.\n\n    *   **Terraform HCL (`user_labels`)**:\n        *   Every `google_monitoring_notification_channel` resource that you\n            create MUST include the `created-with-google-skill` label in its\n            `user_labels` block:\n\n            ```terraform\n            user_labels = {\n              created-with-google-skill = \"cloud-monitoring-notification-channels-configuration\"\n            }\n            ```\n\n        *   When modifying an existing `google_monitoring_alert_policy` resource\n            solely to add a notification channel, do **not** use\n            `created-with-google-skill` (since this skill did not create the\n            alerting policy). Instead, include the\n            `added-channel-with-google-skill` label in its `user_labels` block\n            (preserving any existing `user_labels` on the policy):\n\n            ```terraform\n            user_labels = {\n              added-channel-with-google-skill = \"cloud-monitoring-notification-channels-configuration\"\n            }\n            ```\n\n    *   Follow the instructions below based on the CLI tool being used:\n\n        *   **gcloud:** Prefix every `gcloud` invocation with the metrics\n            environment variables. Set them inline on each command; shell state\n            may not persist between commands:\n\n            ```bash\n            CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:cloud-monitoring-notification-channels-configuration)\" \\\n                gcloud \u003Ccommand> [flags]\n            ```\n\n        *   **Direct HTTP calls:** For direct HTTP calls (e.g. `curl`), you MUST\n            pass the explicit `-H \"User-Agent: ...\"` header in the shell command\n            syntax exactly like this:\n\n            ```bash\n            curl -H \"User-Agent: agent-skills\u002F1.0 (skill:cloud-monitoring-notification-channels-configuration)\" ...\n            ```\n\n        *   **Terraform:** Prefix every Terraform `plan` and `apply` invocation\n            with the metrics environment variables. Set them inline on each\n            command; shell state may not persist between commands. For example:\n\n            ```bash\n            GOOGLE_TERRAFORM_USERAGENT_EXTENSION=\"agent-skills\u002F1.0 (skill:cloud-monitoring-notification-channels-configuration)\" \\\n                terraform plan [flags]\n            ```\n\n    *   If the skill instructions provide an additional skill script name,\n        include that script name in the attribution label. Using a `gcloud`\n        command inside\n        [`scripts\u002Fverify_pubsub_topic.sh`](scripts\u002Fverify_pubsub_topic.sh) as an\n        example:\n\n        ```bash\n        CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:cloud-monitoring-notification-channels-configuration; script:verify_pubsub_topic)\" \\\n            gcloud \u003Ccommand> [flags]\n        ```\n\n*   **Execution Note (State Refresh Timeout Recovery)**: When running `terraform\n    plan` or `terraform apply`, set a command timeout of **120 seconds**. If the\n    command does not complete within 120 seconds (indicating Terraform is\n    stalling on a full state refresh across a large state file rather than\n    normal execution), cancel the command and retry **at most once** by running\n    `terraform plan` and `terraform apply` with `-target` scoped to the specific\n    resources being created or updated (for example,\n    `-target=google_monitoring_notification_channel.\u003Cresource_name>` and, if\n    updating an alert policy,\n    `-target=google_monitoring_alert_policy.\u003Cpolicy_name>`). If the targeted\n    retry also times out after 120 seconds or fails, **DO NOT** retry again;\n    stop execution and report the timeout or error to the user.\n\n## Generation\n\n### Input Assumptions (checklist)\n\n*   **Notification Channel Type**: When creating a new notification channel, the\n    user MUST provide the notification channel type to configure.\n    -   If no type is provided (and the user is not attaching an existing\n        notification channel to an alert policy), you MUST prompt the user to\n        ask for a type before continuing.\n*   **Sensitive Credentials File**: Some notification channels require the use\n    of sensitive credentials in their configuration. You MUST verify that the\n    user has a `secret.tfvars` file in the working directory. If the file does\n    not exist, create one using the template provided in\n    [`assets\u002Fsecret.tfvars`](assets\u002Fsecret.tfvars) and notify the user that\n    credentials should be stored there.\n\n### Execution Steps\n\n1.  Open the reference file corresponding to the notification channel the user\n    wants to configure:\n\n    Notification Channel Type | Reference File\n    :------------------------ | :----------------------------------------\n    **email**                 | [email.md](references\u002Femail.md)\n    **sms**                   | [sms.md](references\u002Fsms.md)\n    **slack**                 | [slack.md](references\u002Fslack.md)\n    **pubsub**                | [pubsub.md](references\u002Fpubsub.md)\n    **pagerduty**             | [pagerduty.md](references\u002Fpagerduty.md)\n    **webhook**               | [webhook.md](references\u002Fwebhook.md)\n\n2.  Follow the guidelines in the `Prerequisites` section (if any) to complete\n    all requirements for the channel configuration.\n\n3.  If the reference file contains a `Required Credentials` section under\n    `Specification`, you MUST confirm that the listed required credentials are\n    configured in the `secret.tfvars` file.\n\n    -   If any of the credentials are set to empty or not found in the file, you\n        MUST prompt the user to provide them before proceeding.\n\n4.  Use the template provided in the `Terraform HCL` section under\n    `Specification` inside the reference file replacing the specified variables\n    as needed to write the new configuration into the output file. If the user\n    explicitly specifies a `display_name` for the notification channel, set\n    `display_name` to that exact string instead of the default\n    `\"\u003CType> Notification Channel (...)\"` template string.\n\n5.  **Adding a Channel to an Existing Alert Policy**: When modifying an existing\n    `google_monitoring_alert_policy` resource to use an existing\n    `google_monitoring_notification_channel` resource (without creating a new\n    channel), set `notification_channels` on the\n    `google_monitoring_alert_policy` block and set the\n    `added-channel-with-google-skill` label to\n    `\"cloud-monitoring-notification-channels-configuration\"` in its\n    `user_labels` block (preserving any existing `user_labels`):\n\n    ```terraform\n    notification_channels = [\n      google_monitoring_notification_channel.\u003Cchannel_resource_name>.name,\n    ]\n    user_labels = {\n      added-channel-with-google-skill = \"cloud-monitoring-notification-channels-configuration\"\n    }\n    ```\n\n### Outputs & Formats\n\nWrite all channel configurations into a `notification_channels.tf` file under\nthe directory chosen in the #context-provided section (or update the target\n`.tf` file when adding notification channels to an existing\n`google_monitoring_alert_policy`). Ensure every generated\n`google_monitoring_notification_channel` resource sets\n`created-with-google-skill` to\n`\"cloud-monitoring-notification-channels-configuration\"` in `user_labels`, and\nevery modified `google_monitoring_alert_policy` resource sets\n`added-channel-with-google-skill` to\n`\"cloud-monitoring-notification-channels-configuration\"` in `user_labels`.\n\n--------------------------------------------------------------------------------\n\n## Supporting Links\n\n*   [Create and manage notification channels](https:\u002F\u002Fdocs.cloud.google.com\u002Fmonitoring\u002Fsupport\u002Fnotification-options.md.txt)\n","# Cloud Monitoring Notification Channels Configuration\n\n## Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read [Usage Attribution](references\u002Fattribution.md). For commands executed\ndirectly in the terminal (never in generated scripts, Terraform, or user code),\nprefix `gcloud` with\n`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:cloud-monitoring-notification-channels-configuration)\"`\nand append `agent-skills\u002F1.0 (skill:cloud-monitoring-notification-channels-configuration)` to `User-Agent` headers.\n\n## Context Provided\n\n*   **Terraform Only**: Write the generated observability configuration ONLY as\n    Terraform (`.tf`) files (e.g., `notification_channels.tf`).\n    -   Install Terraform **ONLY** if you are asked to deploy the channels AND\n        there is no valid Terraform installation.\n    -   If you are **NOT** asked to deploy the channels, **DO NOT** install\n        Terraform.\n*   **Working Directory Inference**: Determine the target path for `.tf` files\n    using the following order:\n    1.  If the user provides a path, use that exact path for the `.tf` file.\n    2.  If a path is not provided, search the workspace for existing `.tf` files\n        (preferring files that already define\n        `google_monitoring_notification_channel` or\n        `google_monitoring_alert_policy` resources, or existing directories in\n        the strict preference order: `monitoring\u002F`, then `ops\u002F`, then `sre\u002F`).\n        If found, write `notification_channels.tf` in that directory (or update\n        the existing `.tf` file when modifying an existing resource).\n    3.  If a path is not provided and no `.tf` files or target directories exist\n        in the workspace, create and write to\n        `monitoring\u002Fnotification_channels.tf`.\n*   **Google Cloud Prerequisites**: When running `gcloud` CLI discovery commands\n    or deploying configurations with the `terraform` CLI against a Google Cloud\n    project, ensure the following prerequisites are met in order (do not execute\n    these commands if the user only asks to generate or print Terraform HCL):\n    1.  **Target Project ID & Project Number**:\n        *   Identify the target Google Cloud `{project_id}` from the user's\n            request or via `gcloud config get-value project`. If neither is\n            available, prompt the user to provide `{project_id}` before\n            continuing.\n        *   When the Google Cloud project number (`{project_number}`) is needed\n            (such as constructing the Cloud Monitoring Service Agent identity\n            for Pub\u002FSub channels):\n            *   **Method A (Standard)**: Run `gcloud projects describe\n                {project_id} --format='value(projectNumber)'`.\n            *   **Method B (Ask User)**: If the command fails or you cannot\n                retrieve the project number, ask the user to provide it.\n    2.  **Authentication**: Authenticate the `gcloud` CLI via `gcloud auth\n        login` and configure Application Default Credentials (ADC) for Terraform\n        via `gcloud auth application-default login`.\n    3.  **Project Configuration & Billing**: Configure the target Google Cloud\n        project via `gcloud config set project {project_id}` (and ensure the\n        project has an active billing account attached).\n        *   **Recovery Actions**: If `gcloud config set project {project_id}` or\n            `gcloud projects describe {project_id}` fails, verify active\n            credentials with `gcloud auth list`, list accessible projects with\n            `gcloud projects list`, or prompt the user to confirm the project ID\n            and access permissions. If deployment fails due to a missing or\n            inactive billing account, stop deployment and instruct the user to\n            link an active billing account (via `gcloud billing projects link\n            {project_id} --billing-account={account_id}` or in the Google Cloud\n            console) before retrying.\n    4.  **IAM Permissions**: Ensure the principal has permission to manage\n        notification channels—either via the predefined Monitoring\n        NotificationChannel Editor role\n        (`roles\u002Fmonitoring.notificationChannelEditor`, plus\n        `roles\u002Fmonitoring.alertPolicyEditor` when adding a channel to an\n        existing alert policy) **or via a custom IAM role** containing the\n        equivalent permissions (`monitoring.notificationChannels.get`,\n        `monitoring.notificationChannels.list`,\n        `monitoring.notificationChannels.create`,\n        `monitoring.notificationChannels.update`,\n        `monitoring.notificationChannels.delete`, and\n        `monitoring.alertPolicies.get` \u002F `monitoring.alertPolicies.update` when\n        updating an alert policy).\n        *   **Recovery Actions**: Users with a custom role granting these\n            permissions do not need the predefined role name. If a `gcloud` or\n            `terraform` command fails with `PERMISSION_DENIED` (HTTP 403), stop\n            execution, identify the missing `monitoring.notificationChannels.*`\n            or `monitoring.alertPolicies.*` permission, and instruct the user to\n            ask a project administrator to grant\n            `roles\u002Fmonitoring.notificationChannelEditor` (or a custom role with\n            the required permissions) to their principal.\n*   **Discovery Tips**:\n    *   **Listing Notification Channels**: You MUST use `gcloud beta monitoring\n        channels list --project={project_id}` to list notification channels. Do\n        **NOT** use any other `gcloud` commands to list notification channels.\n    *   **Verifying Pub\u002FSub Topics**: When configuring a Pub\u002FSub notification\n        channel, run\n        [`scripts\u002Fverify_pubsub_topic.sh`](scripts\u002Fverify_pubsub_topic.sh)\n        `{monitoring_project_id} {topic_name_or_path}` to verify that:\n        1.  The Pub\u002FSub API (`pubsub.googleapis.com`) is enabled in the topic's\n            project (supporting both same-project topics and cross-project\n            topics specified as\n            `projects\u002F{topic_project_id}\u002Ftopics\u002F{topic_name}`).\n        2.  The topic exists and the monitoring project's Cloud Monitoring\n            Service Agent\n            (`service-{monitoring_project_number}@gcp-sa-monitoring-notification.iam.gserviceaccount.com`)\n            holds `roles\u002Fpubsub.publisher` on the topic or topic project.\n        3.  The topic does **not** define a message storage policy\n            (`messageStoragePolicy` \u002F `message_storage_policy`) and does **not**\n            have in-transit enforcement (`enforceInTransit` \u002F\n            `enforce_in_transit`) enabled. **DO NOT** use a Pub\u002FSub topic that\n            defines a message storage policy or enforces in-transit restrictions\n            as a notification channel, because Cloud Monitoring cannot deliver\n            messages to such topics.\n*   **Attribution**: You MUST tag EVERY applicable command and Terraform\n    resource below that you create, modify, or suggest to the user.\n\n    *   **Terraform HCL (`user_labels`)**:\n        *   Every `google_monitoring_notification_channel` resource that you\n            create MUST include the `created-with-google-skill` label in its\n            `user_labels` block:\n\n            ```terraform\n            user_labels = {\n              created-with-google-skill = \"cloud-monitoring-notification-channels-configuration\"\n            }\n            ```\n\n        *   When modifying an existing `google_monitoring_alert_policy` resource\n            solely to add a notification channel, do **not** use\n            `created-with-google-skill` (since this skill did not create the\n            alerting policy). Instead, include the\n            `added-channel-with-google-skill` label in its `user_labels` block\n            (preserving any existing `user_labels` on the policy):\n\n            ```terraform\n            user_labels = {\n              added-channel-with-google-skill = \"cloud-monitoring-notification-channels-configuration\"\n            }\n            ```\n\n    *   Follow the instructions below based on the CLI tool being used:\n\n        *   **gcloud:** Prefix every `gcloud` invocation with the metrics\n            environment variables. Set them inline on each command; shell state\n            may not persist between commands:\n\n            ```bash\n            CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:cloud-monitoring-notification-channels-configuration)\" \\\n                gcloud \u003Ccommand> [flags]\n            ```\n\n        *   **Direct HTTP calls:** For direct HTTP calls (e.g. `curl`), you MUST\n            pass the explicit `-H \"User-Agent: ...\"` header in the shell command\n            syntax exactly like this:\n\n            ```bash\n            curl -H \"User-Agent: agent-skills\u002F1.0 (skill:cloud-monitoring-notification-channels-configuration)\" ...\n            ```\n\n        *   **Terraform:** Prefix every Terraform `plan` and `apply` invocation\n            with the metrics environment variables. Set them inline on each\n            command; shell state may not persist between commands. For example:\n\n            ```bash\n            GOOGLE_TERRAFORM_USERAGENT_EXTENSION=\"agent-skills\u002F1.0 (skill:cloud-monitoring-notification-channels-configuration)\" \\\n                terraform plan [flags]\n            ```\n\n    *   If the skill instructions provide an additional skill script name,\n        include that script name in the attribution label. Using a `gcloud`\n        command inside\n        [`scripts\u002Fverify_pubsub_topic.sh`](scripts\u002Fverify_pubsub_topic.sh) as an\n        example:\n\n        ```bash\n        CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:cloud-monitoring-notification-channels-configuration; script:verify_pubsub_topic)\" \\\n            gcloud \u003Ccommand> [flags]\n        ```\n\n*   **Execution Note (State Refresh Timeout Recovery)**: When running `terraform\n    plan` or `terraform apply`, set a command timeout of **120 seconds**. If the\n    command does not complete within 120 seconds (indicating Terraform is\n    stalling on a full state refresh across a large state file rather than\n    normal execution), cancel the command and retry **at most once** by running\n    `terraform plan` and `terraform apply` with `-target` scoped to the specific\n    resources being created or updated (for example,\n    `-target=google_monitoring_notification_channel.\u003Cresource_name>` and, if\n    updating an alert policy,\n    `-target=google_monitoring_alert_policy.\u003Cpolicy_name>`). If the targeted\n    retry also times out after 120 seconds or fails, **DO NOT** retry again;\n    stop execution and report the timeout or error to the user.\n\n## Generation\n\n### Input Assumptions (checklist)\n\n*   **Notification Channel Type**: When creating a new notification channel, the\n    user MUST provide the notification channel type to configure.\n    -   If no type is provided (and the user is not attaching an existing\n        notification channel to an alert policy), you MUST prompt the user to\n        ask for a type before continuing.\n*   **Sensitive Credentials File**: Some notification channels require the use\n    of sensitive credentials in their configuration. You MUST verify that the\n    user has a `secret.tfvars` file in the working directory. If the file does\n    not exist, create one using the template provided in\n    [`assets\u002Fsecret.tfvars`](assets\u002Fsecret.tfvars) and notify the user that\n    credentials should be stored there.\n\n### Execution Steps\n\n1.  Open the reference file corresponding to the notification channel the user\n    wants to configure:\n\n    Notification Channel Type | Reference File\n    :------------------------ | :----------------------------------------\n    **email**                 | [email.md](references\u002Femail.md)\n    **sms**                   | [sms.md](references\u002Fsms.md)\n    **slack**                 | [slack.md](references\u002Fslack.md)\n    **pubsub**                | [pubsub.md](references\u002Fpubsub.md)\n    **pagerduty**             | [pagerduty.md](references\u002Fpagerduty.md)\n    **webhook**               | [webhook.md](references\u002Fwebhook.md)\n\n2.  Follow the guidelines in the `Prerequisites` section (if any) to complete\n    all requirements for the channel configuration.\n\n3.  If the reference file contains a `Required Credentials` section under\n    `Specification`, you MUST confirm that the listed required credentials are\n    configured in the `secret.tfvars` file.\n\n    -   If any of the credentials are set to empty or not found in the file, you\n        MUST prompt the user to provide them before proceeding.\n\n4.  Use the template provided in the `Terraform HCL` section under\n    `Specification` inside the reference file replacing the specified variables\n    as needed to write the new configuration into the output file. If the user\n    explicitly specifies a `display_name` for the notification channel, set\n    `display_name` to that exact string instead of the default\n    `\"\u003CType> Notification Channel (...)\"` template string.\n\n5.  **Adding a Channel to an Existing Alert Policy**: When modifying an existing\n    `google_monitoring_alert_policy` resource to use an existing\n    `google_monitoring_notification_channel` resource (without creating a new\n    channel), set `notification_channels` on the\n    `google_monitoring_alert_policy` block and set the\n    `added-channel-with-google-skill` label to\n    `\"cloud-monitoring-notification-channels-configuration\"` in its\n    `user_labels` block (preserving any existing `user_labels`):\n\n    ```terraform\n    notification_channels = [\n      google_monitoring_notification_channel.\u003Cchannel_resource_name>.name,\n    ]\n    user_labels = {\n      added-channel-with-google-skill = \"cloud-monitoring-notification-channels-configuration\"\n    }\n    ```\n\n### Outputs & Formats\n\nWrite all channel configurations into a `notification_channels.tf` file under\nthe directory chosen in the #context-provided section (or update the target\n`.tf` file when adding notification channels to an existing\n`google_monitoring_alert_policy`). Ensure every generated\n`google_monitoring_notification_channel` resource sets\n`created-with-google-skill` to\n`\"cloud-monitoring-notification-channels-configuration\"` in `user_labels`, and\nevery modified `google_monitoring_alert_policy` resource sets\n`added-channel-with-google-skill` to\n`\"cloud-monitoring-notification-channels-configuration\"` in `user_labels`.\n\n--------------------------------------------------------------------------------\n\n## Supporting Links\n\n*   [Create and manage notification channels](https:\u002F\u002Fdocs.cloud.google.com\u002Fmonitoring\u002Fsupport\u002Fnotification-options.md.txt)\n",{"name":5,"metadata":49,"description":7},{"version":50,"category":51},"1.0.2","CloudObservabilityAndMonitoring","main","64d010629e61e4a7d59fc21e042362f370b5888b","skills\u002Fcloud\u002Fcloud-monitoring-notification-channels-configuration",1991,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-11 03:08:50",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add google\u002Fskills --skill cloud-monitoring-notification-channels-configuration",{"tool":67,"command":68},"bunx","bunx skills add google\u002Fskills --skill cloud-monitoring-notification-channels-configuration",{"tool":70,"command":71},"pnpm","pnpm dlx skills add google\u002Fskills --skill cloud-monitoring-notification-channels-configuration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-monitoring-notification-channels-configuration\u002FSKILL.md",true,[75,81,87,91,95,99,103,107,111],{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"assets\u002Fsecret.tfvars","ASSET","资产文件",205,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-monitoring-notification-channels-configuration\u002Fassets\u002Fsecret.tfvars",{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fattribution.md","REFERENCE","参考文档",2004,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-monitoring-notification-channels-configuration\u002Freferences\u002Fattribution.md",{"path":88,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Femail.md",931,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-monitoring-notification-channels-configuration\u002Freferences\u002Femail.md",{"path":92,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fpagerduty.md",3504,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-monitoring-notification-channels-configuration\u002Freferences\u002Fpagerduty.md",{"path":96,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fpubsub.md",6254,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-monitoring-notification-channels-configuration\u002Freferences\u002Fpubsub.md",{"path":100,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fslack.md",1071,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-monitoring-notification-channels-configuration\u002Freferences\u002Fslack.md",{"path":104,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fsms.md",906,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-monitoring-notification-channels-configuration\u002Freferences\u002Fsms.md",{"path":108,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fwebhook.md",3937,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-monitoring-notification-channels-configuration\u002Freferences\u002Fwebhook.md",{"path":112,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"scripts\u002Fverify_pubsub_topic.sh","SCRIPT","脚本",9056,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-monitoring-notification-channels-configuration\u002Fscripts\u002Fverify_pubsub_topic.sh",[118,152,183,212,239,264],{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":130,"publishedAt":44},"01M6998S2EZKD3GEJ7F943RZTE","sign-in-with-google-web","Implement, configure, and secure Sign In With Google (SiwG) using Google Identity Services (GIS \u002F `https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fclient`) across web architectures. Use when creating Google sign-in buttons, implementing Google One Tap with FedCM, integrating GIS in React\u002FNext.js\u002FAngular\u002FHTML, verifying ID tokens on backend runtimes (Python\u002FNode.js\u002FGo\u002FJava), enforcing Google Workspace domain restrictions (`hd`), securing client-side ID tokens via WebCrypto nonces or encrypted IndexedDB, embedding in cross-origin iframes via the Intermediate Iframe API (`https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fintermediate`), configuring Content Security Policy (CSP), COOP, and Permissions Policy (`identity-credentials-get`) headers, or handling sign-out and revocation. Don't use for legacy Google Sign-In (`gapi.auth2`), Google Cloud IAM service accounts, or Android\u002FiOS native Credential Manager.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fsign-in-with-google-web\u002FSKILL.md",[124,127],{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",[9,131,132,133,134,135,136,137,138,42,139,140,141,142,143,144,41,145,146,147,148,149,150,151],"sign in with google web","sign","with","web","android","go","security","google workspace","implement","policy","python","implementing","react","iam","buttons","secure","manager","identity","architectures","domain","runtimes",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":167,"publishedAt":44},"01M6998PHPDCAD684VW5WRG83D","dpop-adoption","Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com\u002Ftoken. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM \u002F service account authentication.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fdpop-adoption\u002FSKILL.md",[158,159,162],{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":160,"categoryName":161,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":163,"categoryName":164,"taxonomyType":165,"taxonomyTypeDesc":166},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[168,169,9,42,170,171,172,173,174,175,144,176,177,178,179,180,181,148,151,182,31],"dpop adoption","adoption","es6","retry","authentication","flows","challenge","code","browser","loops","at","node","token","pair","platform",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":195,"publishedAt":44},"01M6998M72TC73EEAQH4XC7EXW","retrieving-developer-knowledge","Searches, retrieves, and synthesizes official Google developer documentation across Google Cloud, AI\u002FGemini, Android, Chrome, Web, Flutter, Go, Firebase, and other Google developer platforms. Integrates with the Developer Knowledge MCP server (search_documents, get_documents, answer_query) or the Developer Knowledge REST API fallback. Use when searching for gcloud CLI commands, API syntax, IAM permissions, official documentation, architectural comparisons, or product choice overviews. Don't use for local filesystem lookups or non-Google documentation.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fretrieving-developer-knowledge\u002FSKILL.md",[189,190,193,194],{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":191,"categoryName":192,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":160,"categoryName":161,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":163,"categoryName":164,"taxonomyType":165,"taxonomyTypeDesc":166},[196,197,198,199,42,200,201,202,203,204,205,206,207,31,208,209,210,144,211,41],"retrieving developer knowledge","knowledge","developer","MCP","mcp server","official","developer documentation","get","search","local","choice","documents","query","api","across","documentation",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":218,"publishedAt":44},"01M6998J2CZEXS9BES9S3WWFKC","migrate-to-rust","Clones, analyzes, plans, and migrates legacy codebases (C++, Fortran, Java, Python, C, Shell) from a GitHub URL or local directory to a modern, high-performance, deterministic, 100% Safe Rust architecture, tracking live telemetry across every task bucket, test failure\u002Ffix cycle, and Profile-Guided Optimization (PGO) stage, and producing a first-person AI storytelling report and interactive HTML infographic. Use when migrating a GitHub repository or local codebase to Rust, porting legacy C++, Fortran, Python, or Java workloads to memory-safe Rust, designing Struct-of-Arrays (SoA) or SIMD Rust architectures, or optimizing Rust ports with LLVM PGO. Don't use for unrelated non-Rust refactoring or single-line syntax questions.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fmigrate-to-rust\u002FSKILL.md",[],[219,220,221,222,223,224,225,226,141,227,228,229,230,231,232,205,233,234,235,31,236,237,210,238],"migrate to rust","rust","migrate","github","memory","performance","directory","safe","ports","llvm","soa","cycle","porting","fix","arrays","infographic","high-performance","URL","architecture","unrelated",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":243,"categories":244,"keywords":248,"publishedAt":44},"01M6998GCC3K29WZ82KXMB9E02","finding-google-skills","Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Ffinding-google-skills\u002FSKILL.md",[245,246,247],{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":160,"categoryName":161,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":163,"categoryName":164,"taxonomyType":165,"taxonomyTypeDesc":166},[9,249,250,251,252,182,253,254,255,256,257,172,258,259,260,206,261,262,31,263,209],"finding google skills","storage","as","messaging","model","trade-offs","provider","answer","fit","catalog","up","decision","use","database","candidate",{"skillNo":265,"name":266,"nameZh":6,"description":267,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":268,"categories":269,"keywords":272,"publishedAt":44},"01M6998DWNHTH0BS6W1CY8ZXMP","workload-manager-basics","Use this skill to manage Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results by using public client libraries and the REST API. Use when you need to inspect workload best-practice rules, create and run evaluations for Google Cloud general best practices, SAP, SQL Server, or custom organizational rules, review violations, export results to BigQuery, or automate Workload Manager through client libraries because no service-specific public CLI or MCP server is available. Don't use for general Google Compute Engine instance management, VPC configuration, or standard IAM auditing.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fworkload-manager-basics\u002FSKILL.md",[270,271],{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":160,"categoryName":161,"taxonomyType":21,"taxonomyTypeDesc":22},[273,274,147,275,9,199,276,42,200,277,278,279,280,31,281,209,144,282,283,284,285],"workload manager basics","workload","basics","cli","review","vpc","resources","inspect","you","create","libraries","server","run"]