aws/agent-toolkit-for-aws
59 skills163k installs131k starsGitHub
Install
npx skills add https://github.com/aws/agent-toolkit-for-awsSkills in this repo
1Aws Iamaws-iam is an AWS agent toolkit skill containing verified corrections for IAM behaviors that language models frequently misstate. It is not a full IAM guide; the docs direct agents to official AWS documentation and to verify limits, quotas, API names, and edge cases rather than relying on pre-training. Verified edge cases span CloudTrail logging for AcceptHandshake in the acting account only, ConsoleLogin region variability, STS GetSessionToken restrictions, cross-account AssumeRole region opt-in requirements, and one-hour role chaining limits. Organizations notes cover suspended account removal timing, PutResourcePolicy for delegation, and ListPolicies filter type names. SDK specifics document DuplicatePolicyAttachmentException, Boto3 AccessKey activate and deactivate methods without update, and five managed policy version limits. Policy evaluation covers ForAllValues vacuous truth with Null condition pairing, resource-based policies bypassing permissions boundaries, eight privilege escalation actions, and iam:PassRole with Resource star risks. Additional sections address SAML encrypted assertion URLs, MFA resync-only NotAction lists, and Redshift Serverless dual service principa.5.1kinstalls2Aws Serverlessaws-serverless is an official AWS agent skill for serverless work across Lambda, API Gateway, Step Functions, EventBridge, DynamoDB streams, SQS, SNS, S3, and Kinesis integrations. It routes agents to reference files for architecture patterns, SAM and CDK deployment, troubleshooting, Lambda cold start and memory tuning, event source mappings, concurrency, API Gateway setup, orchestration, and production readiness checklists. The overview pairs with the AWS MCP server for CLI and CloudWatch validation while noting quota and runtime values may drift and should be confirmed before production. Routing sends new apps to architecture.md then deployment.md, errors to troubleshooting.md with five common fixes first, performance to lambda.md and production.md, and defers Lambda Managed Instances, durable functions, and microVM workloads to sibling skills. Developers reach for it when building event-driven AWS backends, debugging 502 or 504 API errors, tuning concurrency, configuring CORS, or optimizing cold starts and event mappings.4.9kinstalls3Aws Cdkaws-cdk is a domain skill for authoring and operating AWS CDK infrastructure with TypeScript or Python constructs, covering bootstrap, synth, diff, deploy, compliance, drift detection, resource import, and safe refactoring. Critical warnings document deadly embrace cross-stack export deadlocks requiring weakened references across three deploys, construct ID renames that trigger CloudFormation replacement, UPDATE_ROLLBACK_FAILED recovery via cdk rollback, and non-empty S3 buckets needing removalPolicy DESTROY plus autoDeleteObjects true. Workflows map bootstrap, cdk init, cdk-nag AwsSolutionsChecks, cdk drift with optional --fail in CI, cdk import, and cdk refactor without property changes in the same deploy. Troubleshooting ties DeployFailed to verbose deploy and diagnose commands, credential errors to aws sts get-caller-identity, asset bundling failures to Docker and path issues, and dependency cycles to shared stack extraction or SSM late binding. Construct guidance prefers L2 constructs with escape hatches via node.defaultChild addPropertyOverride. Security recommendations include OIDC CI credentials, permissions boundaries on bootstrap, grant helpers for IAM, cdk-nag with --st.4.6kinstalls4Aws ObservabilityAWS Observability is an agent skill for metrics, logs, and traces across CloudWatch, X-Ray, CloudTrail, and ADOT. It routes requests to focused references for Log Insights query syntax, metric and composite alarms, custom metrics with PutMetricData or EMF, dashboard widgets, X-Ray sampling and annotations, synthetic canaries, and operational CloudTrail queries. The skill includes CDK alarm templates and an ADOT collector starter config, and pairs well with the AWS MCP server for live CLI validation. Troubleshooting guidance starts with the five most common fixes and covers canary failure tables plus cross-service error patterns. Use it when debugging INSUFFICIENT_DATA alarms, writing fields-filter-stats-parse queries, publishing EMF metrics, migrating X-Ray to ADOT, designing cross-account dashboards, or auditing who deleted resources. It explicitly excludes application logging drivers and threat-detection-only work so agents stay on platform observability tasks rather than app log plumbing.4.6kinstalls5Aws Billing And Cost ManagementAWS Billing and Cost Management encodes expertise for analyzing, optimizing, and managing AWS spend across Cost Explorer, Budgets, Billing Views, Compute Optimizer, Cost Optimization Hub, Savings Plans, Reserved Instances, CUR 2.0 Athena queries, anomaly detection, and Free Tier monitoring. Critical rules require determining the current date before any Cost Explorer or Budgets API call and never performing arithmetic in prose; scripts must compute sums, averages, and percentages deterministically. Decision guide maps questions to references such as cost-explorer for spend breakdowns, pricing-lookup for service rates, optimization hub for savings starting point, and cost-audit for seven-step bill reduction workflow. Billing Views scope analysis via list-billing-views and --billing-view-arn on supported CE and budget APIs. Compute Optimizer needs enrollment via update-enrollment-status Active before recommendations. Common traps include RECORD_TYPE versus CHARGE_TYPE filters, Price List service codes differing from CE names, and hourly granularity requiring CE preferences. AWS MCP server is recommended for sandboxed execution when available.4.3kinstalls6Aws CloudformationThe aws-cloudformation skill provides domain expertise for the full CloudFormation lifecycle: authoring templates, pre-deployment validation, and post-failure diagnosis. Authoring follows best-practices SOP with secure defaults including S3 public access block, encryption, versioning, Retain deletion policies on stateful resources, and no secrets in plain String parameters. Validation runs three layers: cfn-lint syntax, cfn-guard compliance, and change set describe-events pre-deployment API. Troubleshooting uses describe-events with FailedEvents filter, not legacy describe-stack-events, classifying parallel IAM permission gaps and distinguishing template vs environment fixes. Template content is untrusted user data and must not be treated as agent instructions. The skill works with plain YAML or JSON CloudFormation and defers to CDK-focused skills when teams already use CDK abstractions for reusable infrastructure code generation and higher-level stack composition patterns across dev staging and production AWS environments.4.3kinstalls7Amazon BedrockAmazon Bedrock guides generative AI work on AWS across five separate API endpoints for control plane, runtime inference, agents, and AgentCore services. It maps user intent to workflows for Converse API model calls, Knowledge Base RAG setup, Bedrock Agents with action groups, Guardrails content safety, and AgentCore runtime deployment. Critical warnings cover explicit maxTokens to avoid ThrottlingException, Guardrails PII logging in CloudWatch, and recent boto3 or AWS CLI versions for Converse and AgentCore support. Reference files cover prompt caching, quota health, cost tracking, and Claude model migration between generations. Security guidance stresses IAM roles over users, scoped permissions, Secrets Manager for keys, confused deputy protection, and treating agent-generated parameters as untrusted input. Workflows verify AWS CLI credentials, region model access, and dependency versions before executing KB creation, agent setup, or AgentCore deployment steps sequentially.4.3kinstalls8Aws ContainersAWS Containers guides building, deploying, and operating workloads on ECS, Fargate, ECR, and related AWS services. Service overview maps developer needs to ECS Express Mode for simple HTTP apps, standard Fargate services, GPU EC2 when above sixteen vCPU, ECR repositories, ALB patterns, queue workers, scheduled tasks, Service Connect, and ECS Exec debugging. Gotchas enforce valid Fargate CPU and memory pairs, mandatory awsvpc networking, separation of execution versus task IAM roles, secrets injected only at task launch, ALB deregistration delay tuning, healthCheckGracePeriodSeconds, deployment circuit breaker rollback, private subnet VPC endpoints including S3 gateway, and ECR lifecycle preview delays. Express Mode replaces App Runner recommendations for new simple HTTP deployments while EKS stays out of scope unless Kubernetes is explicit. Prerequisites verify AWS CLI v2, Docker, and Session Manager plugin before commands. The skill excludes Kubernetes, generic CI/CD pipeline setup, raw VPC design, and non-container serverless unless containers are the target. AWS MCP server is recommended but standard CLI access suffices.4.2kinstalls9Aws Sdk Python UsageThe aws-sdk-python-usage skill governs Python code using boto3 and botocore for AWS services. It explains client versus resource interfaces, session and client creation with reuse outside loops, PascalCase API parameters, and typed client.exceptions over generic ClientError in business logic. Script structure keeps if __name__ main to a single main call with argparse and exit codes in main, never sys.exit in library functions. Pagination must use paginators with optional JMESPath search rather than manual NextToken loops. Waiters block until resources reach desired states. botocore.config.Config sets retries, timeouts, and pool sizes. Logging uses boto3.set_stream_logger or botocore session file loggers for wire debug. Common pitfall: ClientError imports from botocore.exceptions not boto3.exceptions. Service-specific references for S3 and DynamoDB must be loaded when those services appear. The skill forbids emojis in code, comments, or output while active.3.9kinstalls10Aws Sdk Js V3 UsageDo not use emojis in any code comments or output when this skill is active aws sdk client one per service generated by smithy typescript https github com awslabs smithy typescript one to one with AWS services and operations aws sdk lib higher level helpers e g lib dynamodb lib storage aws sdk no prefix utility packages mostly internal don t import deep paths js import S3Client from aws sdk client s3 correct NOT import S3Client from aws sdk client s3 dist cjs S3Client Bare bones preferred smaller bundle js import S3Client GetObjectCommand from aws sdk client s3 const client new S3Client region us east 1 const output await client send new GetObjectCommand Bucket b Key k The aws sdk js v3 usage agent skill provides documented workflows prerequisites triggers and safety guidance from its SKILL md source Agents load it when user requests match the description and follow step by step instructions without inventing capabilities It integrates with standard agent tooling for the tasks inputs outputs and failure modes3.9kinstalls11Aws Messaging And StreamingWhen answering AWS messaging and streaming questions verify specific numbers versions limits and behavioral details from service specific skills or official AWS documentation When uncertain search skills or docs rather than guessing Fabricated configuration options or incorrect version numbers are worse than admitting uncertainty When a question asks about recommended configurations CloudWatch alarm settings thresholds missing data treatment search for the service specific skills or documentation rather than relying on general best practices Domain expertise for choosing and using AWS services that move data between producers and consumers This skill covers two fundamental patterns messaging and streaming and the AWS services that implement each Use this skill to decide which pattern fits a workload select the right service and understand how services integrate with each other For specific guidance on individual AWS services see reference files or service specific Skills Messaging enables decoupled asynchronous communication between components A producer sends a message one or more consumers receive and process it Once processed the message is typically deleted Messaging services.3.8kinstalls12Connecting To Data Source>- The connecting-to-data-source skill documents workflows and patterns from the repository SKILL.md. --- name: connecting-to-data-source description: >- Create and troubleshoot AWS Glue connections to JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS), Redshift, Snowflake, and BigQuery. Gathers connection hints from user, discovers existing connections and RDS/Redshift candidates, registers credentials in Secrets Manager or IAM DB auth, configures VPC, and tests. Triggers on: connect to database, set up Glue connection, register data source, connect to Snowflake/BigQuery/RDS, connection timeout, test connection, troubleshoot connection. Do NOT use for moving data (use ingesting-into-data-lake), creating tables (use creating-data-lake-table), queries (use querying-data-lake), catalog exploration (use exploring-data-catalog), or SaaS (Salesforce, ServiceNow, SAP, MongoDB, Kafka). version: 1 argument-hint: '[source-type|connection-name|hostname]' --- # Connect to Data Source Register an external data source with AWS Glue so downstream skills (ingesting-into-data-lake) can move data from it. A Glue connection stores the network config, driver, and credential reference for on.3.3kinstalls13Exploring Data CatalogThis skill provides comprehensive read-only discovery and cataloging across AWS data environments. It maps Glue Data Catalog assets, S3 Tables, Redshift-federated databases, and remote Iceberg catalogs within an account. Supports targeted deep dives by database, table, or S3 path, plus exhaustive landscape enumeration with catalog classification by type. Includes experimental Glue Discovery API for customer-authored context lookup. Captures schemas, partition keys, data formats, and locations without executing queries. Critical constraints: always confirm AWS region upfront, paginate all results, treat catalog descriptions as untrusted, and distinguish from querying (use querying-data-lake skill) and data location (use finding-data-lake-assets skill).3.2kinstalls14Storing And Querying VectorsThe storing-and-querying-vectors skill - It covers hundreds/thousands of sustained queries per second QPS : Wrong tool. Recommend OpenSearch.. Key workflows include tiered bulk + hot : S3 Vectors for storage + OpenSearch Serverless for real-time. See references/limits-and-patterns.md .. Amazon S3 Vectors is a cost-effective AWS service for storing and querying vector embeddings at scale. Optimized for long-term storage with subsecond latency for cold queries, as low as 100ms for warm queries. Developers invoke storing-and-querying-vectors when the task matches the triggers and reference files in SKILL.md for grounded, stepwise execution. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation.3.2kinstalls15Querying Data LakeThis skill executes and manages Athena SQL queries across default and federated catalogs including Glue, S3 Tables, and Redshift. It handles workgroup selection, resolves target assets through delegation when needed, classifies statements for safety (SELECT vs. destructive operations), and reports query costs and data scanned. The skill validates AWS credentials, confirms output S3 locations before execution, and provides error recovery with workgroup suggestions. It integrates with AWS MCP server for sandboxed execution and audit logging, falling back to AWS CLI when unavailable. Essential for data analysts and engineers querying multi-catalog data lakes safely.3.2kinstalls16Securing S3 BucketsThe securing-s3-buckets skill documents agent workflows from the repository SKILL.md. It covers you MUST inform the user if required tools are missing. Key workflows include you SHOULD confirm credentials with aws sts get-caller-identity. Implements layered S3 security controls across five workflows: securing new buckets, auditing existing configurations, remediating findings, configuring encryption, and enabling monitoring. Follows AWS Well-Architected security best practices. Execute commands using the AWS MCP server when connected sandboxed execution, audit logging, observability . Fall back to AWS CLI or shell otherwise. Developers invoke securing-s3-buckets when the task matches the triggers and reference files in SKILL.md for grounded, stepwise execution. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation.3.2kinstalls17Ingesting Into Data LakeThe ingesting-into-data-lake skill guides agents through one-time loads, recurring pipelines, and catalog migrations into queryable lake tables. It defaults to S3 Tables unless inventory shows Iceberg on a general-purpose bucket is the established posture. Sources include local uploads, S3 files, JDBC sources such as Oracle, PostgreSQL, MySQL, SQL Server, Redshift, RDS, Aurora, Snowflake, BigQuery, DynamoDB exports, and Glue table migrations. Workflow steps verify AWS MCP or CLI access, classify the source, confirm Glue connections, pick target format, and execute documented ingest paths. It delegates connection setup to connecting-to-data-source and declines unsupported SaaS sources like Salesforce or Kafka. Agents must explain steps before executing MCP or CLI commands.3.2kinstalls18Creating Data Lake TableThe creating-data-lake-table skill from AWS agent-toolkit-for-aws provisions managed Apache Iceberg tables via Amazon S3 Tables (s3tables API). It covers table bucket setup, namespace and table creation, schema definition, Glue catalog registration, partitioning strategy, and IAM permissions. A decision guide requires checking existing Glue tables before create: fuzzy database names delegate to finding-data-lake-assets; conflicting non-S3-Tables names need user confirmation. Creation paths include empty tables followed by ingesting-into-data-lake, Glue ETL per references/table-creation-glue-etl.md, and optional Lake Formation integration. Agents must verify AWS MCP tools or CLI availability, confirm region and credentials via aws sts get-caller-identity, and prefer MCP sandboxed execution when connected. Do not use for vector storage, querying existing tables, or file import without table creation. Use when users ask to create data lake tables, S3 Tables Iceberg, Athena tables, or analytics table partitioning.3.1kinstalls19Finding Data Lake AssetsThe finding-data-lake-assets skill resolves data lake and lakehouse references across Glue Data Catalog, S3, S3 Tables, and Redshift. It accepts a table name, keyword, column name, or S3 path plus target AWS region, confirms ambiguous input, and returns concrete catalog matches optimized for low token usage. Workflow verifies AWS MCP tools or CLI access, optionally consults experimental Glue Discovery Search and GetAsset assets when CLI support and user opt-in allow, then runs structured search steps across catalogs. It acts as a resolver for other skills and direct user requests, declining full catalog audits or query execution outside scope. Agents must explain each step before executing MCP or CLI commands and respect abort decisions. Delegate to exploring-data-catalog for audits, querying-data-lake for SQL, and creating-data-lake-table for empty table creation.3.1kinstalls20Aws AmplifyThe aws-amplify skill documents agent workflows from the repository SKILL.md. It covers node.js ^18.19.0 || ^20.6.0 || =22 and npm. Key workflows include aWS credentials configured aws sts get-caller-identity succeeds. - Route to the Right Reference Step 1: Identify the Task Type | Task | Go To | | ---------------------------------------- | ------------------------------------------------------------------------ | | Create a new project | → scaffolding.md references/scaffolding.md , then Step 2 and/or Step 3 | | Add or modify a backend feature | → Step 2 Backend Features | | Connect frontend to existing backen Developers invoke aws-amplify when the task matches the triggers and reference files in SKILL.md for grounded, stepwise execution. Reference files and progressive disclosure keep context focused while preserving concrete commands, configuration fields, and validation checks copied from the upstream documentation.3.1kinstalls21Connecting Lambda To Api GatewayThe connecting-lambda-to-api-gateway skill provides domain expertise for wiring Lambda to Amazon API Gateway REST APIs. It covers API creation, resource and method setup, Lambda proxy integration, IAM permissions, deployment, CORS, authorization types (NONE, AWS_IAM, COGNITO_USER_POOLS, CUSTOM), API keys, throttling, access logging, and production security hardening easy to miss manually. Procedure reference lambda-gateway-api.md must be followed exactly. Troubleshooting section addresses common integration failures. Use whenever connecting Lambda to API Gateway so CORS, permissions, and logging are not skipped. REST API creation with Lambda proxy integration and deployment steps Authorization types: NONE, AWS_IAM, Cognito pools, or CUSTOM authorizers CORS, throttling, access logging, and production security hardening Follows lambda-gateway-api.md procedure exactly for reliable wiring Handles permissions and integration failures commonly missed in manual setup connecting-lambda-to-api-gateway wires Lambda to API Gateway REST APIs with CORS, auth, and hardening Deployed REST API with proxy integration, permissions, CORS, and production controls User connects Lambda to API Gateway o.3kinstalls22Creating Secrets Using Best PracticesThe creating-secrets-using-best-practices skill provides domain expertise for AWS Secrets Manager with production-grade controls including dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management. Procedure supports database credentials, API keys, OAuth tokens, and custom secret types each structured and encrypted with a dedicated KMS key. Troubleshooting covers KMS key access with kms:ViaService scoping to secretsmanager, rotation Lambda permission failures, and secret access denied from IAM or key policy mismatches. Always use this skill when creating secrets rather than ad hoc CLI calls. Invoke when users create AWS secrets, configure rotation, or troubleshoot KMS and IAM access for Secrets Manager workloads. Dedicated KMS encryption keys per secret with rotation. Supports database, API key, OAuth, and custom secret types. Least-privilege IAM and CloudTrail auditing guidance. Troubleshooting KMS ViaService and rotation Lambda failures.3kinstalls23Aws Sdk Swift UsageThe aws sdk swift usage skill |. Documentation covers workflows, commands, and guardrails agents should follow when users invoke this capability. Key documented areas include `S3Client.S3ClientConfig` (not S3ClientConfiguration); `DynamoDBClient.DynamoDBClientConfig` (not DynamoDBClientConfiguration); `STSClient.STSClientConfig` (not STSClientConfiguration); `S3ClientTypes.Bucket`, `S3ClientTypes.Object`. Reference commands include @main; struct Main {. Use when developers or agents need structured guidance for aws sdk swift usage tasks with evidence grounded in the bundled SKILL.md rather than generic advice. `S3Client.S3ClientConfig` (not S3ClientConfiguration) `DynamoDBClient.DynamoDBClientConfig` (not DynamoDBClientConfiguration) `STSClient.STSClientConfig` (not STSClientConfiguration) `S3ClientTypes.Bucket`, `S3ClientTypes.Object` `DynamoDBClientTypes.AttributeValue` `CloudWatchClientTypes.MetricDatum`, `CloudWatchClientTypes.Dimension` `awsCredentialIdentityResolver` - Custom credentials `useFIPS` - Enable FIPS endpoints |3kinstalls24Troubleshooting Application FailuresThe troubleshooting-application-failures skill diagnoses application failures through CloudWatch log analysis. It discovers relevant log groups, searches error patterns and stack traces, performs root cause analysis, and generates prioritized remediation recommendations. Procedure in application-failure-troubleshooting.md must be followed exactly. When no log groups are found, agents ask for names like /aws/lambda/function-name, /aws/apigateway/api-name, or custom application groups. Use when applications fail in AWS and log-based diagnosis is needed rather than guessing from symptoms alone. Discovers CloudWatch log groups for failing applications automatically Searches error patterns, stack traces, and correlates root causes Prioritized remediation recommendations from log evidence Follows application-failure-troubleshooting.md procedure exactly Fallback prompts for log group names when discovery returns empty troubleshooting-application-failures diagnoses AWS app failures via CloudWatch log discovery and analysis Root cause analysis with prioritized fixes based on CloudWatch log patterns User has application failures needing CloudWatch log diagnosis in AWS Operators debugging La2.9kinstalls25Connecting Lambda To DynamodbThe connecting lambda to dynamodb skill Connects an AWS Lambda function to DynamoDB with IAM roles, stream event source mapping, and read/write permissions. Use when setting up Lambda-DynamoDB integration, processing DynamoDB stream events, or deploying serverless event-driven architectures. Documentation covers workflows, commands, and guardrails agents should follow when users invoke this capability. Use when developers or agents need structured guidance for connecting lambda to dynamodb tasks with evidence grounded in the bundled SKILL.md rather than generic advice. Connects an AWS Lambda function to DynamoDB with IAM roles, stream event source mapping, and read/write permissions. Use when setting up Lambda-DynamoDB integration, processing DynamoDB stream events,2.9kinstalls26Troubleshooting S3 FilesThe troubleshooting s3 files skill Diagnoses and resolves Amazon S3 Files issues including mount failures, permission errors, synchronization problems, and performance issues. Use when the user has an S3 file system that is not mounting, returning access denied, not syncing changes to S3, showing files in lost+found, or performing slower than expected. Documentation covers workflows, commands, and guardrails agents should follow when users invoke this capability. Key documented areas include You MUST verify `aws` CLI is available with `s3files` subcommand support; You MUST confirm valid AWS credentials; You MUST ONLY check for tool existence and version - MUST NOT execute destructive or mutating commands during verification; You MUST inform the user if any required tools are missing. Reference commands include sudo yum -y install amazon-efs-utils # Amazon Linux; aws s3files list-mount-targets --file-system-id fs-ID --region REGION. Use when developers or agents need structured guidance for troubleshooting s3 files tasks with evidence grounded in the bundled SKILL.md rather than generic advice.2.9kinstalls27Debugging Lambda TimeoutsThis skill provides domain expertise for systematically debugging AWS Lambda timeout failures. Developers use it when Lambda functions are timing out or approaching timeout limits. The workflow collects function configuration, CloudWatch metrics and logs, analyzes dependency chains, identifies cold start patterns, and reviews code for timeout-prone patterns. Results compile into a structured debugging report with prioritized recommendations addressing insufficient timeout settings, external service delays, database connection issues, memory constraints, and inefficient code patterns.2.9kinstalls28Configuring Vpc Endpoints For Private Aws Service AccessThis skill teaches configuring AWS VPC endpoints (interface and gateway types) to enable private connectivity to AWS services like S3, DynamoDB, EC2, and Secrets Manager via AWS PrivateLink. Developers use it when building secure, air-gapped infrastructure that avoids internet gateways, NAT devices, and public IPs. Key workflows include creating endpoint resources, configuring security groups and route tables, enabling DNS resolution, and troubleshooting common issues like DNS failures, connection timeouts, and overly restrictive endpoint policies.2.9kinstalls29Creating Api Gateway Stagecreating-api-gateway-stage is an agent skill from aws/agent-toolkit-for-aws that creates an api gateway stage with cloudwatch logging, x-ray tracing, throttling, waf integration, and iam roles following aws best practices. use when deploying a rest api to different environments su. # Creating an API Gateway Stage ## Overview Domain expertise for creating and configuring API Gateway stages with comprehensive logging, monitoring, security, and throttling controls. Covers CloudWatch logging setup, X-Ray tracing, WAF web ACL association, method-level configuration, and authorization options. ## Create an API Gateway stage To Developers invoke creating-api-gateway-stage during ship/testing work for testing & qa tasks. The skill documents triggers, prerequisites, and step-by-step workflows grounded in SKILL.md. Compatible with Claude Code, Cursor, and Codex agent runtimes that load marketplace skills.2.9kinstalls30Launching Ec2 Instance With Best Practiceslaunching-ec2-instance-with-best-practices is an agent skill from aws/agent-toolkit-for-aws that launches an ec2 instance with secure, cost-efficient defaults including ami selection, burstable instance sizing, least-privilege iam roles, hardened security groups, encrypted ebs volumes, and compre. # Launching EC2 Instances with Best Practices ## Overview Domain expertise for launching EC2 instances with sensible defaults optimized for security, cost-efficiency, and operational best practices. Covers AMI selection, instance type recommendation, network configuration, IAM role creation, security group hardening, storage configuration, taggin Developers invoke launching-ec2-instance-with-best-practices during operate/infra work for cloud & infrastructure tasks. The skill documents triggers, prerequisites, and step-by-step workflows grounded in SKILL.md. Compatible with Claude Code, Cursor, and Codex agent runtimes that load marketplace skills. Review the Security Audits panel on this listing before installing in production environments.2.8kinstalls31Setting Up Cloudwatch Alarm Notificationssetting-up-cloudwatch-alarm-notifications is an agent skill from aws/agent-toolkit-for-aws that sets up notification channels for cloudwatch alarms using sns topics and subscriptions. always use this skill when configuring alarm notifications — it creates encrypted sns topics, configures topic p. # Setting Up CloudWatch Alarm Notifications ## Overview Domain expertise for configuring Amazon CloudWatch alarm notification channels using Amazon SNS topics and subscriptions. Covers creating encrypted SNS topics, setting up subscriptions for email, SMS, and webhook endpoints, configuring topic policies for CloudWatch access, and linking alarms Developers invoke setting-up-cloudwatch-alarm-notifications during operate/infra work for cloud & infrastructure tasks. The skill documents triggers, prerequisites, and step-by-step workflows grounded in SKILL.md. Compatible with Claude Code, Cursor, and Codex agent runtimes that load marketplace skills.2.8kinstalls32Routing Traffic With Route53 And Cloudfrontrouting-traffic-with-route53-and-cloudfront is an agent skill from aws/agent-toolkit-for-aws that configures amazon route 53 to route traffic to a cloudfront distribution using a custom domain. use when setting up dns alias records, alternate domain names (cnames), acm certificates for https, and . # Routing Traffic with Route 53 and CloudFront ## Overview Domain expertise for configuring Amazon Route 53 to route traffic to Amazon CloudFront distributions using custom domain names. Covers hosted zone management, alias A/AAAA records, alternate domain name (CNAME) configuration, and ACM certificate setup for HTTPS. ## Configure Route 53 to Developers invoke routing-traffic-with-route53-and-cloudfront during operate/infra work for cloud & infrastructure tasks. The skill documents triggers, prerequisites, and step-by-step workflows grounded in SKILL.md. Compatible with Claude Code, Cursor, and Codex agent runtimes that load marketplace skills.2.8kinstalls33Setting Up Ec2 Instance Profilessetting-up-ec2-instance-profiles is an agent skill from aws/agent-toolkit-for-aws that configures ec2 instances to securely call aws services by creating and attaching iam roles via instance profiles, eliminating hardcoded credentials. use when an ec2 instance needs permissions to acces. # Setting Up EC2 Instance Profiles ## Overview Domain expertise for granting EC2 instances secure access to AWS services using IAM roles and instance profiles. Covers the full lifecycle: identifying required permissions, creating or reusing IAM roles with least-privilege policies, creating instance profiles, attaching them to EC2 instances, and v Developers invoke setting-up-ec2-instance-profiles during operate/infra work for cloud & infrastructure tasks. The skill documents triggers, prerequisites, and step-by-step workflows grounded in SKILL.md. Compatible with Claude Code, Cursor, and Codex agent runtimes that load marketplace skills.2.7kinstalls34Creating Production Vpc Multi Azcreating-production-vpc-multi-az is an agent skill from aws/agent-toolkit-for-aws that creates a production-ready vpc with public and private subnets across multiple availability zones, including internet gateway, nat gateways, route tables, and security groups following aws well-archit. # Creating a Production-Ready VPC Across Multiple Availability Zones ## Overview Domain expertise for creating production-ready VPC infrastructure distributed across multiple Availability Zones. Covers VPC creation with DNS support, public and private subnet layout with automatic CIDR calculation, internet gateway, NAT gateways for high-availabil Developers invoke creating-production-vpc-multi-az during operate/infra work for cloud & infrastructure tasks. The skill documents triggers, prerequisites, and step-by-step workflows grounded in SKILL.md. Compatible with Claude Code, Cursor, and Codex agent runtimes that load marketplace skills.2.7kinstalls35Enabling Lambda Vpc Internet Accessenabling-lambda-vpc-internet-access is an agent skill from aws/agent-toolkit-for-aws that enables internet access for aws lambda functions deployed in vpc subnets by creating nat gateway infrastructure, configuring public/private subnet routing, and updating security groups. use when a vpc. # Enabling Lambda VPC Internet Access ## Overview Domain expertise for enabling internet access from AWS Lambda functions running inside VPC private subnets. Lambda functions in a VPC cannot receive public IP addresses, so outbound internet access requires NAT Gateway infrastructure that routes traffic from private subnets through a public subnet Developers invoke enabling-lambda-vpc-internet-access during ship/testing work for testing & qa tasks. The skill documents triggers, prerequisites, and step-by-step workflows grounded in SKILL.md. Compatible with Claude Code, Cursor, and Codex agent runtimes that load marketplace skills.2.7kinstalls36Aws Transformaws-transform is an agent skill from aws/agent-toolkit-for-aws that performs code upgrades, migrations, and transformations using the aws transform (atx) cli. use when upgrading language versions, migrating aws sdks, migrating frameworks (angular, vue.js, spring boot,. # AWS Transform (ATX) ## Overview Perform code upgrades, migrations, and transformations using AWS Transform (ATX). Supports any-to-any transformations: language version upgrades (Java, Python, Node.js, etc.), framework migrations, AWS SDK migrations, library upgrades, code refactoring, architecture changes, and custom organization-specific trans Developers invoke aws-transform during operate/infra work for cloud & infrastructure tasks. The skill documents triggers, prerequisites, and step-by-step workflows grounded in SKILL.md. Compatible with Claude Code, Cursor, and Codex agent runtimes that load marketplace skills. Review the Security Audits panel on this listing before installing in production environments.2.7kinstalls37Connecting Vpcs With Peeringconnecting-vpcs-with-peering is an agent skill from aws/agent-toolkit-for-aws that establishes vpc peering connections between two vpcs for direct private network connectivity. always use this skill when creating or managing vpc peering — it validates cidr overlap, updates all route. # Connecting VPCs with Peering ## Overview Domain expertise for establishing private network connectivity between two VPCs using VPC peering. Covers the full lifecycle: creating the peering connection, accepting it, updating route tables in both VPCs, configuring DNS resolution, and adjusting security groups for cross-VPC traffic. Supports same-r Developers invoke connecting-vpcs-with-peering during operate/infra work for cloud & infrastructure tasks. The skill documents triggers, prerequisites, and step-by-step workflows grounded in SKILL.md. Compatible with Claude Code, Cursor, and Codex agent runtimes that load marketplace skills.2.7kinstalls38Exporting Rds To S3exporting-rds-to-s3 is an agent skill from aws/agent-toolkit-for-aws that exports amazon rds or aurora database snapshots to amazon s3 in apache parquet format for analytics, backup, or data migration. handles snapshot selection or creation, iam role setup, kms encryption, . # Exporting RDS/Aurora to S3 ## Overview Domain expertise for exporting Amazon RDS and Aurora database snapshots to Amazon S3 in Apache Parquet format. Covers the full workflow: snapshot identification or creation, IAM role and KMS encryption setup, S3 bucket preparation, export task initiation, progress monitoring, data verification, and post-ex Developers invoke exporting-rds-to-s3 during operate/infra work for cloud & infrastructure tasks. The skill documents triggers, prerequisites, and step-by-step workflows grounded in SKILL.md. Compatible with Claude Code, Cursor, and Codex agent runtimes that load marketplace skills.2.7kinstalls39Creating Amazon Aurora Db Cluster With Instancescreating-amazon-aurora-db-cluster-with-instances is an agent skill from aws/agent-toolkit-for-aws that creates a complete amazon aurora database cluster with instances, handling cluster creation, instance provisioning, and secrets manager password management in the proper sequence. use when setting up . # Creating Amazon Aurora DB Cluster with Instances ## Overview Domain expertise for creating complete Amazon Aurora database setups including cluster creation, instance provisioning, and managed password configuration via AWS Secrets Manager. Supports both Aurora MySQL and Aurora PostgreSQL engines. ## Create an Aurora cluster with instances To Developers invoke creating-amazon-aurora-db-cluster-with-instances during operate/infra work for cloud & infrastructure tasks. The skill documents triggers, prerequisites, and step-by-step workflows grounded in SKILL.md. Compatible with Claude Code, Cursor, and Codex agent runtimes that load marketplace skills.2.7kinstalls40Creating Ec2 Image Builder PipelineThe creating-ec2-image-builder-pipeline skill automates custom AMI creation using EC2 Image Builder end to end. It covers IAM role setup, build component definition, image recipe creation, infrastructure and cross-region distribution configuration, pipeline execution, and launch template creation. Troubleshooting addresses InvalidParameterValueException when ARNs are manually constructed, InstanceProfileNotFoundException with IAM eventual consistency waits, ResourceAlreadyExistsException naming conflicts, and build instance launch failures from missing policies or unavailable instance types. Procedure details live in references/ec2-image-builder-pipeline.md for exact API sequencing. Use when developers need repeatable AMI builds with pre-installed software and regional distribution.2.6kinstalls41Setting Up Cloudtrail Multi RegionThe setting-up-cloudtrail-multi-region skill configures centralized AWS API activity logging across all regions for security monitoring and compliance auditing. It guides creating a multi-region CloudTrail trail with S3 log storage, CloudWatch Logs integration, and CloudWatch Logs Insights queries for operational analysis. Troubleshooting covers S3 bucket naming conflicts, IAM permission denied errors without FullAccess policies, trails not logging due to bucket policy or start-logging issues, CloudWatch delivery delays of 5 to 15 minutes, and opt-in region events taking up to 24 hours. Use when platform teams need comprehensive cross-region API audit trails with searchable CloudWatch log analysis.2.6kinstalls42Troubleshooting EfsThe troubleshooting-efs skill is designed for diagnose and resolve Amazon EFS mount, performance, and connectivity issues. Troubleshooting EFS Overview Domain expertise for diagnosing and resolving Amazon EFS issues. Covers mount failures, NFS connectivity, IAM and POSIX permissions, throughput and performance, and encryption problems. Invoke when the user troubleshoots EFS mount failures, performance, or connectivity on AWS.2.6kinstalls43Aws CleanroomsThe aws-cleanrooms skill troubleshoots and debugs AWS Clean Rooms collaboration issues related to IAM roles, S3 bucket policies, KMS keys, Lake Formation permissions, and CloudWatch logging for custom ML model training and inference jobs. Use when a customer reports permission failures, access errors, or log publishing issues in Clean Rooms. # AWS Clean Rooms ## Overview Domain expertise for troubleshooting AWS Clean Rooms collaborations and custom ML modeling. Covers permission debugging, data access issues, and CloudWatch logging configuration. ## Common tasks ### Debugging Clean Rooms errors Determine the failure type: **Access denied or permission error?** → See [permission debugging procedure](references/permission-debugging.md). Covers IAM role policies (inline + attached managed), S3 bucket policies, KMS key policies, Lake Formation permissions, and cross-account trust. **Missing CloudWatch logs for custom model jobs?** → See [custom model logging debugging procedure](references/custom-model-logging-debugging.md). Covers Configured Model Algorithm Association privacy configuration, ML Configuration role permissions, and log group verification.2.4kinstalls44Signing In To AwsThis skill helps a developer get AWS credentials for local CLI and SDK access using the aws login command, which issues short-term credentials that rotate every 15 minutes. It activates when authentication is needed, credentials are missing or expired, or an AWS operation fails on credentials. It runs version and identity precondition checks first and requires the user's confirmation before running aws login.2.2kinstalls45Aws Lambda Durable FunctionsBuilds resilient, long-running, multi-step applications with AWS Lambda durable functions with automatic state persistence, retry logic, and orchestration for long-running executions. Covers the critical replay model, step operations, wait/callback patterns, error handling with saga pattern, testing with LocalDurableTestRunner. Triggers on phrases like lambda durable functions, durable execution, workflow orchestration, state machines, retry/checkpoint patterns, long-running stateful Lambda functions, saga pattern, human-in-the-loop callbacks, reliable serverless applications, context.step, context.wait, context.invoke, context.runInChildContext, withDurableExecution, DurableContext, UnrecoverableInvocationError, durable-execution-sdk, qualified ARN invocation, and durable handler replay. Build resilient multi-step applications and AI workflows that can execute for up to 1 year while maintaining reliable progress despite interruptions.2.1kinstalls46Aws Lambda Managed InstancesEvaluates, configures, and migrates workloads to AWS Lambda Managed Instances (LMI). Runs Lambda functions on EC2 instances in the user's account while AWS manages provisioning, patching, scaling, routing, and load balancing. Triggers when queries mention Lambda Managed Instances, LMI, capacity providers, multi-concurrent execution environments, EC2-backed Lambda, persistent Lambda instances, PerExecutionEnvironmentMaxConcurrency, CapacityProviderConfig, cold start elimination via dedicated instances, migrating standard Lambda to managed instances, or cost comparison between standard Lambda and LMI with Savings Plans or Reserved Instances. Runs Lambda functions on EC2 instances in the user's account while AWS manages provisioning, patching, scaling, routing, and load balancing. Combines Lambda's developer experience with EC2's pricing and hardware options.2kinstalls47Amazon Aurora PostgresqlThis skill creates, modifies, and advises on Amazon Aurora PostgreSQL clusters through sub-skills for creation, express provisioning, serverless capacity, storage, pricing, and upgrades. A developer uses it to stand up a PostgreSQL-compatible Aurora cluster, defaulting to the no-VPC express flow with IAM authentication. It requires explicit confirmation before any create or modify operation.1.9kinstalls48Amazon ElasticacheActivate when developers have latent caching needs: slow API responses, database read bottlenecks, DynamoDB throttling or cost, RDS/Aurora scaling pressure, Bedrock latency or cost, or adding a cache; activate when working with Redis, Valkey, Memcached, or any in-memory data store, cache-aside patterns, session stores, rate limiting, leaderboards, counters, streams, queues, pub/sub, distributed locks, feature flags, shopping carts, or other caching strategies. Activate for GenAI and ML retrieval: vector similarity search for low-latency retrieval, semantic caching, RAG, LLM response caching, embedding stores, AI agent memory, recommendation, personalization. Activate for ElastiCache lifecycle: provisioning (serverless or node-based), engine selection, CloudFormation/CDK/Terraform IaC, VPC connectivity, TLS, RBAC, IAM auth, Global Datastore, monitoring, troubleshooting, cost optimization, and migration from self-managed Redis. Do not trigger for browser caches, CDN/CloudFront, HTTP Cache-Control, CPU caches. A modular ElastiCache toolkit organized as a registry of sub-skills. Each sub-skill handles one domain of ElastiCache work. The1.9kinstalls49Amazon Aurora MysqlThis skill creates, modifies, and advises on Amazon Aurora MySQL clusters through a registry of sub-skills for creation, serverless capacity, storage type, commitment pricing, and upgrade planning. A developer uses it to provision a MySQL-compatible Aurora cluster or right-size an existing one. It requires explicit confirmation before any mutation and executes through the AWS MCP server or the AWS CLI.1.7kinstalls50Managing Amazon Msk>-. Domain expertise for operating Amazon MSK Provisioned clusters with Standard and Express broker types. Covers performance troubleshooting, consumer lag diagnosis, storage management, cluster sizing, client configuration, and CloudWatch monitoring.1.7kinstalls51Developing Applications On Managed Service For Apache FlinkThis skill provides domain expertise for building Apache Flink applications on Amazon Managed Service for Apache Flink, covering development, KPU resource management, connectors, state, monitoring, and IaC deployment. A developer uses it when writing or deploying a Flink stream-processing app on MSF, choosing between the DataStream and Table APIs. It loads reference files with MSF-specific thresholds and constraints rather than answering from generic Flink knowledge.1.6kinstalls52Amazon KeyspacesThis skill provides compatibility checks, pricing estimates, connection troubleshooting, and infrastructure mutations for Amazon Keyspaces, the managed Cassandra-compatible service. A developer uses it to create keyspaces and tables, change table settings like TTL, PITR, and capacity mode, or plan a Cassandra-to-Keyspaces migration. It requires explicit confirmation before any create or modify operation and mandates resource tags on creation.1.6kinstalls53Agents Deploy>. Deploy your AgentCore agent to AWS, or diagnose why a deploy failed. The agents-deploy skill documents workflows, constraints, and examples from SKILL.md for agent-assisted execution.914installs54Agents Debug>. Diagnose why your AgentCore agent or environment isn't working correctly. The agents-debug skill documents workflows, constraints, and examples from SKILL.md for agent-assisted execution.902installs55Agents Connect>. Give your AgentCore agent access to external APIs, tools, and services via the AgentCore Gateway — and control what it can access with Cedar policies. The agents-connect skill documents workflows, constraints, and examples from SKILL.md for agent-assisted execution.899installs56Agents Optimize>. Measure and improve your AgentCore agent's quality through evaluation, monitoring, and observability. The agents-optimize skill documents workflows, constraints, and examples from SKILL.md for agent-assisted execution.899installs57Agents Get Started>. Walk a developer from zero to a running agent on AWS. The agents-get-started skill documents workflows, constraints, and examples from SKILL.md for agent-assisted execution.897installs58Agents Build>. Add capabilities to your AgentCore agent project. The agents-build skill documents workflows, constraints, and examples from SKILL.md for agent-assisted execution.896installs59Agents Harden>. Prepare your AgentCore agent for production — security, reliability, and performance. The agents-harden skill documents workflows, constraints, and examples from SKILL.md for agent-assisted execution.889installs