AWS Agent Skills

Builds generative AI applications on Amazon Bedrock.

Selects, deploys, and customizes AI models on Amazon SageMaker.

Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries.

Analyze AWS costs, find savings, manage budgets, evaluate Savings Plans and Reserved Instances, right-size EC2/Lambda/RDS/EBS with Compute Optimizer, look up service…

Guides building full-stack applications with AWS Blocks — an Infrastructure-from-Code framework.

Authors, deploys, and troubleshoots AWS infrastructure using CDK with TypeScript or Python.

Authors, validates, and troubleshoots AWS CloudFormation templates.

Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU, instance store vs EBS), launch…

Builds and deploys containerized workloads on Elastic Kubernetes Service (EKS), Elastic Container Service (ECS), Fargate, and ECR (Elastic Container Registry).

Routes any task involving AWS databases — choosing, comparing, recommending, getting started with, or operating a database — to the correct service-specific skill.

Configures CI/CD pipelines using AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact.

Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits,…

Guides general use of AWS messaging and streaming services.

Routes AWS networking requests to the correct service skill for implementation.

Builds, configures, debugs, and optimizes AWS observability — operator-symptom questions and detecting Omni vs classic CloudWatch.

AWS SDK for JavaScript v3 development patterns.

AWS SDK for Python (boto3/botocore) development patterns.

AWS SDK for Swift development patterns.

Secret safety for AWS Secrets Manager, secret management, credentials, API keys, tokens, and passwords.

Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries; Security Hub…

Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK.

Selects, investigates, and compares AWS object, file, and block storage services, and answers cost, performance, configuration, security, and troubleshooting questions…

Performs a full AWS Well-Architected Framework review evaluating every framework question across all pillars discovered from the live AWS documentation by analyzing…

Migrates vibe-coded web applications to AWS.

Gets AWS credentials for CLI/SDK access via aws login.

Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query).

Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express…

Manages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS/VPC/driver config, flexible-schema and vector-search data modeling, MongoDB compatibility…

Designs, reviews, and debugs DynamoDB data layers from design axioms — enumerates access patterns, chooses partition/sort keys and GSIs, decides single-table vs.

Activate when developers have latent caching needs: slow API responses, database read bottlenecks, DynamoDB throttling or cost, RDS/Aurora scaling pressure, Bedrock…

Provides authoritative compatibility checks, pricing estimates, connection troubleshooting, pre-warming guidance, and infrastructure mutations for Amazon Keyspaces (for…

Provides authoritative guidance on Amazon Neptune Database and Neptune Analytics for graph, knowledge-graph, and relationship-heavy workloads — fraud detection / fraud…

Provisions and manages Aurora DSQL clusters, connects via psql or DSQL Connectors, manages schemas, runs queries, migrates from MySQL, diagnoses query plans, and…

Creates a complete Amazon Aurora database cluster with instances, handling cluster creation, instance provisioning, and Secrets Manager password management in the proper…

Exports Amazon RDS or Aurora database snapshots to Amazon S3 in Apache Parquet format for analytics, backup, or data migration.

Provisions, connects, migrates, and operates Amazon RDS for Db2.

Diagnoses and resolves Amazon RDS for Oracle connectivity, authentication, networking, and driver troubleshooting.

Advises on Amazon RDS open-source engines (MySQL, MariaDB, PostgreSQL) for instance creation, upgrade planning, commitment pricing, proxy evaluation, and Blue/Green…

Provides connectivity, authentication, and troubleshooting guidance for Amazon RDS for SQL Server.

Retrieves authoritative guidance on Amazon Timestream for InfluxDB (managed InfluxDB 2, InfluxDB 2 Read Replica Clusters, InfluxDB 3 Core and Enterprise).

Trigger a pre-merge release readiness review on a GitHub PR, GitLab MR, or local branch.

Have a fast, conversational analysis with the AWS DevOps Agent.

Coordinate the AWS DevOps Agent across multiple AgentSpaces from one Claude Code session — route questions to the right space (prod vs staging vs knowledge), query…

Run a fast AWS Security Agent diff scan on only the changed code since a git ref.

Run a deep root-cause investigation on the AWS DevOps Agent.

Run an AWS Security Agent penetration test against a live web application — registers and verifies the target domain, exercises the supplied endpoints with the managed…

Pull AWS Security Agent findings (penetration tests and code reviews) and drive remediation.

Run automated release testing (UI or API) via the AWS DevOps Agent using a pre-configured test profile.

Run an AWS Security Agent scan on the workspace — uploads the source to AWS, scans it with the managed Security Agent service, and returns ranked, verified findings with…

Set up the AWS DevOps Agent and AWS Security Agent connections.

Setup and diagnostics for the AWS DevOps Agent MCP connection.

Configure AWS Security Agent for the current workspace — provision or reuse an agent space, IAM service role, and S3 bucket.

Run an AWS Security Agent threat model review on spec/design documents.

Configures Amazon CloudFront content delivery across six workflows: when to use CloudFront and how it fits with AWS WAF, Shield, CloudFront Functions, Lambda@Edge, Route…

Configures VPC endpoints (interface and gateway) for private AWS service access using AWS PrivateLink.

Establishes VPC peering connections between two VPCs for direct private network connectivity.

Creates a production-ready VPC with public and private subnets across multiple Availability Zones, including internet gateway, NAT gateways, route tables, and security…

Configures AWS Direct Connect: choosing a connection model (dedicated, hosted, or a link aggregation group) and completing the cross connect; creating private, public,…

Enables internet access for AWS Lambda functions deployed in VPC subnets by creating NAT Gateway infrastructure, configuring public/private subnet routing, and updating…

Configures Amazon Route 53 DNS: public and private records, traffic-steering routing policies, health checks, DNS Firewall, Route 53 Profiles, VPC Resolver (also known…

Configures Amazon Route 53 to route traffic to a CloudFront distribution using a custom domain.

Configures AWS Shield Advanced for enhanced Distributed Denial of Service (DDoS) protection: subscribing accounts and adding resource protections, enabling automatic…

Configures AWS Site-to-Site VPN: creating an IPsec VPN connection between an on-premises network and a VPC, choosing the target gateway (virtual private gateway, transit…

Configures AWS Transit Gateway: creating a hub and attaching VPCs, segmenting traffic with route tables, centralizing egress and inspection through a hub (appliances or…

Configures AWS WAF to filter web traffic: creating web access control lists (web ACLs) on CloudFront, Application Load Balancers, API Gateway, and AppSync; AWS Managed…

Entry point for AI-agent work on AWS: pick a runtime, plan a migration for existing workloads, and build an executable POC — one phased flow.

Startup-tailored AWS architecture advice that adjusts recommendations to the company's stage (pre-revenue through Series B+), team size, runway, and available credits.

Migrate workloads from Microsoft Azure to AWS.

Surfaces a single, genuinely relevant AWS Activate partner offer as optional context AFTER another AWS Startup Advisor skill has finalized its recommendation, plan, or…

Migrate workloads from Google Cloud Platform to AWS — plus AI and agentic workloads from any provider.

Migrate workloads from Heroku to AWS.

AWS Startups reference content — Activate FAQ, credits guide, programs, partner offers, sample architectures, and hundreds of learn articles spanning generative AI,…

Use when the user wants to migrate code that calls OpenAI, Gemini/Google AI, or the Anthropic API to Amazon Bedrock — a pure model/SDK rewrite.

AWS-curated copy-paste prompts for AI coding agents (MVP scaffolding, RAG chatbot with Claude on Bedrock, security baseline evaluation, cost anomaly detection, GPU quota…

Interactive discovery + implementation workflow that gathers requirements through picker-based questions (intent, scope, constraints, preferences), scans the codebase…

Best-practice authoring guidance AND a read-only policy gate for AWS Terraform generated by a migration skill.

Builds, runs, debugs, and operates event-driven applications using EventBridge Event Bus - a managed, centrally governed publish/subscribe event bus that an organization…

Builds resilient, long-running, multi-step applications with AWS Lambda durable functions with automatic state persistence, retry logic, and orchestration for…

Evaluates, configures, and migrates workloads to AWS Lambda Managed Instances (LMI).

Builds, runs, debugs, and operates applications on AWS Lambda MicroVMs — Firecracker-isolated, snapshot-resumable serverless compute environments running inside a…

Authors and edits AWS Step Functions state machines: writes Amazon States Language (ASL) in JSONata, and chooses and structures state types (Task, Choice, Map, Parallel,…

Connects an existing AWS Lambda function to Amazon API Gateway by creating a REST or HTTP API with resource/method setup, Lambda proxy integration, permissions, and…

Connects an AWS Lambda function to DynamoDB with IAM roles, stream event source mapping, and read/write permissions.

Creates an API Gateway stage with CloudWatch logging, X-Ray tracing, throttling, WAF integration, and IAM roles following AWS best practices.

Debugs AWS Lambda function timeout failures by systematically analyzing function configuration, CloudWatch logs and metrics, VPC/networking, cold starts, memory…

Deploys a Regional REST API with a custom domain name, a Lambda backend function, and a request-based Lambda authorizer using AWS CLI.

Deploy an event-driven workflow that routes S3 uploads to either Lambda or Fargate via Step Functions based on file size.

Guides migration, provisioning, search, log-analytics, trace-analytics, and Agentic AI Assistant workflows for Amazon OpenSearch Service and Serverless across six…

Create and troubleshoot AWS Glue connections to JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS), Redshift, Snowflake, and BigQuery.

Create managed Iceberg tables using Amazon S3 Tables (s3tables API namespace) with automatic compaction and snapshot management.

Full inventory and audit of AWS Glue Data Catalog assets across S3 Tables, Redshift-federated, and remote Iceberg catalogs.

Resolve data lake and lakehouse asset references across Glue Data Catalog, S3, S3 Tables, and Redshift.

Import data into the AWS data lake from S3 files, local uploads, JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS, Aurora), Amazon Redshift, Snowflake,…

Execute and manage Athena SQL queries across default and federated catalogs (Glue, S3 Tables, Redshift).

Amazon Redshift is NOT PostgreSQL — corrects PostgreSQL-derived LLM mistakes; covers Redshift-specific SQL, DDL, COPY/UNLOAD, system views, metadata discovery, and…

Store and query vector embeddings using Amazon S3 Vectors, a cost-effective long-term vector storage service with its own API namespace (s3vectors).

Use to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments, or resource removal.

Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies.

Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues.

Use when deploying your agent to AWS, or when a deploy has failed.

Use when a developer wants to create a new agent project or get started with AgentCore.

Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting,…

Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI/CD quality gates, observability, or cost optimization.

Use when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments, and applying operator-defined…

Answers questions about Amazon Application Recovery Controller (ARC) Region switch including architecture, plans, execution blocks, workflows, triggers, active/active vs…

Plans, builds, runs, and analyzes fault injection experiments with AWS Fault Injection Service (AWS FIS) to validate application resilience through chaos engineering.

Guides the end-to-end AWS resilience lifecycle integrating Resilience Hub v2, Fault Injection Service, and Application Recovery Controller.

Configures AWS Application Recovery Controller (ARC) for operational resilience: routing controls with safety rules for cross-Region failover, and zonal shift / zonal…

Runs and interprets AWS Resilience Hub v2 failure mode assessments.

Sets up AWS Resilience Hub v2 from scratch: creates resilience policies with SLO targets, registers systems and user journeys, onboards services with input sources, and…

Configures AWS Resilience Hub v2 for multi-account resilience management across an AWS Organization.

Designs a resilience program: how to structure and standardize resilience policies across an organization, team, or portfolio (tiered policy model with…

Troubleshoots and debugs AWS Clean Rooms collaboration issues related to IAM roles, S3 bucket policies, KMS keys, Lake Formation permissions, and CloudWatch logging for…

MANDATORY for Flink or Amazon Managed Service for Apache Flink (MSF) questions.

Operates Amazon Kinesis Data Streams (KDS).

Operates Amazon MSK Provisioned clusters (Standard and Express brokers).

Helps migrate self-managed Apache Kafka workloads to Amazon MSK Express.

Guides an end-to-end data-warehouse migration to Amazon Redshift — discovery, schema/SQL/stored-procedure/macro/script conversion, data migration, validation,…

Installs, configures, and troubleshoots Network Flow Monitor agents on EC2 instances to monitor network path health.

Enables a multi-region AWS CloudTrail trail with S3 log storage, CloudWatch Logs integration, and CloudWatch Logs Insights queries for security monitoring and compliance…

Sets up notification channels for CloudWatch alarms using SNS topics and subscriptions.

Troubleshoots failing applications by discovering and analyzing CloudWatch log groups to identify error patterns, root causes, and actionable solutions.

Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables.

Enables Redshift system-table (SYS_*) log publishing to S3 Tables in Apache Iceberg format for both Provisioned clusters and Serverless namespaces, verifies publishing…

Queries S3 object metadata, tracks bucket activity, audits object changes, searches annotations, and analyzes storage metrics using S3 Metadata system tables (journal,…

Runs SQL analytics on SageMaker Catalog asset metadata tables exported as Apache Iceberg in S3 Tables.

Creates and automates custom image builds with EC2 Image Builder - Linux, Windows, and macOS AMIs, and container images to ECR.

Launches an EC2 instance with secure, cost-efficient defaults including AMI selection, burstable instance sizing, least-privilege IAM roles, hardened security groups,…

Configures EC2 instances to securely call AWS services by creating and attaching IAM roles via instance profiles, eliminating hardcoded credentials.

Guides Amazon SES onboarding for domain-based email sending.

Onboards RCS Business Messaging and Notify OTP via the pinpoint-sms-voice-v2 AWS CLI.

Manages WhatsApp messaging through AWS End User Messaging Social.

Create and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation of misconfigurations.

Diagnoses and resolves Amazon EFS issues including mount failures, NFS timeouts, permission errors, throughput problems, and burst credit exhaustion.

Diagnoses and resolves Amazon S3 Files issues including mount failures, permission errors, synchronization problems, and performance issues.

Performs code upgrades, migrations, and transformations using the AWS Transform (ATX) CLI.

Handles the full DMS Schema Conversion lifecycle including creating migration projects, converting database schemas to a target engine, running compatibility…

Deploys, queries, and debugs AWS Marketplace usage-based (PAYG) metering — the pipeline (ResolveCustomer, BatchMeterUsage, EventBridge via SAM) and querying/debugging…

Connects AI agents to remote Windows desktop applications on Amazon WorkSpaces Applications (AppStream 2.0) through the managed Agent Access MCP server, and guides…

Runs quantum computing workflows on AWS through Amazon Braket — discovering devices (QPUs and simulators) and their availability, building gate-model circuits and analog…

Creates and manages secrets in AWS Secrets Manager following security best practices.

Sets up CloudWatch Application Observability (also called Omni) for the first time.

Build and deploy full-stack web and mobile apps with AWS Amplify Gen2 (TypeScript code-first).