aws

Generated source view for the actual executable engineering/aws skill. The durable routing article is Cloud, Data, and Service Skills. Source: skills/engineering/aws/SKILL.md

Runtime Source

Bundled Resources

These files are part of the executable skill folder and must be preserved with the skill source.

Description

Use for AWS work: IAM, CDK, CloudFormation, Lambda, serverless, S3, RDS, VPC, Route 53, CloudFront, MSK, Flink, data lakes, Bedrock, cost, observability, security, and SDK usage. Load folded AWS references only for the named service or failure mode.

Skill Source

---
name: aws
description: >-
  Use for AWS work: IAM, CDK, CloudFormation, Lambda, serverless, S3, RDS, VPC, Route 53,
  CloudFront, MSK, Flink, data lakes, Bedrock, cost, observability, security, and SDK usage. Load
  folded AWS references only for the named service or failure mode.
origin: personal
source_slug: aws
merged_skill_router: true
---

# AWS

Use this as the single executable router for AWS work.

## Routing

- Account safety: confirm profile, region, environment, and blast radius before mutations.
- Infrastructure: route CDK, CloudFormation, VPC, EC2, Route 53, CloudFront, and production network work through the matching folded reference.
- Serverless and data: route Lambda, API Gateway, DynamoDB, S3, RDS, Aurora, MSK, Flink, data lake, and Bedrock work through the specific reference.
- Diagnostics: route CloudWatch, CloudTrail, observability, cost, and troubleshooting prompts to the matching folded reference first.

## Reference Loading

Load one folded reference at a time. Prefer the most specific reference that matches the user's named service, framework, command, or error. If no folded reference matches, use the router guidance here and verify with primary docs or local project state.

<!-- folded-skills:auto:start -->
## Folded Skill References

These former standalone skills are bundled here as references to keep the runtime list compact. Load only the reference that matches the user's exact product, framework, or failure mode.

| Former skill | Reference | Description |
| --- | --- | --- |
| `amazon-aurora-mysql` | [`references/skills/amazon-aurora-mysql/SKILL.md`](references/skills/amazon-aurora-mysql/SKILL.md) | Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I/O-Optimized storage, commitment pricing, or MySQL upgrade planning. Aurora MySQL uses full (VPC-based) configuration — express configuration is PostgreSQL-only. For Aurora PostgreSQL, use amazon-aurora-postgresql instead. Contains safety guardrails and response templates that override defaults. |
| `amazon-aurora-postgresql` | [`references/skills/amazon-aurora-postgresql/SKILL.md`](references/skills/amazon-aurora-postgresql/SKILL.md) | Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I/O-Optimized storage, commitment pricing, or PostgreSQL upgrade planning. For Aurora MySQL, use amazon-aurora-mysql instead. Contains safety guardrails, express-first routing, and response templates that override defaults. |
| `amazon-bedrock` | [`references/skills/amazon-bedrock/SKILL.md`](references/skills/amazon-bedrock/SKILL.md) | Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore. Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching setup and debugging, quota health checks and throttling diagnosis, cost attribution and tracking, migrating between Claude model generations (4.5 to 4.6 to 4.7), chunking strategies, API selection (Converse vs InvokeModel), guardrail capabilities, and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Connector, Instrument, Coinbase CDP, Stripe Privy, 402 Payment Required, pay for content, paid endpoint, agent payments). NOT for custom model training, Rekognition, or Comprehend. |
| `amazon-documentdb` | [`references/skills/amazon-documentdb/SKILL.md`](references/skills/amazon-documentdb/SKILL.md) | Manages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS/VPC/driver config, flexible-schema and vector-search data modeling, MongoDB compatibility assessment, DMS-based migration, slow-query diagnosis, major version upgrades (4.0→5.0→8.0), Well-Architected reviews (41-check wa_review.py), cost estimation, and security hardening. Retrieve for every DocumentDB question and when the user asks to set up or migrate MongoDB to AWS — DocumentDB is AWS's MongoDB-compatible managed database. Triggers: JSON document store, document database, MongoDB on AWS, Nested fields, Lambda cannot connect, TLS handshake, VPC port 27017, IAM auth, Secrets Manager, encryption at rest, $graphLookup, flexible schema, COLLSCAN, compound index, DMS migration, CDC cutover, $vectorSearch, RAG, Global Clusters, DR replication, cost sizing, audit, health check, production-readiness. |
| `amazon-elasticache` | [`references/skills/amazon-elasticache/SKILL.md`](references/skills/amazon-elasticache/SKILL.md) | Activate when developers have latent caching needs: slow API responses, database read bottlenecks, DynamoDB throttling or cost, RDS/Aurora scaling pressure, Bedrock latency or cost, or adding a cache; activate when working with Redis, Valkey, Memcached, or any in-memory data store, cache-aside patterns, session stores, rate limiting, leaderboards, counters, streams, queues, pub/sub, distributed locks, feature flags, shopping carts, or other caching strategies. Activate for GenAI and ML retrieval: vector similarity search for low-latency retrieval, semantic caching, RAG, LLM response caching, embedding stores, AI agent memory, recommendation, personalization. Activate for ElastiCache lifecycle: provisioning (serverless or node-based), engine selection, CloudFormation/CDK/Terraform IaC, VPC connectivity, TLS, RBAC, IAM auth, Global Datastore, monitoring, troubleshooting, cost optimization, and migration from self-managed Redis. Do not trigger for browser caches, CDN/CloudFront, HTTP Cache-Control, CPU caches. |
| `amazon-keyspaces` | [`references/skills/amazon-keyspaces/SKILL.md`](references/skills/amazon-keyspaces/SKILL.md) | Provides authoritative compatibility checks, pricing estimates, connection troubleshooting, pre-warming guidance, and infrastructure mutations for Amazon Keyspaces (for Apache Cassandra). Covers LWT/batch operations, secondary indexes, materialized views, capacity modes, TTL, PITR, CDC, auto-scaling, multi-region keyspaces, UDTs, nodetool diagnostics parsing, SQL-to-Cassandra migration, and Cassandra-to-Keyspaces migration scenarios. Agents frequently produce incomplete or incorrect answers about Keyspaces feature support without this skill loaded. |
| `amazon-opensearch-service` | [`references/skills/amazon-opensearch-service/SKILL.md`](references/skills/amazon-opensearch-service/SKILL.md) | Amazon OpenSearch Service and Serverless across five capabilities — migration (Solr/ES/self-managed OpenSearch into AOS/AOSS, schema/query translation, sizing, cutover); provisioning (domain + AOSS lifecycle, upgrades, storage tiers, FGAC, monitoring); search (vector / semantic / hybrid / RAG with Bedrock connectors); log-analytics (PPL, OSI ingestion, anomaly detection, OpenSearch Dashboards, Splunk/Datadog alternatives); trace-analytics (OTel spans, service maps, Data Prepper). Triggers on OpenSearch, AOS, AOSS, Elasticsearch, ELK, Solr, Lucene, vector / k-NN / semantic / hybrid / neural search, RAG, ELSER, log analytics, observability, Kibana, OSI, OCU, PPL, trace analytics, BM25, eDisMax, schema.xml, ILM, ISM, FAISS, HNSW, Migration Assistant for Amazon OpenSearch Service, Historical Data Migration, Live Traffic Migration, UltraWarm, OR1, Splunk/Datadog alternative, moving off Solr. Picks ONE capability per ask, names instance class + count + shard math, ships query DSL examples. |
| `aws-amplify` | [`references/skills/aws-amplify/SKILL.md`](references/skills/aws-amplify/SKILL.md) | Build and deploy full-stack web and mobile apps with AWS Amplify Gen2 (TypeScript code-first). Covers auth (Cognito), data (AppSync/DynamoDB), storage (S3), functions, APIs, and AI (Amplify AI Kit with Bedrock). Supports React, Next.js, Vue, Angular, React Native, Flutter, Swift, and Android. Always use this skill for Amplify Gen2 topics — even for questions you think you know — it contains validated, version-specific patterns that prevent common mistakes. TRIGGER when: user mentions Amplify Gen2; project has amplify/ directory or amplify_outputs; code imports @aws-amplify packages; user asks about defineBackend, defineAuth, defineData, defineStorage, defineFunction, or npx ampx. SKIP: Amplify Gen1 (amplify CLI v6), standalone SAM/CDK without Amplify (use aws-serverless), direct Bedrock without Amplify AI Kit (use bedrock). |
| `aws-billing-and-cost-management` | [`references/skills/aws-billing-and-cost-management/SKILL.md`](references/skills/aws-billing-and-cost-management/SKILL.md) | Analyze AWS costs, find savings, manage budgets, evaluate Savings Plans and Reserved Instances, right-size EC2/Lambda/RDS/EBS with Compute Optimizer, look up service pricing, query CUR with Athena, detect cost anomalies, scope costs to billing views, and monitor Free Tier usage. Triggers on: AWS bill, cost analysis, reduce spend, savings plan, reserved instance, right-size, budget alert, cost optimization, pricing, free tier, cost anomaly, CUR, cost audit, billing view, billing view ARN. |
| `aws-blocks` | [`references/skills/aws-blocks/SKILL.md`](references/skills/aws-blocks/SKILL.md) | Guides building full-stack applications with AWS Blocks — an Infrastructure-from-Code framework. Applies when creating APIs, selecting Building Blocks (KVStore, DistributedTable, Database, AuthBasic, AuthCognito, Realtime, AsyncJob, FileBucket, etc.), running local development, or deploying AWS Blocks applications. Also covers AWS Blocks topics with validated, version-specific patterns that prevent common mistakes. Triggers when user mentions AWS Blocks; project has aws-blocks/ directory; code imports @aws-blocks packages. |
| `aws-cdk` | [`references/skills/aws-cdk/SKILL.md`](references/skills/aws-cdk/SKILL.md) | Authors, deploys, and troubleshoots AWS infrastructure using CDK with TypeScript or Python. Covers best practices, stack architecture, and construct patterns. Always use when writing CDK constructs, bootstrapping environments, running cdk deploy/synth/diff, fixing CDK or CloudFormation errors, planning stack structure, importing existing resources, resolving drift, or refactoring stacks without resource replacement. |
| `aws-cleanrooms` | [`references/skills/aws-cleanrooms/SKILL.md`](references/skills/aws-cleanrooms/SKILL.md) | Troubleshoots and debugs AWS Clean Rooms collaboration issues related to IAM roles, S3 bucket policies, KMS keys, Lake Formation permissions, and CloudWatch logging for custom ML model training and inference jobs. Use when a customer reports permission failures, access errors, or log publishing issues in Clean Rooms. |
| `aws-cloudformation` | [`references/skills/aws-cloudformation/SKILL.md`](references/skills/aws-cloudformation/SKILL.md) | Author, validate, and troubleshoot AWS CloudFormation templates. Covers template authoring with secure defaults, pre-deployment validation (cfn-lint, cfn-guard, change sets), and root-cause diagnosis of failed stacks using CloudFormation events and CloudTrail correlation. |
| `aws-configuring-vpc-endpoints-for-private-aws-service-access` | [`references/skills/aws-configuring-vpc-endpoints-for-private-aws-service-access/SKILL.md`](references/skills/aws-configuring-vpc-endpoints-for-private-aws-service-access/SKILL.md) | Configures VPC endpoints (interface and gateway) for private AWS service access using AWS PrivateLink. Use when setting up secure private connectivity to S3, DynamoDB, and other AWS services without internet gateway, NAT device, or public IP addresses. Covers endpoint creation, security groups, route tables, and DNS configuration. |
| `aws-connecting-lambda-to-api-gateway` | [`references/skills/aws-connecting-lambda-to-api-gateway/SKILL.md`](references/skills/aws-connecting-lambda-to-api-gateway/SKILL.md) | Connects an existing AWS Lambda function to Amazon API Gateway by creating a REST or HTTP API with resource/method setup, Lambda proxy integration, permissions, and deployment. Always use this skill when connecting Lambda to API Gateway — it handles CORS, throttling, access logging, and production security hardening that are easy to miss. |
| `aws-connecting-lambda-to-dynamodb` | [`references/skills/aws-connecting-lambda-to-dynamodb/SKILL.md`](references/skills/aws-connecting-lambda-to-dynamodb/SKILL.md) | Connects an AWS Lambda function to DynamoDB with IAM roles, stream event source mapping, and read/write permissions. Use when setting up Lambda-DynamoDB integration, processing DynamoDB stream events, or deploying serverless event-driven architectures. |
| `aws-connecting-to-data-source` | [`references/skills/aws-connecting-to-data-source/SKILL.md`](references/skills/aws-connecting-to-data-source/SKILL.md) | Create and troubleshoot AWS Glue connections to JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS), Redshift, Snowflake, and BigQuery. Gathers connection hints from user, discovers existing connections and RDS/Redshift candidates, registers credentials in Secrets Manager or IAM DB auth, configures VPC, and tests. Triggers on: connect to database, set up Glue connection, register data source, connect to Snowflake/BigQuery/RDS, connection timeout, test connection, troubleshoot connection. Do NOT use for moving data (use ingesting-into-data-lake), creating tables (use creating-data-lake-table), queries (use querying-data-lake), catalog exploration (use exploring-data-catalog), or SaaS (Salesforce, ServiceNow, SAP, MongoDB, Kafka). |
| `aws-connecting-vpcs-with-peering` | [`references/skills/aws-connecting-vpcs-with-peering/SKILL.md`](references/skills/aws-connecting-vpcs-with-peering/SKILL.md) | Establishes VPC peering connections between two VPCs for direct private network connectivity. Always use this skill when creating or managing VPC peering — it validates CIDR overlap, updates all route tables in both VPCs, configures DNS resolution, and provides security group guidance that are critical for correct connectivity. |
| `aws-containers` | [`references/skills/aws-containers/SKILL.md`](references/skills/aws-containers/SKILL.md) | Deploys and operates containerized workloads on ECS, Fargate, and ECR. Covers task definitions, Fargate services, ECR repository setup and lifecycle policies, ECS Exec debugging, service scaling, deployment strategies, load balancer integration, and logging configuration. Use when deploying, debugging, or optimizing containers on AWS. ALSO USE for container deployment options (ECS vs ECS Express Mode), networking modes, health check troubleshooting, OOM errors, secrets injection, blue/green deployments, ECR image management, and App Runner sunset guidance and migration. NOT for Kubernetes, EKS, or CI/CD pipelines. |
| `aws-creating-amazon-aurora-db-cluster-with-instances` | [`references/skills/aws-creating-amazon-aurora-db-cluster-with-instances/SKILL.md`](references/skills/aws-creating-amazon-aurora-db-cluster-with-instances/SKILL.md) | Creates a complete Amazon Aurora database cluster with instances, handling cluster creation, instance provisioning, and Secrets Manager password management in the proper sequence. Use when setting up new Aurora MySQL or PostgreSQL clusters with production-ready configuration. |
| `aws-creating-api-gateway-stage` | [`references/skills/aws-creating-api-gateway-stage/SKILL.md`](references/skills/aws-creating-api-gateway-stage/SKILL.md) | Creates an API Gateway stage with CloudWatch logging, X-Ray tracing, throttling, WAF integration, and IAM roles following AWS best practices. Use when deploying a REST API to different environments such as dev, test, or production. |
| `aws-creating-data-lake-table` | [`references/skills/aws-creating-data-lake-table/SKILL.md`](references/skills/aws-creating-data-lake-table/SKILL.md) | Create managed Iceberg tables using Amazon S3 Tables (s3tables API namespace) with automatic compaction and snapshot management. Sets up table bucket, namespace, table, schema, Glue catalog registration, partitioning, IAM access control. Triggers on: create table, data lake table, analytics table, structured data storage, S3 Tables, Iceberg, Athena table, partitioning strategy, access permissions. Do NOT use for: importing files (use ingesting-into-data-lake), vector storage (use storing-and-querying-vectors), querying existing tables (use querying-data-lake), or locating existing table (use finding-data-lake-assets). |
| `aws-creating-ec2-image-builder-pipeline` | [`references/skills/aws-creating-ec2-image-builder-pipeline/SKILL.md`](references/skills/aws-creating-ec2-image-builder-pipeline/SKILL.md) | Creates a complete EC2 Image Builder pipeline that builds a custom AMI with pre-installed software, distributes it to target regions, executes the pipeline, and creates a launch template. Use when setting up automated AMI creation with IAM roles, build components, image recipes, and infrastructure configuration. |
| `aws-creating-production-vpc-multi-az` | [`references/skills/aws-creating-production-vpc-multi-az/SKILL.md`](references/skills/aws-creating-production-vpc-multi-az/SKILL.md) | Creates a production-ready VPC with public and private subnets across multiple Availability Zones, including internet gateway, NAT gateways, route tables, and security groups following AWS Well-Architected principles. Use when deploying multi-AZ VPC infrastructure with automatic CIDR planning and DNS resolution. |
| `aws-creating-secrets-using-best-practices` | [`references/skills/aws-creating-secrets-using-best-practices/SKILL.md`](references/skills/aws-creating-secrets-using-best-practices/SKILL.md) | Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling. |
| `aws-debugging-lambda-timeouts` | [`references/skills/aws-debugging-lambda-timeouts/SKILL.md`](references/skills/aws-debugging-lambda-timeouts/SKILL.md) | Debugs AWS Lambda function timeout failures by systematically analyzing function configuration, CloudWatch logs and metrics, VPC/networking, cold starts, memory constraints, and downstream dependencies to identify root causes with actionable fixes. Use when a Lambda function is timing out or approaching its timeout limit. |
| `aws-deploying-custom-domain-rest-api` | [`references/skills/aws-deploying-custom-domain-rest-api/SKILL.md`](references/skills/aws-deploying-custom-domain-rest-api/SKILL.md) | Deploys a Regional REST API with a custom domain name, a Lambda backend function, and a request-based Lambda authorizer using AWS CLI. Covers ACM certificate provisioning, API Gateway REST API creation, Lambda function deployment, request authorizer setup, custom domain configuration, base path mapping, and Route 53 DNS record creation. Trigger keywords: custom domain, REST API, Lambda, Route 53, API Gateway, regional endpoint, request authorizer, base path mapping. |
| `aws-developing-applications-on-managed-service-for-apache-flink` | [`references/skills/aws-developing-applications-on-managed-service-for-apache-flink/SKILL.md`](references/skills/aws-developing-applications-on-managed-service-for-apache-flink/SKILL.md) | MANDATORY for Flink or Amazon Managed Service for Apache Flink (MSF) questions. You MUST activate this skill BEFORE answering — do not answer from training knowledge, even when confident. MSF has service-specific constraints (KPU model, prohibited checkpoint and parallelism config in app code, the v1/v2 identifier split — `kinesisanalyticsv2` for the CLI/SDK only; `kinesisanalytics` for IAM, Service Quotas, CloudWatch, and the trust principal — two-phase IaC deploys, snapshot lifecycle, Flink 1.x→2.x migration) that override generic Flink knowledge. |
| `aws-dms-schema-conversion` | [`references/skills/aws-dms-schema-conversion/SKILL.md`](references/skills/aws-dms-schema-conversion/SKILL.md) | Handles the full DMS Schema Conversion lifecycle including creating migration projects, converting database schemas to a target engine, running compatibility assessments, navigating metadata trees, exporting converted DDL to S3, applying schema changes to a target database, and converting SQL statements between database engines. |
| `aws-enabling-lambda-vpc-internet-access` | [`references/skills/aws-enabling-lambda-vpc-internet-access/SKILL.md`](references/skills/aws-enabling-lambda-vpc-internet-access/SKILL.md) | Enables internet access for AWS Lambda functions deployed in VPC subnets by creating NAT Gateway infrastructure, configuring public/private subnet routing, and updating security groups. Use when a VPC-attached Lambda function cannot reach the internet. |
| `aws-exploring-data-catalog` | [`references/skills/aws-exploring-data-catalog/SKILL.md`](references/skills/aws-exploring-data-catalog/SKILL.md) | Full inventory and audit of AWS Glue Data Catalog assets across S3 Tables, Redshift-federated, and remote Iceberg catalogs. Triggers on: inventory the catalog, audit databases, list all tables, catalog overview, data landscape, enumerate catalogs, data inventory, search the catalog. Do NOT use for finding specific data (use finding-data-lake-assets), running queries (use querying-data-lake), or creating tables (use creating-data-lake-table). |
| `aws-exporting-rds-to-s3` | [`references/skills/aws-exporting-rds-to-s3/SKILL.md`](references/skills/aws-exporting-rds-to-s3/SKILL.md) | Exports Amazon RDS or Aurora database snapshots to Amazon S3 in Apache Parquet format for analytics, backup, or data migration. Handles snapshot selection or creation, IAM role setup, KMS encryption, S3 bucket preparation, export task execution, progress monitoring, and data verification. Use when exporting RDS/Aurora data to S3 for Athena, Glue, or Redshift Spectrum consumption. |
| `aws-finding-data-lake-assets` | [`references/skills/aws-finding-data-lake-assets/SKILL.md`](references/skills/aws-finding-data-lake-assets/SKILL.md) | Resolve data lake and lakehouse asset references across Glue Data Catalog, S3, S3 Tables, and Redshift. Triggers on: find the table, where is our data, which table has, locate dataset, find data for, search catalog, what tables match, Redshift table, lakehouse table, data lake table, warehouse table, reverse lookup S3 path. Do NOT use for: full catalog audits (use exploring-data-catalog), running queries (use querying-data-lake), creating tables (use creating-data-lake-table). |
| `aws-iam` | [`references/skills/aws-iam/SKILL.md`](references/skills/aws-iam/SKILL.md) | Use when working with AWS IAM, STS, Organizations, permission boundaries, trust policies, identity policies, SAML, MFA, iam:PassRole, least privilege, or AWS authorization edge cases. Verifies common AI mistakes against AWS documentation. |
| `aws-ingesting-into-data-lake` | [`references/skills/aws-ingesting-into-data-lake/SKILL.md`](references/skills/aws-ingesting-into-data-lake/SKILL.md) | Import data into the AWS data lake from S3 files, local uploads, JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS, Aurora), Amazon Redshift, Snowflake, BigQuery, DynamoDB, or existing Glue catalog tables (migration). Default target is S3 Tables; standard Iceberg on a general purpose bucket is supported where S3 Tables is not adopted. Handles one-time loads, recurring pipelines, migrations. Triggers on: import data, load data, ingest, sync database, migrate table, move data to AWS, set up pipeline, ETL, pull from Snowflake, query BigQuery into S3, export DynamoDB, CTAS, convert to Iceberg. Do NOT use for setting up or troubleshooting Glue connections (use connecting-to-data-source), creating empty tables (use creating-data-lake-table), running queries (use querying-data-lake), finding tables by fuzzy name (use finding-data-lake-assets), catalog audit (use exploring-data-catalog), or SaaS platforms like Salesforce, ServiceNow, SAP, MongoDB, Kafka. |
| `aws-lambda-durable-functions` | [`references/skills/aws-lambda-durable-functions/SKILL.md`](references/skills/aws-lambda-durable-functions/SKILL.md) | Builds resilient, long-running, multi-step applications with AWS Lambda durable functions with automatic state persistence, retry logic, and orchestration for long-running executions. Covers the critical replay model, step operations, wait/callback patterns, error handling with saga pattern, testing with LocalDurableTestRunner. Triggers on phrases like lambda durable functions, durable execution, workflow orchestration, state machines, retry/checkpoint patterns, long-running stateful Lambda functions, saga pattern, human-in-the-loop callbacks, reliable serverless applications, context.step, context.wait, context.invoke, context.runInChildContext, withDurableExecution, DurableContext, UnrecoverableInvocationError, durable-execution-sdk, qualified ARN invocation, and durable handler replay. |
| `aws-lambda-managed-instances` | [`references/skills/aws-lambda-managed-instances/SKILL.md`](references/skills/aws-lambda-managed-instances/SKILL.md) | Evaluates, configures, and migrates workloads to AWS Lambda Managed Instances (LMI). Runs Lambda functions on EC2 instances in the user's account while AWS manages provisioning, patching, scaling, routing, and load balancing. Triggers when queries mention Lambda Managed Instances, LMI, capacity providers, multi-concurrent execution environments, EC2-backed Lambda, persistent Lambda instances, PerExecutionEnvironmentMaxConcurrency, CapacityProviderConfig, cold start elimination via dedicated instances, migrating standard Lambda to managed instances, or cost comparison between standard Lambda and LMI with Savings Plans or Reserved Instances. |
| `aws-lambda-microvms` | [`references/skills/aws-lambda-microvms/SKILL.md`](references/skills/aws-lambda-microvms/SKILL.md) | Builds, runs, debugs, and operates applications on AWS Lambda MicroVMs — Firecracker-isolated, snapshot-resumable serverless compute environments running inside a container with up to 8 hr lifetimes. Applicable when workloads need strong isolation between tenants, isolated serverless compute, sandbox compute, or secure multi-tenant execution. Also suited for AI/agent code-execution sandboxes, interactive code playgrounds and notebooks (Jupyter, REPLs, dev environments running user-supplied code), reinforcement-learning environments, multi-tenant CI executors and build runners, sessionful game or simulation servers, or isolated security scanners. Also applicable when the workload needs long-lived sessions, a real port-listening server (gRPC, WebSocket, custom TCP protocols), state preserved across periods of inactivity (suspend/resume), container-level access (FUSE, eBPF, custom syscalls), or session-affine routing. |
| `aws-launching-ec2-instance-with-best-practices` | [`references/skills/aws-launching-ec2-instance-with-best-practices/SKILL.md`](references/skills/aws-launching-ec2-instance-with-best-practices/SKILL.md) | Launches an EC2 instance with secure, cost-efficient defaults including AMI selection, burstable instance sizing, least-privilege IAM roles, hardened security groups, encrypted EBS volumes, and comprehensive tagging. Use when deploying new EC2 instances following AWS best practices for security and cost optimization. |
| `aws-managing-amazon-msk` | [`references/skills/aws-managing-amazon-msk/SKILL.md`](references/skills/aws-managing-amazon-msk/SKILL.md) | Operates Amazon MSK Provisioned clusters (Standard and Express brokers). MUST be used for ANY MSK Provisioned task — do not rely on training data for topics covered here, since Standard and Express emit different metrics and follow different patching models that training data routinely conflates. Covers performance, consumer lag, storage, and traffic shaping diagnosis; sizing and choosing Standard vs Express; Kafka client tuning; creating CloudWatch alarms, dashboards, monitoring, and cluster configurations; AND MSK maintenance, patching, version upgrades, and rolling-restart behavior. Triggers: MSK, Kafka on AWS, `kafka.*` or `express.*` instance types, AWS/Kafka CloudWatch namespace, alarms, dashboards, monitoring, consumer lag, partition replication, broker storage, MSK upgrades, patching, maintenance windows, SECURITY_PATCHING, BROKER_UPDATE, rolling restarts, unexpected broker reboots. Do NOT use for MSK Connect, MSK Serverless, or MSK Replicator. |
| `aws-messaging-and-streaming` | [`references/skills/aws-messaging-and-streaming/SKILL.md`](references/skills/aws-messaging-and-streaming/SKILL.md) | Guides use of AWS messaging and streaming services. Covers Amazon SQS, Amazon SNS, Amazon EventBridge, Amazon MQ, Amazon Kinesis Data Streams, Amazon Data Firehose, Amazon Managed Service for Apache Flink, and Amazon Managed Streaming for Apache Kafka (MSK). Use when implementing messaging and streaming patterns. |
| `aws-migrate-to-msk` | [`references/skills/aws-migrate-to-msk/SKILL.md`](references/skills/aws-migrate-to-msk/SKILL.md) | Helps migrate self-managed Apache Kafka workloads to Amazon MSK Express. Inventories the source cluster (from IaC files, Kafka CLI output, or manual input), assesses MSK Express compatibility across topology, Kafka version, configs, auth, and quotas, produces a target Express specification (instance type, broker count, monthly cost) by filling the AWS-published MSK Sizing/Pricing workbook, and guides migration execution using MSK Replicator. Applicable when the user mentions migrating Kafka, MSK, MSK Express, Kafka migration, analyzing Kafka infrastructure, moving to MSK, moving streaming platform to MSK, streaming migration, moving streaming workloads to AWS, MSK workload compatibility, MSK cluster sizing, choosing an MSK cluster type, or MSK Replicator. |
| `aws-observability` | [`references/skills/aws-observability/SKILL.md`](references/skills/aws-observability/SKILL.md) | Builds, configures, debugs, and optimizes AWS observability using CloudWatch (Logs Insights, Metrics, Alarms, Dashboards, EMF), X-Ray, CloudTrail, and ADOT. Covers Log Insights query syntax (fields, filter, stats, parse, pattern, join, subqueries), alarm configuration (metric, composite, anomaly detection, missing data treatment), dashboard design, custom metrics (PutMetricData, EMF, metric filters), X-Ray tracing (ADOT, sampling rules, annotations vs metadata), ADOT collector config, and CloudTrail auditing. Use when the user mentions CloudWatch, Log Insights, alarms, INSUFFICIENT_DATA, dashboards, custom metrics, EMF, X-Ray, traces, sampling, CloudTrail, who deleted, ADOT, OpenTelemetry, observability, monitoring, synthetics, canaries, or troubleshooting alarm behavior. Do NOT use for application logging setup, container log drivers, or security threat detection. |
| `aws-processing-s3-uploads-with-step-functions` | [`references/skills/aws-processing-s3-uploads-with-step-functions/SKILL.md`](references/skills/aws-processing-s3-uploads-with-step-functions/SKILL.md) | Deploy an event-driven workflow that routes S3 uploads to either Lambda or Fargate via Step Functions based on file size. Uses EventBridge to trigger a Step Functions state machine when objects are uploaded to S3. Small files are processed by Lambda, large files by a Fargate task. Includes VPC, ECR repository, ECS cluster, and scoped IAM roles. Trigger keywords: Step Functions, Fargate, Lambda, S3 event, EventBridge, ECS, ECR, file processing, workflow orchestration, serverless. |
| `aws-querying-aws-cloudwatch` | [`references/skills/aws-querying-aws-cloudwatch/SKILL.md`](references/skills/aws-querying-aws-cloudwatch/SKILL.md) | Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables. Covers VPC Flow Logs, WAF logs, CloudFront access logs, Route 53 resolver logs, Network Firewall logs, EKS audit logs, Verified Access logs, SES logs, VPC Lattice logs, Step Functions logs, NLB access logs, and 20+ other AWS vended data sources. Applies when analyzing network traffic, investigating security incidents, querying exported logs with SQL, enabling S3 Tables integration, configuring log export, correlating logs with other data, or running Athena queries on the aws-cloudwatch table bucket. Trigger phrases: query logs with SQL, analyze logs in Athena, SQL on VPC flow logs, investigate network traffic, run SQL on exported logs, enable S3 Tables for CloudWatch, correlate logs, historical log analysis, set up log querying. |
| `aws-querying-aws-s3` | [`references/skills/aws-querying-aws-s3/SKILL.md`](references/skills/aws-querying-aws-s3/SKILL.md) | Queries S3 object metadata, tracks bucket activity, audits object changes, searches annotations, and analyzes storage metrics using S3 Metadata system tables (journal, inventory, annotation) and S3 Storage Lens tables via Athena SQL. Applies when counting objects, finding recent uploads or deletions, identifying who wrote to a prefix, breaking down storage classes, finding objects by tag, searching annotation content, analyzing storage lens metrics, or enabling S3 Metadata tracking. Prefers system tables over raw S3 APIs (list-objects-v2, head-object) at scale. Trigger phrases: bucket activity, object count, who uploaded, track deletions, storage class breakdown, find by tag, search annotations, storage lens metrics, audit bucket changes. |
| `aws-querying-aws-sagemaker-catalog` | [`references/skills/aws-querying-aws-sagemaker-catalog/SKILL.md`](references/skills/aws-querying-aws-sagemaker-catalog/SKILL.md) | Runs SQL analytics on SageMaker Catalog asset metadata tables exported as Apache Iceberg in S3 Tables. Covers governance queries, asset growth tracking, ownership audits, time-travel over catalog state, and metadata quality analysis. Applies when querying catalog inventory, finding assets without descriptions, comparing catalog snapshots, or auditing data ownership. Trigger phrases: catalog inventory SQL, how many assets, assets without descriptions, asset growth over time, who owns this data, catalog governance, data quality audit, catalog analytics. |
| `aws-querying-data-lake` | [`references/skills/aws-querying-data-lake/SKILL.md`](references/skills/aws-querying-data-lake/SKILL.md) | Execute and manage Athena SQL queries across default and federated catalogs (Glue, S3 Tables, Redshift). Triggers on phrases like: query data, run SQL, athena query, analyze table, SQL query, workgroup status, profile table, query Redshift catalog, query S3 Tables. Do NOT use for finding specific data assets (use finding-data-lake-assets), full catalog audits (use exploring-data-catalog), importing data (use ingesting-into-data-lake). |
| `aws-rds-db2` | [`references/skills/aws-rds-db2/SKILL.md`](references/skills/aws-rds-db2/SKILL.md) | Provisions, connects, migrates, and operates Amazon RDS for Db2. Applies when provisioning with IBM customer and site IDs (License Manager, BYOL, GovCloud), connecting over TLS, fixing SQL30082N after Secrets Manager rotation, migration from Db2 LUW (Linux, AIX, Windows, AS400) or z/OS mainframe (ADB2GEN, Q Replication), choosing code page/collation (EBCDIC, CCSID), S3 backup/restore, Multi-AZ and cross-region standby replicas, RDSADMIN procedures, customer-managed KMS BYOK, self-managed Active Directory Kerberos, Db2 audit to S3, minimum IAM, or colocation. |
| `aws-routing-traffic-with-route53-and-cloudfront` | [`references/skills/aws-routing-traffic-with-route53-and-cloudfront/SKILL.md`](references/skills/aws-routing-traffic-with-route53-and-cloudfront/SKILL.md) | Configures Amazon Route 53 to route traffic to a CloudFront distribution using a custom domain. Use when setting up DNS alias records, alternate domain names (CNAMEs), ACM certificates for HTTPS, and IPv6 support for CloudFront. |
| `aws-sdk-js-v3-usage` | [`references/skills/aws-sdk-js-v3-usage/SKILL.md`](references/skills/aws-sdk-js-v3-usage/SKILL.md) | AWS SDK for JavaScript v3 development patterns. Use when writing JavaScript or TypeScript code that uses AWS services via @aws-sdk/* packages (aws-sdk-js-v3), or when asked about schemas, runtime validation, serialization, or code generation in the context of the JS/TS AWS SDK. |
| `aws-sdk-python-usage` | [`references/skills/aws-sdk-python-usage/SKILL.md`](references/skills/aws-sdk-python-usage/SKILL.md) | AWS SDK for Python (boto3/botocore) development patterns. You MUST use this skill when writing Python code that uses AWS services via boto3 or botocore. This includes creating service clients or resources, configuring sessions and credentials, handling errors with ClientError, using paginators and waiters, S3 file transfers and presigned URLs, DynamoDB table operations, and any boto3/botocore client configuration. Use this skill whenever Python code imports boto3 or botocore, or when the user asks about AWS operations in Python. |
| `aws-sdk-swift-usage` | [`references/skills/aws-sdk-swift-usage/SKILL.md`](references/skills/aws-sdk-swift-usage/SKILL.md) | AWS SDK for Swift development patterns. Use when writing Swift code that uses AWS services via aws-sdk-swift package. |
| `aws-securing-s3-buckets` | [`references/skills/aws-securing-s3-buckets/SKILL.md`](references/skills/aws-securing-s3-buckets/SKILL.md) | Create and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation of misconfigurations. Use when the user wants to secure a new bucket, audit an existing bucket, fix a security finding, configure encryption, or enable logging and monitoring. Do NOT use for general S3 data operations, S3 Tables setup, or discovering existing data assets. |
| `aws-serverless` | [`references/skills/aws-serverless/SKILL.md`](references/skills/aws-serverless/SKILL.md) | Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK. Covers cold starts, CORS debugging, event source mappings, troubleshooting, concurrency, SnapStart, Powertools, function URLs, EventBridge Scheduler, Lambda layers, and production readiness. Triggers on mentions of Lambda, API Gateway, Step Functions, SAM templates, CDK serverless stacks, DynamoDB stream triggers, SQS event sources, cold starts, timeouts, 502/504 errors, throttling, concurrency, CORS, Powertools, or any event-driven architecture on AWS, even without the word "serverless." Does not apply to EC2, ECS/Fargate containers, or Amplify hosting. |
| `aws-setting-up-cloudtrail-multi-region` | [`references/skills/aws-setting-up-cloudtrail-multi-region/SKILL.md`](references/skills/aws-setting-up-cloudtrail-multi-region/SKILL.md) | Enables a multi-region AWS CloudTrail trail with S3 log storage, CloudWatch Logs integration, and CloudWatch Logs Insights queries for security monitoring and compliance auditing. Use when setting up centralized API activity logging across all AWS regions. |
| `aws-setting-up-cloudwatch-alarm-notifications` | [`references/skills/aws-setting-up-cloudwatch-alarm-notifications/SKILL.md`](references/skills/aws-setting-up-cloudwatch-alarm-notifications/SKILL.md) | Sets up notification channels for CloudWatch alarms using SNS topics and subscriptions. Always use this skill when configuring alarm notifications — it creates encrypted SNS topics, configures topic policies for CloudWatch access, sets up email/SMS/webhook subscriptions, and links alarms to notification actions with proper security controls. |
| `aws-setting-up-ec2-instance-profiles` | [`references/skills/aws-setting-up-ec2-instance-profiles/SKILL.md`](references/skills/aws-setting-up-ec2-instance-profiles/SKILL.md) | Configures EC2 instances to securely call AWS services by creating and attaching IAM roles via instance profiles, eliminating hardcoded credentials. Use when an EC2 instance needs permissions to access AWS services like S3, DynamoDB, SQS, or CloudWatch through temporary credentials. |
| `aws-storing-and-querying-vectors` | [`references/skills/aws-storing-and-querying-vectors/SKILL.md`](references/skills/aws-storing-and-querying-vectors/SKILL.md) | Store and query vector embeddings using Amazon S3 Vectors, a cost-effective long-term vector storage service with its own API namespace (s3vectors). Triggers on: create S3 vector bucket, vector index, store embeddings, semantic search, RAG vector storage, similarity search, vector database, migrate from other vector databases. Do NOT use for: querying tabular data (use querying-data-lake), S3 object storage, or hundreds/thousands of sustained QPS (use OpenSearch). |
| `aws-transform` | [`references/skills/aws-transform/SKILL.md`](references/skills/aws-transform/SKILL.md) | Performs code upgrades, migrations, and transformations using the AWS Transform (ATX) CLI. Use when upgrading language versions, migrating AWS SDKs, migrating frameworks (Angular, Vue.js, Spring Boot, React), upgrading libraries, optimizing performance, migrating x86 to Graviton, analyzing codebases / generating documentation, or defining custom transformations with natural language. Runs locally on a few repositories or at scale across hundreds via AWS Batch/Fargate. |
| `aws-troubleshooting-application-failures` | [`references/skills/aws-troubleshooting-application-failures/SKILL.md`](references/skills/aws-troubleshooting-application-failures/SKILL.md) | Troubleshoots failing applications by discovering and analyzing CloudWatch log groups to identify error patterns, root causes, and actionable solutions. Use when an application is experiencing failures and log-based diagnosis is needed. |
| `aws-troubleshooting-efs` | [`references/skills/aws-troubleshooting-efs/SKILL.md`](references/skills/aws-troubleshooting-efs/SKILL.md) | Diagnoses and resolves Amazon EFS issues including mount failures, NFS timeouts, permission errors, throughput problems, and burst credit exhaustion. Use when the user has an EFS file system that is not mounting, returning errors, performing slowly, or showing access denied. |
| `aws-troubleshooting-s3-files` | [`references/skills/aws-troubleshooting-s3-files/SKILL.md`](references/skills/aws-troubleshooting-s3-files/SKILL.md) | Diagnoses and resolves Amazon S3 Files issues including mount failures, permission errors, synchronization problems, and performance issues. Use when the user has an S3 file system that is not mounting, returning access denied, not syncing changes to S3, showing files in lost+found, or performing slower than expected. |
| `signing-in-to-aws` | [`references/skills/signing-in-to-aws/SKILL.md`](references/skills/signing-in-to-aws/SKILL.md) | Gets AWS credentials for CLI/SDK access via `aws login`. Activates when a developer needs to authenticate to AWS for local development, when an AWS operation fails due to missing or expired credentials, or when someone asks about setting up AWS access. Triggers: "set up AWS", "configure AWS", "aws login", "get credentials", "authenticate", "session expired", "token expired", "no credentials", "AccessDeniedException" with no configured credentials. |
<!-- folded-skills:auto:end -->
## Related Skills

- `find-skills` for upstream skill discovery before adding new children
- `skill-creator` for pruning or extending this router

---

Timeline

• 2026-07-15 | Generated a browseable source page from the actual executable skill file. Source: skills/engineering/aws/SKILL.md