aws-samples
- 848 skills
- 0 followers
- last month last updated
- ▌ Aidlc 3 · aws-samples bundleAI-DLC workflow orchestrator. Reads manifest state, dispatches to phase skills, manages rollback and status. Executes phases by loading and following each skill's SKILL.md.
- ▌ AWS Resilience Modeling · aws-samples bundleConduct comprehensive AWS system architecture resilience analysis and risk identification. Use when the user wants to perform architecture analysis, identify failure modes, map system components and dependencies, assess risk priorities, or create disaster recovery plans. Also use for failure mode analysis, component dependency mapping, risk scoring, and mitigation strategy design — even if they don't explicitly say "resilience". Automatically invoked for AWS韧性分析, 架构分析, 系统风险评估, AWS韧性评估, 可靠性评估, 灾难恢复规划, 故障模式分析, 组件依赖分析, 风险识别.
- ▌ Setup · aws-samplesGuided installation and first-time setup for ABCA. Walks through prerequisites, toolchain installation, dependency setup, and initial deployment. Use when the user says "set up the project", "get started", "install", "first time setup", "how do I start", "prerequisites", or is new to the project.
- ▌ Deploy · aws-samplesDeploy, diff, or destroy the ABCA CDK stack. Handles pre-deployment validation, synthesis, and post-deployment verification. Use when the user says "deploy", "cdk deploy", "deploy the stack", "destroy", "cdk diff", "what changed", "redeploy", or "update the stack".
- ▌ Status · aws-samplesCheck ABCA platform status — stack health, running tasks, and recent task history. Use when the user says "status", "health check", "is ABCA running", "check platform", or "what's the state".
- ▌ Submit Task · aws-samplesSubmit a coding task to the ABCA platform via CLI or REST API. Guides prompt quality, workflow selection, and cost controls. Use when the user says "submit a task", "create a task", "run the agent", "send task to agent", "bgagent submit", "new task", "pr iteration", "pr review", "review a PR", "quick submit", "submit to ABCA", or wants to automate coding work.
- ▌ Onboard Repo · aws-samplesOnboard a new GitHub repository to the ABCA platform so the agent can target it. Use when the user says "onboard a repo", "add a repository", "register a repo", "new repo", or gets a `REPO_NOT_ONBOARDED` / 422 error about an unregistered repository.
- ▌ Troubleshoot · aws-samplesDiagnose and fix common ABCA issues: deployment failures, preflight errors, authentication problems, agent failures, and build issues. Use when the user says "troubleshoot", "debug", "not working", "error", "failed", "help me fix", "preflight_failed", "task failed", "deploy failed", "auth error", "401", "422", "503", or describes something not working as expected.
- ▌ API Gateway 5 · aws-samples bundleDesign and configure Amazon API Gateway APIs. Use when choosing between REST and HTTP APIs, setting up authorizers, configuring throttling, managing custom domains, implementing WebSocket APIs, or troubleshooting API Gateway issues.
- ▌ Incident Triage 3 · aws-samples bundleUse when an alarm fires, a user reports an outage or degradation, or when you need to quickly assess severity, identify affected services, and determine immediate next steps. Also use when the user says "有告警", "服务挂了", "出问题了", "incident", or "on-call". Focuses on the FIRST 5 MINUTES: classify severity, scope blast radius, route to action. For deep diagnosis use aws-troubleshooting or log-diagnosis.
- ▌ Aidlc 2 · aws-samples bundleAI-Driven Development Life Cycle workflow. Use when user says "Using AI-DLC...", "AI-DLC로...", "Start AI-DLC", "start development", "build an app", "create a project", or wants intelligent adaptive software development workflow with requirements analysis, design, and implementation phases.
- ▌ Eks Operation Review 4 · aws-samples bundleRun a structured EKS operational excellence assessment against a live cluster. Covers 10 areas — networking, autoscaling, observability, access & identity, add-ons, workload config, deployments, cluster lifecycle, IaC, operational processes — and produces a GREEN/AMBER/RED rated report with prioritized recommendations. Activate for any request to audit, review, health-check, or score an EKS cluster's operational posture, including section-scoped reviews of individual areas and version currency / current-state add-on / deprecated-API review with no target version. Not for upgrade readiness assessment against a target version, cluster discovery, or architectural design advice.
- ▌ Text Agent To Nova Sonic Voice 3 · aws-samples bundleMigrate any text-based agent to a Nova Sonic voice agent using Strands BidiAgent. Covers two layers: (1) Frontend — browser WebSocket client with Web Audio API for mic capture and audio playback, (2) Orchestrator — FastAPI + Strands BidiAgent server that takes the text agent's system prompt and tools and runs them as a real-time speech-to-speech agent. TRIGGER when: user wants to add voice to an existing text agent; user asks about converting a chatbot to a Nova Sonic voice agent; user mentions text-to-voice migration, Strands BidiAgent, or Nova Sonic voice agent. SKIP when: user is building a text-only agent; user wants TTS/STT without a live agent loop; user is asking about deployment or infrastructure.
- ▌ Observability 2 · aws-samples bundleObservability specialist for agent fleet monitoring, policy violation tracking, audit log analysis, and compliance reporting. Use when teams need to check agent status, investigate violations, analyze audit logs, or generate operational reports.
- ▌ Security Review 2 · aws-samplesReview AI agent security — IAM policies, secret management, input validation, prompt injection defense, memory isolation. Use when the user asks about security, hardening, or threat modeling for agent systems.
- ▌ Sagemaker Deploy · aws-samples bundleStage any supported open-weight Hugging Face model directly into Amazon S3 and deploy it to an Amazon SageMaker AI real-time endpoint with a compatible vLLM or SGLang Deep Learning Container. Use for model hosting, endpoint creation, direct-to-S3 transfer, smoke testing, and deployment cleanup.
- ▌ Sagemaker Optimize · aws-samples bundleFind an optimized serving configuration for a model with Amazon SageMaker AI inference recommendations, then deploy it and compare against a baseline benchmark. Covers both config search (best instance + serving knobs) and deep optimization (speculative decoding / EAGLE 3, quantization, kernel tuning). Use when the user asks to optimize, speed up, tune, or get a recommendation for a deployed or to-be-deployed model.
- ▌ Sagemaker Benchmark · aws-samples bundleRun a managed performance benchmark against a deployed Amazon SageMaker AI endpoint using SageMaker AI inference benchmarking (part of optimized GenAI inference recommendations; NVIDIA AIPerf under the hood). Measures TTFT, ITL, request-latency percentiles, and throughput. Use when the user asks to benchmark / load-test / measure the performance of a live endpoint.
- ▌ Ecs Build 3 · aws-samples bundleUse when building Amazon ECS infrastructure with Terraform, generating apply-ready code for ECS clusters, services, and task definitions across three capacity models — Fargate (FARGATE_SPOT as capacity provider), EC2 Auto Scaling group providers, and ECS Managed Instances. Covers rolling/blue-green/linear/canary deployment config, Express services, Service Connect, private/VPC-endpoint-only networking, secrets, and Graviton. Also use when (1) wiring a Managed Instances capacity provider and its IAM role, (2) mixing FARGATE and FARGATE_SPOT in a strategy, (3) rendering blue/green, linear, or canary deployment config, (4) generating VPC endpoints for private or air-gapped ECS, (5) configuring Application Auto Scaling, or (6) migrating a service from launch type to capacity providers. Skip for EKS/Kubernetes builds (use eks-build), design and launch-type selection (use ecs-architect), CI/CD pipelines and release strategy (use ecs-devops), and replatforming an existing app onto ECS (use ecs-modernize).
- ▌ Ecs Security 3 · aws-samples bundleSecurity and compliance guidance for Amazon ECS — "ECS was unable to assume the role", task role vs execution role, iam:PassRole, confused-deputy aws:SourceArn trust, Fargate vs EC2 shared responsibility, injecting Secrets Manager/SSM secrets (trailing-colon JSON-key gotcha), readonlyRootFilesystem / non-root / drop capabilities, ECS Exec governance, security-group-per-task, VPC endpoint policies, GuardDuty ECS Runtime Monitoring, ECR Inspector scanning, image signing, Fargate FIPS, or PCI/HIPAA/FedRAMP. Walks a discovery-driven 7-layer stack plus the AWS-canonical baseline and a 30/60/90 roadmap. Trigger even if "compliance" is never said — any ECS hardening, task-trust fix, or secrets-injection qualifies. Skip for EKS/Kubernetes (eks-security), GenAI/GPU security (ecs-genai), App Runner/Lambda, auditing a live estate's operational posture (ecs-operation-review — "audit my ECS security posture" matches both), or account-level security with no ECS angle.
- ▌ Dotnet AWS Ecs 3 · aws-samples bundleGenerates IaC (CloudFormation or CDK) and a deployment guide to deploy a .NET workload to Amazon ECS Fargate on Linux containers with an Application Load Balancer. Produces a VPC, ECS cluster, task definition, ALB, and auto-scaling. NOT for Windows containers, EC2 launch type, or Kubernetes/EKS deployments.
- ▌ Eks Resilience Checker · aws-samples bundleAssess Amazon EKS cluster resilience against 26 best practice checks covering application workloads, control plane, and data plane. Outputs structured assessment.json for chaos-engineering-on-aws integration. Use when the user wants to evaluate EKS cluster resilience, run resilience assessment, check EKS best practices, or prepare for chaos experiments. Triggers on EKS resilience, 韧性评估, cluster assessment, resilience check, EKS best practices, 集群评估, resiliency check.
- ▌ AI Pdlc Navigator 2 · aws-samples bundleUse this skill whenever the user asks about this AI-PDLC repo — the tool-agnostic product development lifecycle with 9 phases (Discover → Iterate), 14 role swim lanes, ~130 activities, ~260 artifacts/outcomes, and AI acceleration guidance per role. Trigger on any mention of phases (Discover/Define/Design/Plan/Build/Verify/Launch/Operate/Iterate), roles (Product Sponsor, BA, Architect, SRE, PM, etc.), artifacts, outcomes, RACI, the swim-lane diagram, the drawio source, "assistive vs autonomous AI" for a role, or requests to extend/regenerate/commit changes to this lifecycle. Also trigger when the user says things like "update our flow", "what does X role do in Y phase", "where does artifact Z live", "how do I regenerate the diagram", or "stay source-of-truth aligned".
- ▌ Over Permissioned 2 · aws-samples bundleA file organizer skill that sorts files into directories based on type. Supports photos, documents, videos, and archives. Can process entire directory trees recursively.
- ▌ Insecure Installer 2 · aws-samples bundleA package manager helper skill that installs and configures development tools. Supports Node.js, Python, and Rust toolchains. Caches tool configurations for fast reinstall.
- ▌ Eks Upgrade Check 3 · aws-samples bundleAssess EKS cluster upgrade readiness by running automated checks across 8 areas (version validation, breaking changes, deprecated APIs, add-on compatibility, node readiness, workload risks, AWS Upgrade Insights, upgrade plan), calculate a readiness score (0-100%), and generate a detailed report with remediation steps and pre-filled AWS CLI commands. Assessment-only - all checks are strictly read-only and never modify the cluster. Use this skill when investigating EKS upgrade safety, or, in the context of a version upgrade, Kubernetes version skew, deprecated API usage, addon compatibility, or Karpenter version; also node upgrade readiness or control plane upgrade planning.
- ▌ Eks Operation Review 3 · aws-samples bundlePerform a structured EKS operational excellence assessment against a live cluster. Covers 10 areas: cluster lifecycle, infrastructure as code, access and identity, observability, workload configuration, networking, autoscaling, deployment practices, operational processes, and add-on management. Produces a GREEN/AMBER/RED rated report with prioritized recommendations. Activate for any request to audit, review, health-check, or score an EKS cluster operational posture, including section-scoped reviews and version currency / current-state add-on and deprecated-API review with no target version. Not for upgrade readiness assessment against a target version, cluster discovery, or architectural design advice.
- ▌ Map 2 · aws-samplesMap verified service capabilities against customer-provided control framework and threat model. Produces mapping-results.json, controls-catalog.md, and framework-mapping.md. Supports pluggable frameworks: CCMv4, NIST 800-53, CIS Benchmarks, ISO 27001, etc. Split into 4 focused sub-skills for better accuracy; this skill orchestrates them.
- ▌ Test 2 · aws-samplesDeploy compliant resource template and validate zero Config rule findings. Requires AWS credentials.
- ▌ Assess 2 · aws-samplesRun a 5-domain CAF security posture assessment for an AWS service. Produces (1) assessment-summary.md — CAF-structured findings with GAPS tables, (2) sar-facts.json — extracted SAR data, (3) checkpoint-results.json — factual checkpoint verification. These feed into the research, validate, and generate phases.
- ▌ Intake 2 · aws-samples bundlePrecursor intake phase for the Service Approval pipeline. Collects service name, input type, and testing preferences. Produces intake-manifest.json consumed by all downstream phases. Supports file-based input (intake YAML) for repeatable, batch-friendly execution.
- ▌ Evidence 2 · aws-samplesRun live AWS CLI probes against deployed compliant resources to prove each mapped control is enforced. Produces control x CLI x verdict matrix. Phase 7 of the pipeline.
- ▌ Generate V3 2 · aws-samplesGenerate all security control artifacts and compliant IaC templates from mapping-results.json and validated.json. Split into 3 focused sub-skills for better accuracy; this skill orchestrates them.
- ▌ Research V3 2 · aws-samplesAWS service capability discovery producing research.json with structured capabilities, API surface, and existing mitigations. Uses MCP servers for AWS documentation, service authorization, and best practices. Downstream skills (Validate, Map) consume this output. Split into 3 focused sub-skills for better accuracy; this skill orchestrates and merges.
- ▌ Validate V3 2 · aws-samplesVerify research.json v3.0 findings via MCP — confirm capabilities, API parameters, condition keys, SCP/RCP expressibility, and mitigation feasibility. Produce validated.json.
- ▌ Summarize V3 2 · aws-samplesProduce final APPROVAL-REPORT.md with framework coverage matrix, mitigation traceability, control inventory, test evidence, and verdict
- ▌ Generate Iac 2 · aws-samplesGenerate compliant IaC templates in all 4 formats — modular Terraform, CDK TypeScript, CloudFormation YAML, and CDK for Terraform. Uses parameter coverage matrix from mapping-results.json and API surface from validated.json.
- ▌ Map Assemble 2 · aws-samplesDeterministic assembly of map sub-skill outputs into final mapping-results.json, controls-catalog.md, and framework-mapping.md. Builds traceability, identifies coverage gaps, and runs comprehensive validation. No LLM reasoning required — pure data assembly.
- ▌ Service Approval V3 2 · aws-samplesOrchestrate all 9 service-approval agents (Intake → Assess → Research → Validate → Map → Generate → Test → Summarize → Evidence) to generate AWS security controls and compliant resource templates for any AWS service
- ▌ Generate Detective 2 · aws-samplesGenerate detective and responsive security control artifacts — Config rules with Lambda handlers, EventBridge rules, CloudWatch alarms, SSM runbooks, Step Functions workflows, CloudTrail configuration. Reads from mapping-results.json and validated.json.
- ▌ Generate Preventive 2 · aws-samplesGenerate preventive and proactive security control artifacts — SCPs, resource policies, KMS key policies, permission boundaries, tag policies, OPA policies, and CloudFormation Guard rules. Reads from mapping-results.json and validated.json.
- ▌ Map Parse Framework 2 · aws-samplesParse a customer-provided control framework file (xlsx/json/md) into normalized framework_objectives[]. Produces map-framework-parsed.json consumed by map-assemble. Supports CCMv4, NIST 800-53, CIS Benchmarks, ISO 27001.
- ▌ Research API Surface 2 · aws-samplesDiscover the complete API surface for an AWS service — all operations (control-plane AND data-plane), parameters, and cross-reference validation against SAR condition keys. Produces research-api-surface.json consumed by the research merge step.
- ▌ Research Mitigations 2 · aws-samplesParse input files to extract existing mitigations, build initial asset inventory, and collect assessment gaps. Produces research-mitigations.json consumed by the research merge step.
- ▌ Map Framework Mapping 2 · aws-samplesMap generated controls to framework objectives with per-objective analysis, confidence scoring, and strict quality gates. Produces map-framework-mapped.json consumed by map-assemble. The hardest sub-skill — requires careful per-objective reasoning, not batch keyword matching.
- ▌ Map Generate Controls 2 · aws-samplesGenerate security controls from mitigations x capabilities, organized by Category x Scope matrix. Produces map-controls-generated.json with rich metadata for downstream framework mapping. Consumes validated.json.
- ▌ Research Capabilities 2 · aws-samplesDiscover AWS service security capabilities (IAM, encryption, network, logging, org-policies) using MCP servers and assessment artifacts. Produces research-capabilities.json consumed by the research merge step.
- ▌ Research Attack Surface 2 · aws-samplesIdentify applicable threat techniques for the target service based on API surface analysis and customer threat model input (MITRE ATT&CK, STRIDE, or custom). Produces research-attack-surface.json consumed by the research merge step.
- ▌ Iac 2 · aws-samplesInfrastructure as Code best practices with Terraform, Ansible, Pulumi, and CloudFormation. Use when bootstrapping cloud environments, managing remote state backends, recovering from state issues, automating CI/CD pipelines for infrastructure, modularizing infrastructure for reuse, enforcing drift detection, or performing risk assessments before applying changes.
- ▌ AWS Skills 2 · aws-samplesGuides AWS development with infrastructure automation and cloud architecture patterns. Use when designing or refactoring cloud-native applications on AWS, automating environment provisioning with Terraform/CDK/CloudFormation, setting up secure CI/CD pipelines, evaluating service choices for cost/scalability/fault tolerance, or preparing production runbooks and observability.
- ▌ Terraform AWS 2 · aws-samplesComprehensive AWS infrastructure management with Terraform. Covers provider configuration, state management (S3 backend with native locking in Terraform 1.11+), common resource patterns (VPC, IAM, S3, RDS, EKS), module usage, and production best practices. Use when provisioning AWS infrastructure, managing Terraform state, creating VPCs, configuring IAM roles/policies, deploying databases, or troubleshooting Terraform/AWS issues.
- ▌ AWS Iam 3 · aws-samples bundleVerified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Also provides structured workflows for IAM role management and least-privilege policy generation. Covers condition operator safety (ForAnyValue/ForAllValues with Null checks for absent keys), bucket policy deny patterns (VPC endpoint restrictions, org path conditions), resource-based policy confused deputy protection, and service role creation for AWS services (Glue, CloudTrail, VPC Flow Logs, Firehose, DataSync, S3 replication, Lambda, Step Functions, ECS, etc.) including trust policies with aws:SourceAccount/aws:SourceArn conditions. Applies when creating or configuring IAM roles, writing IAM or bucket policies, working with STS, Organizations, condition operators, or any task requiring an IAM service role or execution role. Does not cover non-IAM authorization like Cognito user-pool policies or app-level RBAC.
- ▌ AWS Lambda 2 · aws-samples bundleDesign, build, deploy, test, and debug serverless applications with AWS Lambda. Triggers on phrases like: Lambda function, event source, serverless application, API Gateway, EventBridge, Step Functions, serverless API, event-driven architecture, Lambda trigger. For deploying non-serverless apps to AWS, use deploy-on-aws plugin instead.
- ▌ Agentic Optimizer 2 · aws-samples bundleGuides users to build optimal agentic AI workflows OR optimize existing agents. Analyzes use cases, recommends patterns, selects frameworks (LangGraph, CrewAI, Strands), generates production-ready code, and optimizes existing implementations based on Amazon's production lessons.
- ▌ API Gateway 3 · aws-samples bundleBuild, manage, and operate APIs with Amazon API Gateway (REST, HTTP, and WebSocket). Triggers on phrases like: API Gateway, REST API, HTTP API, WebSocket API, custom domain, Lambda authorizer, usage plan, throttling, CORS, VPC link, private API. Also covers troubleshooting API Gateway errors (4xx, 5xx, timeout, CORS failures) and IaC templates containing API Gateway resources. For general REST API design unrelated to AWS, do not trigger.
- ▌ AWS Cdk 2 · aws-samples bundleAuthors, deploys, and troubleshoots AWS infrastructure using CDK with TypeScript or Python. Covers best practices, stack architecture, and construct patterns. Always use when writing CDK constructs, bootstrapping environments, running cdk deploy/synth/diff, fixing CDK or CloudFormation errors, planning stack structure, importing existing resources, resolving drift, or refactoring stacks without resource replacement.
- ▌ AWS Iam 4 · aws-samples bundleVerified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Also provides structured workflows for IAM role management and least-privilege policy generation. Covers condition operator safety (ForAnyValue/ForAllValues with Null checks for absent keys), bucket policy deny patterns (VPC endpoint restrictions, org path conditions), resource-based policy confused deputy protection, and service role creation for AWS services (Glue, CloudTrail, VPC Flow Logs, Firehose, DataSync, S3 replication, Lambda, Step Functions, ECS, etc.) including trust policies with aws:SourceAccount/aws:SourceArn conditions. Applies when creating or configuring IAM roles, writing IAM or bucket policies, working with STS, Organizations, condition operators, or any task requiring an IAM service role or execution role. Does not cover non-IAM authorization like Cognito user-pool policies or app-level RBAC.
- ▌ Incident Triage 2 · aws-samples bundleInterpret production incident tickets and monitoring alerts, identify the affected application or business flow, retrieve and correlate evidence (logs, telemetry, source code context, configuration, deployment history, known issues), and produce an evidence-backed incident analysis: summary, probable root-cause hypotheses with confidence indicators, impacted components, recommended diagnostic/remediation steps, and routing or escalation guidance. Triggers on phrases like: production incident, incident ticket, triage this alert, root cause, RCA, correlate logs, what broke, error spike, latency spike, transaction failed, timeout, outage, sev1/P1, escalate, on-call, anomaly detection, alert threshold, known issue, postmortem. Use whenever a production issue, alert, or incident report is being analyzed — even if the user just pastes an error message, a stack trace, a screenshot description, or asks 'why are customers seeing this error?'
- ▌ Terraform Skill 2 · aws-samples bundleUse when writing, reviewing, or debugging Terraform/OpenTofu modules, tests, CI, scans, or state ops - diagnoses failure mode (identity churn, secrets, blast radius, CI drift, state corruption) with version-aware guards.
- ▌ Ecs Build 2 · aws-samples bundleUse when building Amazon ECS infrastructure with Terraform, generating apply-ready code for ECS clusters, services, and task definitions across three capacity models — Fargate (FARGATE_SPOT as capacity provider), EC2 Auto Scaling group providers, and ECS Managed Instances. Covers rolling/blue-green/linear/canary deployment config, Express services, Service Connect, private/VPC-endpoint-only networking, secrets, and Graviton. Also use when (1) wiring a Managed Instances capacity provider and its infrastructure IAM role, (2) mixing FARGATE and FARGATE_SPOT in a strategy, (3) rendering the Terraform deployment configuration for a blue/green, linear, or canary strategy, (4) generating VPC endpoints for private or air-gapped ECS, (5) configuring Application Auto Scaling, or (6) rendering the migration of a service from launch type to capacity providers. Skip for EKS/Kubernetes builds (use eks-build), design and launch-type selection (use ecs-architect), CI/CD pipelines and release strategy (use ecs-devops).
- ▌ Ecs Recon 2 · aws-samples bundleECS environment reconnaissance and discovery. Detects compute and capacity providers, task definitions, deployment configuration, auto scaling, networking, security posture, observability, and IaC/CI-CD tooling. Use when someone asks about their ECS environment, wants to describe a cluster, inspect a service, or document task definitions — even without naming the skill. Applies to Amazon ECS, not Amazon EKS (use eks-recon). Discovers current state only — does not score, audit, or design. Skip for operational audits and GREEN/AMBER/RED scoring (ecs-operation-review), deployment-model design, launch-type selection, and ECS best practices (ecs-architect), deployment strategy design and CI/CD engineering (ecs-devops), GPU/ML workloads (ecs-genai), security and compliance (ecs-security), cost/TCO (ecs-cost-intelligence, once available), observability design (ecs-observability), and replatform/migration (ecs-modernize, once available).
- ▌ Ecs Devops 2 · aws-samples bundleUse when someone is deploying, releasing, or shipping software to Amazon ECS — phrased as "blue/green deployment on ECS", "canary deployment for my ECS service", "set up CI/CD for ECS", "GitHub Actions deploy to Fargate", "my ECS deployment is stuck", "ECS deployment circuit breaker", "ECS task sets", or "migrate off CodeDeploy blue/green". Covers strategy selection (rolling/blue-green/linear/canary), lifecycle hooks, circuit-breaker and alarm rollback, and pipelines (CodePipeline, GitHub Actions, ECR scanning) — scoped per launch type (EC2, Fargate, Managed Instances, ECS Anywhere). Trigger even if "deployment strategy" is never said — any release-safety, traffic-shifting, rollback, or pipeline decision for an ECS service qualifies. Skip for EKS/Kubernetes (use eks-* skills) and greenfield ECS architecture with no release angle (use ecs-architect for design and ecs-build for Terraform generation incl. deployment config blocks). For ECS monitoring stacks use ecs-observability; for GPU/ML on ECS use ecs-genai.
- ▌ AWS Observability 3 · aws-samples bundleBuilds, configures, debugs, and optimizes AWS observability with CloudWatch (Log Insights, Metrics, Alarms, Dashboards, EMF), X-Ray, CloudTrail, and ADOT (AWS Distro for OpenTelemetry), AND enables/onboards services to Application Signals using ADOT auto-instrumentation SDKs. Covers Log Insights queries, alarms (metric, composite, anomaly), dashboards, custom metrics/EMF, X-Ray tracing and sampling, ADOT collector config, CloudTrail auditing, and end-to-end Application Signals enablement via ADOT SDKs (CloudWatch Observability EKS add-on, CloudWatch Agent IAM, OTLP endpoints, ServiceEvents, Dynamic Instrumentation) on EC2, ECS, EKS, and Lambda in Python, Node.js, Java, and .NET. Applies to CloudWatch, alarms, dashboards, EMF, X-Ray, traces, CloudTrail, ADOT, monitoring, synthetics/canaries, OR enabling/onboarding/instrumenting a service for Application Signals using ADOT, ServiceEvents, auto-instrumentation, or making a service show up in Application Signals. Not for app logging or security threat detection.
- ▌ Java Upgrade 2 · aws-samples bundleUse when upgrading a Java service to the latest Java LTS (target newest — e.g. Java 25; fall back to 21/17 only if a dependency blocks it), performing the associated framework upgrade (Spring Boot 2→3, javax→jakarta), and containerising the result for ECS/EKS. Covers upgrade tooling (OpenRewrite, jdeps, jdeprscan, Maven/Gradle toolchain), the common Java 8→17/21/25 breakages, the containerisation arc, and — when a managed transformation service (e.g. AWS Transform) is NOT permitted — the prescriptive, group-by-group, build-verified language-native upgrade path (see references/prescriptive-language-native-upgrade.md). Triggers on Java upgrade, JDK upgrade, LTS upgrade, Spring Boot upgrade, jakarta migration, OpenRewrite, jdeps, jdeprscan, containerise Java, Dockerfile for Java, Corretto.
- ▌ Mobile Test Automation 2 · aws-samples bundleUse when designing, choosing tools for, or writing automated tests for mobile apps — native iOS, native Android, React Native, and Flutter. Covers Appium, Maestro, Detox, Espresso, XCUITest, emulator/simulator vs real device strategy, device farms (AWS Device Farm, BrowserStack, Sauce Labs), gestures, deep links, permissions, app lifecycle, mobile flakiness, and CI. Triggers on mobile testing, app test, iOS test, Android test, Appium, Maestro, Detox, Espresso, XCUITest, emulator, real device, device farm, deep link, app permissions. For web browser tests, use the web-test-automation skill instead.
- ▌ Ecs Security 2 · aws-samples bundleSecurity and compliance guidance for Amazon ECS — "ECS was unable to assume the role", task role vs execution role, iam:PassRole, confused-deputy aws:SourceArn trust, Fargate vs EC2 shared responsibility, injecting Secrets Manager/SSM secrets (trailing-colon JSON-key gotcha), readonlyRootFilesystem / non-root / drop capabilities, ECS Exec governance, security-group-per-task, VPC endpoint policies, GuardDuty ECS Runtime Monitoring, ECR Inspector scanning, image signing, Fargate FIPS, or PCI/HIPAA/FedRAMP. Walks a discovery-driven 7-layer stack plus the AWS-canonical baseline and a 30/60/90 roadmap. Trigger even if "compliance" is never said — any ECS hardening, task-trust fix, or secrets-injection qualifies. Skip for EKS/Kubernetes (eks-security), GenAI/GPU security (ecs-genai), App Runner/Lambda, auditing a live estate's operational posture (ecs-operation-review — "audit my ECS security posture" matches both), or account-level security with no ECS angle.
- ▌ Gitlab Mr 2 · aws-samples bundleLocate GitLab vulnerability reports and deliver remediations back to GitLab — branch/commit strategy, raising merge requests via glab CLI, the GitLab REST API, or a GitLab MCP, MR descriptions that carry the triage rationale, and optional write-back of dispositions (dismiss/comment findings). Triggers on phrases like: raise MR, merge request, glab, GitLab API, create branch, commit the fix, where is the vulnerability report, CI artifacts, security dashboard, dismiss finding, write back to GitLab, MR description, one MR per group vs batched. Use whenever fetching a GitLab security report or delivering a fix/disposition to GitLab, even if the user just says 'open the MR' or 'where's the report'.
- ▌ Ecs Architect 2 · aws-samples bundleUse when choosing and architecting an Amazon ECS deployment model for a NEW workload — Fargate vs ECS on EC2 vs Managed Instances vs Express Mode vs ECS Anywhere/External — plus capacity-provider strategy, task sizing, awsvpc/ENI density, networking, service parameters, and launch-type or topology migration (EC2 launch type to capacity providers/Managed Instances; Service Discovery to Service Connect). Also the shared ECS best-practices corpus. Triggers include "which ECS launch type", "Fargate or EC2", "should I use Managed Instances", "migrate off EC2 launch type", "App Mesh to Service Connect", "migrate off App Runner". Skip for existing-app replatform (ecs-modernize); auditing a live estate (ecs-operation-review); cost/TCO (ecs-cost-intelligence); inventory (ecs-recon); security (ecs-security); deployment/CICD (ecs-devops); observability (ecs-observability); GPU/ML design AND GPU launch-type choice (ecs-genai); Kubernetes/EKS (eks-design); Terraform generation of a settled design (use ecs-build).
- ▌ Dotnet Testing 2 · aws-samples bundleUse when authoring automated tests for .NET / C# code — unit tests, integration tests, mocking collaborators, and code coverage. Covers choosing a framework, structuring test projects, writing focused tests that map to requirements, and gating merges to keep trunk green. Triggers on .NET test, C# test, xUnit, NUnit, MSTest, coverlet, Moq, unit test .NET, dotnet test, test coverage C#, mocking C#. For web/browser E2E tests use web-test-automation; for mobile app tests use mobile-test-automation.
- ▌ Nova Sonic Optimization 2 · aws-samplesOptimize a Nova Sonic voice agent for low latency, cost, and reliability on AWS. Covers (1) measuring end-to-end and per-segment latency, (2) same-region deployment and network path tuning, (3) streaming inference and tool-call patterns that hide latency, (4) cost levers (provisioned vs on-demand, voice pricing), and (5) reliability across multiple regions. TRIGGER when: user wants to reduce voice latency; user mentions Groq-class responsiveness; user asks about same-region deployment, streaming, or cold start; user wants to control Nova Sonic cost. SKIP when: user is designing a new agent for the first time (use nova-sonic-best-practices); user is migrating from text (use text-agent-to-nova-sonic-voice).
- ▌ Dotnet AWS Ecs 2 · aws-samples bundleGenerates IaC (CloudFormation or CDK) and a deployment guide to deploy a .NET workload to Amazon ECS Fargate on Linux containers with an Application Load Balancer. Produces a VPC, ECS cluster, task definition, ALB, and auto-scaling. NOT for Windows containers, EC2 launch type, or Kubernetes/EKS deployments.
- ▌ Nova Sonic Best Practices 2 · aws-samplesBest practices for building a Nova Sonic speech-to-speech voice agent on AWS. Covers (1) when to choose Nova Sonic over a STT→LLM→TTS pipeline, (2) voice-first system prompt design, (3) tool calling for voice, (4) conversation UX patterns (barge-in, confirmation, disfluencies), and (5) common pitfalls. TRIGGER when: user is designing a new Nova Sonic voice agent; user asks how to write a voice prompt; user asks about speech-to-speech vs STT→LLM→TTS; user asks about tool calling, barge-in, or voice UX with Nova Sonic. SKIP when: user is migrating an existing text agent (use text-agent-to-nova-sonic-voice instead); user is debugging latency or cost (use nova-sonic-optimization instead).
- ▌ AWS Observability 4 · aws-samples bundleBuilds, configures, debugs, and optimizes AWS observability with CloudWatch (Log Insights, Metrics, Alarms, Dashboards, EMF), X-Ray, CloudTrail, and ADOT (AWS Distro for OpenTelemetry), AND enables/onboards services to Application Signals using ADOT auto-instrumentation SDKs. Covers Log Insights queries, alarms (metric, composite, anomaly), dashboards, custom metrics/EMF, X-Ray tracing and sampling, ADOT collector config, CloudTrail auditing, and end-to-end Application Signals enablement via ADOT SDKs (CloudWatch Observability EKS add-on, CloudWatch Agent IAM, OTLP endpoints, ServiceEvents, Dynamic Instrumentation) on EC2, ECS, EKS, and Lambda in Python, Node.js, Java, and .NET. Applies to CloudWatch, alarms, dashboards, EMF, X-Ray, traces, CloudTrail, ADOT, monitoring, synthetics/canaries, OR enabling/onboarding/instrumenting a service for Application Signals using ADOT, ServiceEvents, auto-instrumentation, or making a service show up in Application Signals. Not for app logging or security threat detection.
- ▌ Ecs Observability 2 · aws-samples bundleAdvise on Amazon ECS observability architecture — select the logs/metrics/traces stack (CloudWatch, Container Insights, X-Ray, ADOT/OpenTelemetry, Managed Prometheus/Grafana, FireLens to third-party) by compliance needs, existing tooling, scale, budget, and launch types (EC2, Fargate, Managed Instances, ECS Anywhere). Use for "how should we monitor our ECS services", "Container Insights or Prometheus for ECS", "are we losing ECS container logs", "set up tracing on Fargate", "ECS logging best practices", "Datadog vs CloudWatch for ECS", "GPU metrics for ECS tasks", or "plan live-debug access to an ECS task". Any ECS logging, metrics, tracing, or alerting design question qualifies even if "observability" is never said. Skip for EKS/Kubernetes (eks-* skills), deployment mechanics/CI-CD/deploy-failure diagnosis (ecs-devops; deploy-failure alerting stays here), security posture beyond observability audit logging (ecs-security), live-estate audits (ecs-operation-review), and FinOps audits of observability spend.
- ▌ Regression Testing 2 · aws-samples bundleUse when planning or writing a behaviour-first regression safety net BEFORE a major change — a Java/JDK version upgrade, a framework migration (e.g. Spring Boot 2→3, AngularJS→React), a runtime change, or a large refactor. Prioritises tests that validate observable external behaviour (API contracts, E2E flows, pure business logic) so the suite survives the change boundary, and provides a decision-gated, per-unit test-generation workflow. Triggers on regression test, pre-upgrade test, test strategy, safety net, behaviour parity, API contract test, test prioritisation, what to test before upgrade. For the mechanics of writing web/UI E2E tests, also use the web-test-automation skill.
- ▌ API Gateway 4 · aws-samples bundleBuild, manage, and operate APIs with Amazon API Gateway (REST, HTTP, and WebSocket). Triggers on phrases like: API Gateway, REST API, HTTP API, WebSocket API, custom domain, Lambda authorizer, usage plan, throttling, CORS, VPC link, private API. Also covers troubleshooting API Gateway errors (4xx, 5xx, timeout, CORS failures) and IaC templates containing API Gateway resources. For general REST API design unrelated to AWS, do not trigger.
- ▌ AWS Cloudformation 2 · aws-samples bundleAuthor, validate, and troubleshoot AWS CloudFormation templates. Covers template authoring with secure defaults, pre-deployment validation (cfn-lint, cfn-guard, change sets), and root-cause diagnosis of failed stacks using CloudFormation events and CloudTrail correlation.
- ▌ Web Test Automation 2 · aws-samples bundleUse when designing, choosing tools for, or writing automated tests for web applications — E2E and UI tests, visual regression, web accessibility (axe-core), API testing inside browser flows, flaky-test debugging, page object model, and CI integration. Playwright-first, with Cypress and Selenium guidance and migration paths. Triggers on web testing, browser test, E2E, Playwright, Cypress, Selenium, page object, locator, flaky test, visual regression, accessibility testing, network mocking, CI sharding. For native iOS/Android/React Native/Flutter app tests, use the mobile-test-automation skill instead.
- ▌ AWS Event Driven Patterns 2 · aws-samples bundleDomain architecture guidance for event-driven financial-services systems on AWS — real-time market-data pipelines, stream processing, alert/subscription matching, multi-channel notification delivery, idempotency, and event-driven CDK stack design. Triggers on phrases like: event-driven architecture for FSI, market data stream processing, MSK topic and partition design, Flink vs Lambda vs ECS for streaming, subscription matching engine, push notification delivery, effectively-once processing, idempotency key, event-driven observability. For generic Lambda/EventBridge how-to unrelated to FSI event pipelines, use the aws-lambda skill instead; for MSK/Kafka service mechanics use the aws-messaging-and-streaming skill instead.
- ▌ AWS Serverless Deployment 2 · aws-samples bundleAWS SAM and AWS CDK deployment for serverless applications. Triggers on phrases like: use SAM, SAM template, SAM init, SAM deploy, CDK serverless, CDK Lambda construct, NodejsFunction, PythonFunction, SAM and CDK together, serverless CI/CD pipeline. For general app deployment with service selection, use deploy-on-aws plugin instead.
- ▌ Dotnet Adot Sidecar 2 · aws-samples bundleAdds OpenTelemetry instrumentation to a containerized .NET application and configures AWS Distro for OpenTelemetry (ADOT) as an ECS sidecar container. Updates existing IaC to include the ADOT collector in the task definition with proper IAM permissions. NOT for non-containerized apps or apps without existing ECS infrastructure.
- ▌ Ecs Operation Review 2 · aws-samples bundleRun a structured Amazon ECS operational-excellence assessment against a live estate (Fargate/EC2/Managed Instances/ECS Anywhere) and score it GREEN/AMBER/RED. Skip for EKS/Kubernetes (use eks-operation-review). Covers 8 domains — clusters & capacity, networking, task definitions, services & deployment safety (circuit breaker, blue/green, canary), service health & autoscaling (grace period, draining, AZ rebalancing), observability, security posture, and operational processes — producing a rated report with prioritized actions. Activate for "audit my ECS estate", "ECS health check", "score my ECS posture", "review my ECS services", "GREEN/AMBER/RED my ECS clusters", including single-domain reviews. For Day-0 design use ecs-architect; for security hardening use ecs-security; for cost/TCO use ecs-cost-intelligence; for observability design use ecs-observability; for CI/CD engineering use ecs-devops; for replatform/refactor use ecs-modernize; for read-only inventory use ecs-recon (siblings once available).
- ▌ Kotlin Coding Standards 2 · aws-samplesConventions for clean, idiomatic, safe Kotlin. Use when writing or reviewing Kotlin code.
- ▌ Text Agent To Nova Sonic Voice 2 · aws-samples bundleMigrate any text-based agent to a Nova Sonic voice agent using Strands BidiAgent. Covers two layers: (1) Frontend — browser WebSocket client with Web Audio API for mic capture and audio playback, (2) Orchestrator — FastAPI + Strands BidiAgent server that takes the text agent's system prompt and tools and runs them as a real-time speech-to-speech agent. TRIGGER when: user wants to add voice to an existing text agent; user asks about converting a chatbot to a Nova Sonic voice agent; user mentions text-to-voice migration, Strands BidiAgent, or Nova Sonic voice agent. SKIP when: user is building a text-only agent; user wants TTS/STT without a live agent loop; user is asking about deployment or infrastructure.
- ▌ AWS Messaging And Streaming 2 · aws-samplesGuides general use of AWS messaging and streaming services. Covers Amazon SQS, Amazon SNS, Amazon EventBridge, Amazon MQ, Amazon Kinesis Data Streams, Amazon Data Firehose, Amazon Managed Service for Apache Flink, and Amazon Managed Streaming for Apache Kafka (MSK). Use when reasoning about messaging and streaming patterns. In general, use specific skills or documentation searches for detailed service-specific questions. Do NOT use for MSK or Managed Service for Apache Flink questions, prefer specific skills.
- ▌ Dotnet Post Transform 2 · aws-samples bundleFixes build errors, wires dependency injection, and resolves static file serving issues in ASP.NET Framework apps transformed to ASP.NET Core by AWS Transform for .NET. Use after running AWS Transform to get a transformed project from compiling to running correctly. Works through five sequential phases automatically. ALSO USE for missing DI registrations, broken images/CSS/JS after migration, middleware pipeline ordering, Content folder vs wwwroot mismatch, and ConfigurationManager shim creation. NOT for greenfield ASP.NET Core apps, EF Core migration authoring, or production deployment hardening.
- ▌ Terraform Best Practices 2 · aws-samplesGuidance for writing clean, maintainable, secure Terraform (HCL). Use when authoring or reviewing Infrastructure as Code with Terraform.
- ▌ Vulnerability Triage 2 · aws-samples bundleParse, normalize, group, and prioritize security findings from GitLab vulnerability reports (JSON), and produce evidence-backed dispositions (fix vs. justified false positive). Triggers on phrases like: vulnerability report, gl-dependency-scanning-report.json, gl-sast-report.json, GitLab security report, CVE, CVSS, EPSS, KEV, triage findings, group vulnerabilities, deduplicate findings, false positive, is this exploitable, reachability, severity, prioritize remediation. Use whenever a GitLab (or GitLab-schema) security report is being analyzed, even if the user just pastes a JSON report or asks 'which of these do we actually need to fix?'
- ▌ Dotnet AWS Parameterstore 2 · aws-samples bundleEnhances a .NET application to externalize configuration into AWS Systems Manager Parameter Store and/or AWS Secrets Manager. Migrates hardcoded values (DB connection strings, API URLs, account IDs, feature flags) from appsettings.json or code into SSM parameters and Secrets Manager secrets, wires the app to resolve them at runtime via a helper class, and produces a summary guide with next steps. NOT for AppConfig feature-flag rollouts, Lambda-only apps, or greenfield apps that already use Parameter Store.
- ▌ Property Based Testing Guide 2 · aws-samplesHow to think about and write correctness properties and property-based tests. Use when defining properties in design docs or implementing property tests.
- ▌ Dependency Remediation 2 · aws-samples bundleRemediate security vulnerabilities in Node.js/npm projects — map a CVE to the offending package and fixed version, choose between a direct bump, a transitive-dependency override, or a code change, assess semver/breaking-change risk, update the lockfile, and verify the fix didn't break anything. Triggers on phrases like: fix vulnerability, upgrade dependency, npm audit, npm audit fix, package-lock.json, transitive dependency, overrides, resolutions, semver, breaking change, bump version, remediate CVE, patch dependency, yarn/pnpm audit, node_modules. Use whenever remediating a triaged Node.js dependency or code-level finding, even if the user just says 'fix these vulnerable packages' or 'bump lodash'.
- ▌ Android Design Best Practices 2 · aws-samplesGuidance for building modern, maintainable, accessible Android apps. Use when designing UI, structuring app modules, or reviewing Jetpack Compose code.
- ▌ AWS Serverless Best Practices 2 · aws-samplesGuidance for serverless backend infrastructure (Lambda, Step Functions, API Gateway, S3, DynamoDB, Cognito, Textract, Bedrock). Use when designing or reviewing serverless systems.
- ▌ Code Generator 2 · aws-samples bundleGenerates production-ready agentic AI implementations with AWS best practices
- ▌ Dotnet Aspnet Sessionstate AWS 2 · aws-samples bundleExternalizes ASP.NET Core session state to Amazon ElastiCache (Valkey or Redis). Modifies the application to use a distributed cache for session storage, optionally generates IaC (CloudFormation or CDK) to provision a new ElastiCache cluster, and produces a summary guide. NOT for output caching, response caching, or applications that don't use ASP.NET session state.
- ▌ Agent Optimizer 2 · aws-samplesSpecialized agent for optimizing existing agentic AI systems based on Amazon's production lessons and AWS best practices
- ▌ Pattern Advisor 2 · aws-samplesSpecialized agent for identifying optimal agentic AI patterns based on AWS prescriptive guidance
- ▌ Framework Selector 2 · aws-samplesSpecialized agent for selecting optimal agentic AI frameworks (LangGraph, CrewAI, Strands)
- ▌ Deploy Stack 2 · aws-samples bundleGuide for deploying the Embodied AI Platform CDK stacks (IsaacGr00tBatchStack + IsaacLabDcvStack) from scratch, including prerequisites, deployment, bootstrap monitoring, SSH setup via SSM, verification, training job submission, W&B visualization, and model evaluation. Also covers tearing down stacks and cleaning up retained resources. Use this skill whenever someone wants to deploy, redeploy, tear down the CDK infrastructure, visualize training metrics, submit training jobs, or run model evaluations — even if they just say "set up the stack", "deploy to AWS", "get DCV running", "view training loss", "run evals", or "clean up AWS resources".
- ▌ Deploy Stack 3 · aws-samples bundleGuide for deploying the Embodied AI Platform CDK stacks (IsaacGr00tBatchStack + IsaacLabDcvStack) from scratch, including prerequisites, deployment, bootstrap monitoring, SSH setup via SSM, verification, training job submission, W&B visualization, and model evaluation. Also covers tearing down stacks and cleaning up retained resources. Use this skill whenever someone wants to deploy, redeploy, tear down the CDK infrastructure, visualize training metrics, submit training jobs, or run model evaluations — even if they just say "set up the stack", "deploy to AWS", "get DCV running", "view training loss", "run evals", or "clean up AWS resources".