aws-samples
- 848 skills
- 0 followers
- last month last updated
- ▌ Kubernetes Manifests · aws-samplesConstruct Kubernetes Jobs, StatefulSets, and Services for GPU-accelerated RL training workloads on EKS
- ▌ Storage Mountpoint S3 · aws-samplesMount S3 buckets as POSIX-like filesystems in training pods via the Mountpoint for Amazon S3 CSI driver
- ▌ Gpu Instance Selection · aws-samplesSelect optimal EC2 GPU instance types for Physical AI RL training based on VRAM, interconnect, and cost requirements
- ▌ Container Image Building · aws-samplesBuild container images for Physical AI RL training including dependency conflict management, patching, and CodeBuild CI
- ▌ Eks Cluster Provisioning · aws-samplesProvision an Amazon EKS cluster with GPU node groups, EFA networking, and OIDC for Physical AI RL training workloads
- ▌ Monitoring Observability · aws-samplesMonitor GPU utilization, training progress, and costs using DCGM, Prometheus, Grafana, MLflow, and CloudWatch
- ▌ Rlinf Functional Testing · aws-samplesRLinf: Validate RLinf training examples end-to-end from container tests to single-step training
- ▌ Rlinf Dataset Preparation · aws-samplesRLinf: Download, preprocess, and stage datasets and model weights for RLinf training on EKS
- ▌ Rlinf Open Source Plugins · aws-samplesRLinf: Integrate Ray, veRL, vLLM, and KubeRay into the RLinf training stack on EKS
- ▌ Ami And Node Configuration · aws-samplesConfigure AMI selection and GPU node bootstrap including NVIDIA drivers, EFA, and Lustre client
- ▌ Kubernetes Native Features · aws-samplesLeverage Kubernetes-native features for GPU training including GPU Operator, topology scheduling, and priority classes
- ▌ Storage S3 Connector Pytorch · aws-samplesUse Amazon S3 Connector for PyTorch to read datasets and save checkpoints directly to S3
- ▌ Rlinf Pytorch Training Scripts · aws-samplesRLinf: Adapt RLinf training scripts for distributed execution on Amazon EKS with veRL, Ray, and FSDP
- ▌ Map · aws-samplesMap verified service capabilities against customer-provided control framework and threat model. Produces mapping-results.json, controls-catalog.md, and framework-mapping.md. Supports pluggable frameworks: CCMv4, NIST 800-53, CIS Benchmarks, ISO 27001, etc. Split into 4 focused sub-skills for better accuracy; this skill orchestrates them.
- ▌ Test · aws-samplesDeploy compliant resource template and validate zero Config rule findings. Requires AWS credentials.
- ▌ Assess · aws-samplesRun a 5-domain CAF security posture assessment for an AWS service. Produces (1) assessment-summary.md — CAF-structured findings with GAPS tables, (2) sar-facts.json — extracted SAR data, (3) checkpoint-results.json — factual checkpoint verification. These feed into the research, validate, and generate phases.
- ▌ Intake · aws-samples bundlePrecursor intake phase for the Service Approval pipeline. Collects service name, input type, and testing preferences. Produces intake-manifest.json consumed by all downstream phases. Supports file-based input (intake YAML) for repeatable, batch-friendly execution.
- ▌ Evidence · aws-samplesRun live AWS CLI probes against deployed compliant resources to prove each mapped control is enforced. Produces control x CLI x verdict matrix. Phase 7 of the pipeline.
- ▌ Generate V3 · aws-samplesGenerate all security control artifacts and compliant IaC templates from mapping-results.json and validated.json. Split into 3 focused sub-skills for better accuracy; this skill orchestrates them.
- ▌ Research V3 · aws-samplesAWS service capability discovery producing research.json with structured capabilities, API surface, and existing mitigations. Uses MCP servers for AWS documentation, service authorization, and best practices. Downstream skills (Validate, Map) consume this output. Split into 3 focused sub-skills for better accuracy; this skill orchestrates and merges.
- ▌ Validate V3 · aws-samplesVerify research.json v3.0 findings via MCP — confirm capabilities, API parameters, condition keys, SCP/RCP expressibility, and mitigation feasibility. Produce validated.json.
- ▌ Summarize V3 · aws-samplesProduce final APPROVAL-REPORT.md with framework coverage matrix, mitigation traceability, control inventory, test evidence, and verdict
- ▌ Generate Iac · aws-samplesGenerate compliant IaC templates in all 4 formats — modular Terraform, CDK TypeScript, CloudFormation YAML, and CDK for Terraform. Uses parameter coverage matrix from mapping-results.json and API surface from validated.json.
- ▌ Map Assemble · aws-samplesDeterministic assembly of map sub-skill outputs into final mapping-results.json, controls-catalog.md, and framework-mapping.md. Builds traceability, identifies coverage gaps, and runs comprehensive validation. No LLM reasoning required — pure data assembly.
- ▌ Service Approval V3 · aws-samplesOrchestrate all 9 service-approval agents (Intake → Assess → Research → Validate → Map → Generate → Test → Summarize → Evidence) to generate AWS security controls and compliant resource templates for any AWS service
- ▌ Generate Detective · aws-samplesGenerate detective and responsive security control artifacts — Config rules with Lambda handlers, EventBridge rules, CloudWatch alarms, SSM runbooks, Step Functions workflows, CloudTrail configuration. Reads from mapping-results.json and validated.json.
- ▌ Generate Preventive · aws-samplesGenerate preventive and proactive security control artifacts — SCPs, resource policies, KMS key policies, permission boundaries, tag policies, OPA policies, and CloudFormation Guard rules. Reads from mapping-results.json and validated.json.
- ▌ Map Parse Framework · aws-samplesParse a customer-provided control framework file (xlsx/json/md) into normalized framework_objectives[]. Produces map-framework-parsed.json consumed by map-assemble. Supports CCMv4, NIST 800-53, CIS Benchmarks, ISO 27001.
- ▌ Research API Surface · aws-samplesDiscover the complete API surface for an AWS service — all operations (control-plane AND data-plane), parameters, and cross-reference validation against SAR condition keys. Produces research-api-surface.json consumed by the research merge step.
- ▌ Research Mitigations · aws-samplesParse input files to extract existing mitigations, build initial asset inventory, and collect assessment gaps. Produces research-mitigations.json consumed by the research merge step.
- ▌ Map Framework Mapping · aws-samplesMap generated controls to framework objectives with per-objective analysis, confidence scoring, and strict quality gates. Produces map-framework-mapped.json consumed by map-assemble. The hardest sub-skill — requires careful per-objective reasoning, not batch keyword matching.
- ▌ Map Generate Controls · aws-samplesGenerate security controls from mitigations x capabilities, organized by Category x Scope matrix. Produces map-controls-generated.json with rich metadata for downstream framework mapping. Consumes validated.json.
- ▌ Research Capabilities · aws-samplesDiscover AWS service security capabilities (IAM, encryption, network, logging, org-policies) using MCP servers and assessment artifacts. Produces research-capabilities.json consumed by the research merge step.
- ▌ Research Attack Surface · aws-samplesIdentify applicable threat techniques for the target service based on API surface analysis and customer threat model input (MITRE ATT&CK, STRIDE, or custom). Produces research-attack-surface.json consumed by the research merge step.
- ▌ Support Cases · aws-samples bundleALWAYS use this skill in the beginning of any incident investigation, root cause analysis, or operational troubleshooting. This skill retrieves and analyzes AWS Support cases (open and resolved) to find historical incidents with similar symptoms, error patterns, or affected services. Activate this skill when investigating an issue and you observe service degradation, elevated error rates, latency spikes, connection failures, throttling, capacity issues, deployment-related failures, alarms, or any operational event or issue. This skill searches past support cases by service, time window, severity, and error keywords to surface prior root causes, proven remediations, and recurring patterns that inform the current investigation.
- ▌ Msk Operations · aws-samples bundleAmazon MSK Provisioned operations, troubleshooting, and health assessment for Standard and Express brokers. Use whenever the user mentions Amazon MSK, MSK Provisioned, MSK Standard/Express brokers, Apache Kafka on AWS, `kafka.*` / `express.*` instance types, or the `AWS/Kafka` CloudWatch namespace. Covers MSK performance issues (high CPU, produce/fetch latency, TrafficShaping), consumer lag, storage/EBS issues, rolling restarts, Kafka version upgrades, SECURITY_PATCHING, BROKER_UPDATE, CloudWatch alarm design, Kafka client (producer/consumer) tuning, under-replicated partitions, unexpected broker reboots, and full MSK operational reviews / health checks / best-practices audits. Do NOT use for MSK Connect, MSK Serverless, or MSK Replicator. Do NOT use for authoring CloudFormation, CDK, or Terraform templates. Do NOT use for other AWS services (RDS, Aurora, S3, DynamoDB, Kinesis, Lambda, EC2) unless MSK is explicitly named.
- ▌ AWS Health Events · aws-samples bundleALWAYS use this skill in the beginning of any incident investigation, root cause analysis, or operational troubleshooting. This skill retrieves and analyzes AWS Health events (service issues, scheduled changes, and account notifications) to identify AWS-side events that may explain or correlate with observed operational issues. Activate this skill when investigating an issue and you observe service degradation, elevated error rates, latency spikes, connection failures, throttling, capacity issues, deployment-related failures, alarms, or any operational event or issue. This skill searches AWS Health events by service, time window, region, and status to surface active or recent service disruptions, scheduled maintenance, and account-specific notifications that inform the current investigation. Also activate when a user requests a health event summary or report for their account over a specified time period.
- ▌ Database Rds Devops · aws-samples bundleDatabase-level data-plane diagnostics for Aurora MySQL and Aurora PostgreSQL. Executes predefined read-only health check queries via RDS Data API to analyze buffer pool, connections, locks, replication, storage, performance, and index efficiency. Requires the rds-aidba MCP server for database-internal access beyond what CloudWatch and RDS APIs provide.
- ▌ Service Quota Check · aws-samples bundleUse this skill during any incident investigation, capacity planning, or operational troubleshooting when the issue may be caused by hitting AWS service limits. Activate when you observe throttling errors (ThrottlingException, TooManyRequestsException, LimitExceededException), resource creation failures, capacity-related alarms, or when a recommendation involves provisioning new AWS resources.
- ▌ Rds Operation Review · aws-samples bundleComprehensive Amazon RDS and Aurora operational review aligned with the AWS Well-Architected Framework and RDS/Aurora best practices. Use this skill when a user asks to review, audit, or assess RDS instances or Aurora clusters for best practices compliance, security posture, reliability, performance, cost optimization, backups, encryption, or operational readiness. Triggers on requests like "RDS review", "Aurora best practices audit", "database operational assessment", "review my RDS instance", "RDS health check", or "ORR for RDS".
- ▌ Wiz Security Context · aws-samples bundleAutomatically load this skill when investigating an operational anomaly on a cloud resource - CPU or memory spikes, latency, elevated error rates, unexpected network traffic, crashes, or cost spikes - to determine whether it is a purely operational issue or a security incident, using the affected resource's security context (vulnerabilities, misconfigurations, exposed secrets, data findings, active threats, malware, detections, and toxic combinations).
- ▌ Eks Upgrade Readiness · aws-samples bundleUse this skill when a user asks to assess, plan, or validate an Amazon EKS cluster upgrade. Activate on requests mentioning "EKS upgrade", "Kubernetes version upgrade", "upgrade readiness", "upgrade plan", "pre-upgrade check", "version skew", "deprecated API", "addon compatibility", "node group upgrade", "control plane upgrade", "EKS end of support", "EKS extended support", "Karpenter drift", "kubelet version skew", or "blue-green cluster migration". It runs a pre-upgrade assessment per the AWS EKS Best Practices Guide, covering infrastructure prerequisites, EKS Upgrade Insights, API deprecations, addon compatibility, full data plane inventory (managed/self-managed nodes, Karpenter, Auto Mode, Fargate), AL2 to AL2023 migration, PDB/topology and StatefulSet safety, capacity planning, and pre/post-upgrade validation, then produces a scored readiness verdict with prioritized remediation. Do NOT use for ECS, general EKS troubleshooting unrelated to version upgrades, or EKS Anywhere/Outpost clusters.
- ▌ Aiml Access Diagnostics · aws-samples bundleUse this skill when diagnosing IAM and access failures for Bedrock and SageMaker. It traces the authorization chain — caller identity, iam:PassRole, trust policy, role permissions, resource policies, SCPs — to name the denying hop and propose a scoped policy. Read-only. Use when a Bedrock or SageMaker call fails on permissions: InvokeModel or Converse AccessDeniedException, CreateTrainingJob or CreateEndpoint AccessDenied, "is not authorized to perform", "not authorized to perform: iam:PassRole", or an execution role that cannot reach S3, ECR, or KMS. Also covers Marketplace and model-subscription denials that are not IAM gaps, and failures under non-access codes: ValidationException "Could not assume role" (trust-policy gap) or "No S3 objects found under S3 URL" (execution role cannot list the prefix). Do NOT use for IAM questions outside AI/ML, policy authoring or least-privilege review without a failure, throttling or quota errors (ThrottlingException), model quality issues, or non-AI/ML services.
- ▌ AWS Vpc Dns Investigation · aws-samples bundleUse this skill when a name is not resolving as expected inside a VPC, or before applying a DNS control-plane change. Activate on symptoms such as NXDOMAIN or SERVFAIL from an EC2 instance, a hostname resolving to a public address when a private endpoint was expected, an AWS service endpoint that stopped resolving after a VPC endpoint or Route 53 change, an application reaching the wrong IP, resolution that works from one instance but not another, IPv6 or dualstack resolution differences, a suspected on-premises forwarding or hybrid DNS problem, or a request to check whether enabling private DNS, adding a Resolver rule, associating a private hosted zone, attaching DNS Firewall, or associating a Route 53 Profile would break anything. It drives the aws-vpc-dns-diagnostics MCP server to observe live resolution from inside the subnet and to simulate a proposed change before it is applied.
- ▌ Bedrock Adoption Readiness · aws-samples bundleAmazon Bedrock production readiness assessment covering IAM governance, data retention (ZDR), quota and capacity headroom, and operational observability across Standard Bedrock and Mantle surfaces. Use this skill when a user asks to review Bedrock readiness, assess Bedrock security posture, evaluate quota headroom, check ZDR configuration, validate Bedrock operational setup, or prepare for Bedrock production deployment. Triggers on "Bedrock readiness review", "am I ready for Bedrock production", "Bedrock security assessment", "check my Bedrock quotas", "Bedrock adoption audit", "Bedrock operational review", or "assess my Bedrock environment".
- ▌ Skip Scheduled Maintenance · aws-samples bundleSkip low-priority incidents during a scheduled maintenance window. Use this skill to automatically filter MEDIUM and LOW severity alarms that fire during planned maintenance, avoiding unnecessary investigations for expected disruptions.
- ▌ Redshift Support Specialist · aws-samples bundleAmazon Redshift domain expertise for query optimization, operational reviews, and cost optimization on provisioned clusters and Serverless workgroups. Use when a user asks about Redshift query tuning, slow queries, disk spill, distribution/sort key issues, a Redshift health check or operational review, or Redshift cost or RPU sizing. Requires the awslabs.redshift-mcp-server MCP server to be connected.
- ▌ Investigation Cost Guardrail · aws-samples bundleCost guardrail for AWS DevOps Agent that covers ALL AWS services and native agent tools. Before the agent makes any paid API call, this skill estimates cost, enforces budgets per investigation, detects expensive operations across all services (Athena queries, S3 scans, DynamoDB scans, SageMaker inference, PromQL, etc.), enforces time window requirements, monitors cumulative call volume, and cancels if thresholds are exceeded. This skill applies to ALL investigations regardless of which services are involved.
- ▌ Agentcore Observability Setup · aws-samples bundleValidates and bootstraps Amazon Bedrock AgentCore observability so customers can trace agent reasoning, detect silent failures, and measure performance before an outage. Use this skill when a user asks to check, validate, audit, verify, fix, or set up AgentCore observability, tracing, metrics, or logging - for example "is AgentCore observability configured correctly", "why can't I see traces for my agent", "my Bedrock agent has no spans in CloudWatch", "validate agent monitoring", "AgentCore observability readiness", or "set up OTEL for my agent". Covers AgentCore Runtime agents, Memory and Gateway resources, built-in tools, and agents hosted outside the runtime (Lambda, ECS, EKS, on-prem, multi-cloud). Verifies what is reachable via read-only CloudWatch, X-Ray, and AgentCore control-plane APIs, and prescribes exact remediation for gaps it cannot directly read such as code-level OTEL instrumentation.
- ▌ Analytics Opensearch Expertise · aws-samples bundleAmazon OpenSearch Service domain health assessment. Performs read-only, API-driven checks against a customer's OpenSearch domain(s) covering cluster health, node/shard configuration, performance metrics, security posture, and cost optimization signals. Activate this skill for requests about OpenSearch or Elasticsearch domain health, cluster review, domain assessment, performance, security posture, or cost optimization. Given a domain ARN (or name + region), it produces a structured findings report with prioritized recommendations. All checks use read-only AWS control-plane APIs (es:Describe*, es:GetCompatibleVersions, es:DescribeReservedInstances, cloudwatch:GetMetricData) — no data-plane access required.
- ▌ Enrich With AWS Security Agent · aws-samples bundleAutomatically load this skill when investigating application outages, service degradation, or errors that could have security-related root causes — including unexplained downtime, authentication or authorization failures, injection attacks, data exposure, or suspicious application behavior. Query AWS Security Agent CloudWatch logs to retrieve detailed code review findings with actionable, low-level details (file, line number, vulnerability type) that customers can directly fix.
- ▌ Storage S3 Resiliency Expertise · aws-samples bundleS3 resiliency, security, and data protection review. Assesses one or many S3 buckets across nine dimensions — versioning, replication, object lock, encryption, block public access, bucket policy, ownership controls, server access logging, and static website hosting — using read-only control-plane API calls, then produces a rated report with prioritized findings and remediation guidance. Single-bucket and multi-bucket (fleet) reviews are routed automatically by input count. Use when a user asks to review, audit, or assess an S3 bucket's resiliency, security, data protection, recovery posture, disaster recovery readiness, or audit posture, or asks about any of those nine features. Triggers on phrasings like "S3 resiliency review", "is my bucket safe", "audit S3 bucket security", "review these buckets: A, B, C", or "check versioning/replication/encryption/public access". Do NOT use for cost optimization, performance tuning, or EFS, FSx, AWS Backup, or Storage Gateway.
- ▌ Database Migration Service Expertise · aws-samples bundleAWS Database Migration Service (DMS) operational review and troubleshooting skill. Conducts best practices validation, health assessments, performance diagnostics, cost optimization reviews, and migration cutover guidance. Triggers on requests like "DMS review", "DMS health check", "DMS troubleshooting", "migration assessment", "DMS best practices audit", "DMS cost optimization", "replication instance review", "CDC latency issue", or "DMS task failure".
- ▌ Crm Production Investigation Guidelines · aws-samples bundleGuidelines for investigating production incidents in the CRM application. Use when triaging any alert or incident involving the CRM REST API, SQS queues, Lambda functions, or Aurora DSQL database in this AWS account. Ensures thorough root cause analysis using AWS-native observability tools.
- ▌ Agentcore Harness Slackbot · aws-samples bundleBuild and deploy a small Slack Events API adapter for an Amazon Bedrock AgentCore Harness, with incremental responses delivered through Slack chat.startStream, chat.appendStream, and chat.stopStream. Use when a customer wants to create or reuse an AgentCore Harness, expose it as a Slack bot, stream InvokeHarness contentBlockDelta events into Slack, scaffold the API Gateway plus Lambda plus FIFO SQS adapter, create a named Harness endpoint such as PROD, configure Slack manifests and secrets, or debug Slack signature, endpoint, IAM, queue, or streaming failures. This is a sample that creates billable AWS resources, so obtain explicit consent before executing deployment or resource-creation steps.
- ▌ Debug · aws-samples bundleDebugging specialist for AgentCore deployments: container failures, IAM permission errors, runtime exceptions, networking issues, and performance problems. Use when developers report errors, crashes, deployment failures, or need help troubleshooting their agent applications.
- ▌
- ▌ Fleet Ops · aws-samples bundleFleet operations specialist for agent restart, scaling, graceful draining, and capacity planning. Use when teams need to restart agents, scale the fleet up or down, drain agents for maintenance, or plan capacity.
- ▌ Knowledge · aws-samples bundlePlatform knowledge base: readiness requirements (C1-C12), deployment patterns, agent architecture patterns, and troubleshooting guides. Use when developers ask about platform capabilities, best practices, requirements, how to deploy, what is needed, or need help debugging deployment issues.
- ▌
- ▌ Governance · aws-samples bundleGovernance specialist for agent registration, Cedar policy management, message routing configuration, and platform compliance. Use when teams need to register agents, configure policies, set up routing patterns, or enforce governance standards.
- ▌ Monitoring · aws-samples bundleProduction monitoring specialist for AgentCore deployments: CloudWatch metrics, alarms, dashboards, operational best practices. Use when developers need to set up monitoring, configure alerts, analyze metrics, troubleshoot performance issues, or build dashboards.
- ▌ Onboarding · aws-samples bundleOnboarding specialist for new team setup, CLAUDE.md generation, agent configuration, and platform standards compliance. Use when teams need to onboard to the platform, set up new agents, generate configuration files, or learn platform standards.
- ▌ Code Review · aws-samples bundleReviews agent code for security vulnerabilities, quality issues, and agent-specific best practices. Checks for prompt injection, credential exposure, unsafe execution, error handling, and testing.
- ▌ Issue Creator · aws-samples bundleCreate structured GitHub issues from review and compliance findings
- ▌ Design Advisor · aws-samples bundleReviews agent applications for platform deployment readiness. Checks containerization, secrets, config, health endpoints, statefulness, error handling, dependencies, and security.
- ▌ Aidlc Inception · aws-samples bundleGuide developer teams through AIDLC Inception — structured requirements gathering, design, and artifact generation
- ▌ Migration Guide · aws-samplesHelp teams migrate AI agents between frameworks and runtimes — Bedrock Agents to AgentCore, LangChain to Strands, monolith to multi-agent. Use when the user asks about migration, porting, or switching frameworks.
- ▌ Policy Compiler · aws-samplesCompile enterprise policies into project-level CLAUDE.md files. Use when onboarding a new project (Phase 1) or when the user asks about policy requirements, compliance, or CLAUDE.md generation.
- ▌
- ▌ Testing Strategy · aws-samplesHelp design and implement test strategies for AI agents — unit tests, integration tests, agent evaluation, memory testing, tool mocking. Use when the user asks about testing agents.
- ▌ Cost Optimization · aws-samplesAnalyze and optimize costs for AI agent workloads on AWS — model selection, caching, memory pricing, scaling strategies. Use when the user asks about costs, pricing, or optimization.
- ▌ Deployment Config · aws-samples bundleGenerates deployment configurations for Amazon Bedrock AgentCore. Produces Dockerfiles, IAM policies, CDK stacks, buildspec files, runtime configs, and environment variable templates following AWS security best practices and least-privilege principles.
- ▌ Test Case Generator · aws-samples bundleGenerate structured test cases from spec.md acceptance criteria with 1:1 AC-to-TC traceability
- ▌ Architecture Knowledge · aws-samplesDeep knowledge about AI agent architectures, AWS services, memory patterns, and best practices. Use as reference when answering technical questions.
- ▌ Ecs Genai · aws-samples bundleUse whenever someone runs a GPU / ML / GenAI / LLM workload on Amazon ECS: GPU on ECS, ECS GPU-optimized AMI, g4dn/g5/g6/p4/p5 on ECS, which ECS launch type for GPU, Inferentia/Trainium/Neuron on ECS, distributed training, model inference or vLLM/Triton/TGI/Ray on ECS, Capacity Blocks, GPU sharing, ASG per GPU type. Covers GPU on ECS-on-EC2 and ECS Managed Instances (GPU AMIs, NVIDIA runtime, instance families); mixed-instance ASGs supported but constrained (no weighting; managed scaling protects on the smallest type); Capacity Blocks; inference/serving; Neuron; distributed ML; GPU observability; a GPU/ML security slice (PCI/HIPAA). AWS Fargate has NO GPU: use ECS-on-EC2, Managed Instances, ECS Anywhere, or keep Fargate and call Bedrock. Trigger even if GenAI is unsaid. Use eks-genai for Kubernetes/EKS; SageMaker for fully-managed ML; Bedrock for managed foundation models; ecs-architect for non-accelerator ECS design; ecs-build to render the settled design as Terraform; ecs-security for deep compliance.
- ▌ Ecs Recon · aws-samples bundleECS environment reconnaissance and discovery. Detects compute and capacity providers, task definitions, deployment configuration, auto scaling, networking, security posture, observability, and IaC/CI-CD tooling. Use when someone asks about their ECS environment, wants to describe a cluster, inspect a service, or document task definitions — even without naming the skill. Applies to Amazon ECS, not Amazon EKS (use eks-recon). Discovers current state only — does not score, audit, or design. Skip for operational audits and GREEN/AMBER/RED scoring (ecs-operation-review), deployment-model design, launch-type selection, and ECS best practices (ecs-architect), deployment strategy design and CI/CD engineering (ecs-devops), GPU/ML workloads (ecs-genai), security and compliance (ecs-security), cost/TCO (ecs-cost-intelligence, once available), observability design (ecs-observability), and replatform/migration (ecs-modernize, once available).
- ▌ Eks Build · aws-samples bundleUse when building EKS clusters. Generates complete, production-ready Terraform projects with optional ArgoCD GitOps integration. Handles environment-specific constraints: air-gapped/VPC-endpoint-only networks, enterprise proxies, private container registries, compliance requirements. Supports 3 patterns: full Terraform, ArgoCD+Terraform, ArgoCD+ACK/KRO. Includes validated modules, two-phase webhook ordering, IRSA/Pod Identity, and 29+ addon configurations. Ask interactive questions or accept requirements YAML. Also use when (1) generating EKS Terraform code from scratch, (2) creating GitOps-managed EKS addons with ArgoCD, (3) scaffolding EKS projects with compliance constraints, (4) implementing two-phase webhook ordering for EKS addons, (5) configuring IRSA or Pod Identity for EKS workloads, (6) generating ArgoCD ApplicationSets for EKS addon management, or (7) comparing deployment patterns for implementation decisions. Skip for Amazon ECS (use ecs-build).
- ▌ Eks Genai · aws-samples bundleUse whenever someone is building, training, fine-tuning, or serving a generative AI / LLM workload on Amazon EKS — phrased as "GPU vs Trainium/Inferentia", "vLLM on EKS", "Ray Serve / KubeRay", "distributed training on EKS", "FSx for Lustre for ML", "Karpenter for GPU", "EFA / NCCL multi-node", "DCGM / Neuron Monitor", "LiteLLM / AI gateway", "RAG on EKS", "agentic AI on EKS", or "self-host Llama / Mistral / Qwen". Walks the opinionated 6-layer stack (compute → cluster/scheduler → frameworks → storage → observability → AI gateway), the GPU-vs-Neuron decision, the JARK + vLLM + LiteLLM canonical reference, KV-cache tiering, cost levers (Neuron, Spot, Capacity Blocks), and a non-negotiable security baseline. Trigger even if "GenAI" is never said — any GPU/Neuron, inference-serving, or distributed-training decision on EKS qualifies. Skip for SageMaker-only or Bedrock-only (no self-hosting) asks, and for generic cluster design/build with no AI/ML workload (use eks-design / eks-build).
- ▌ Eks Recon · aws-samples bundleEKS cluster reconnaissance and environment discovery — reports the raw FACTS of a cluster and its environment. Detects compute (Karpenter, MNG, Auto Mode, Fargate, nodes/AMI), networking (VPC/CNI, subnets, load balancers, DNS), security facts (auth mode, IRSA/Pod Identity, RBAC, encryption), add-ons/Helm, observability, workloads (Deployments, StatefulSets, PDBs, HPAs), storage (CSI, StorageClasses, PVs, backup tooling), IaC (Terraform, CDK, eksctl), CI/CD (Actions, ArgoCD, Flux), and cluster insights. Use to discover or document the current state of an EKS cluster — 'what am I running', 'tell me about my setup', 'what version am I on', inventory before an upgrade/migration/design. Reports facts only; it does not score, rate, plan, or recommend, and overlapping facts with other skills is fine. Route elsewhere for a JUDGMENT or ARTIFACT: readiness scoring/deprecated-API checks (eks-upgrade-check), GREEN/AMBER/RED audits (eks-operation-review), design docs/diagrams (eks-design).
- ▌ Ecs Devops · aws-samples bundleUse when someone is deploying, releasing, or shipping software to Amazon ECS — phrased as "blue/green deployment on ECS", "canary deployment for my ECS service", "set up CI/CD for ECS", "GitHub Actions deploy to Fargate", "my ECS deployment is stuck", "ECS deployment circuit breaker", "ECS task sets", or "migrate off CodeDeploy blue/green". Covers strategy selection (rolling/blue-green/linear/canary), lifecycle hooks, circuit-breaker and alarm rollback, and pipelines (CodePipeline, GitHub Actions, ECR scanning) — scoped per launch type (EC2, Fargate, Managed Instances, ECS Anywhere). Trigger even if "deployment strategy" is never said — any release-safety, traffic-shifting, rollback, or pipeline decision for an ECS service qualifies. Skip for EKS/Kubernetes (use eks-* skills) and greenfield ECS architecture with no release angle (use ecs-architect for design and ecs-build for Terraform generation incl. deployment config blocks). For ECS monitoring stacks use ecs-observability; for GPU/ML on ECS use ecs-genai.
- ▌ Eks Design · aws-samples bundleUse when designing EKS architecture. Generates design documents with Mermaid diagrams, ADRs, security architecture, and validation reports. Translates requirements into tailored EKS designs guided by Well-Architected best practices. Covers cluster architecture, compute, networking, security, addons, observability, cost, and upgrade strategy. Also use when reviewing or validating existing EKS architectures, planning networking or security, evaluating deployment models, or generating architecture diagrams. Skip for short advisory recommendations without a formal document (eks-best-practices), Internal Developer Platforms or progressive delivery (eks-platform-engineering), and GenAI/LLM workload design — GPU vs Neuron, vLLM/Ray serving, distributed training (eks-genai).
- ▌ Update Docs · aws-samplesAudit and update every documentation surface in the APEX repo against the current state of skills, steering workflows, README marker tables, and the Docusaurus site under misc/website/. After any change to a skill (rename, retire, add, edit description), walk the repo, re-run script-managed surfaces if their --check fails, and reason through every tracked prose *.md to catch references that need updating. Use after adding/removing/renaming a skill, after editing SKILL.md frontmatter, after editing README marker blocks, or before publishing a docs change. Also use when the user says "update docs", "sync docs", "check docs", "run update-docs", or mentions that documentation might be stale.
- ▌ Eks Security · aws-samples bundleUse whenever someone needs security or compliance guidance for Amazon EKS — phrased as "CIS Benchmark for EKS", "HIPAA / PCI-DSS / FedRAMP / SOC 2 / GDPR on EKS", "harden my EKS cluster", "Bottlerocket vs AL2023 vs RHEL/Ubuntu AMI", "EKS Pod Identity vs IRSA", "Access Entries vs aws-auth", "GuardDuty for EKS", "Pod Security Admission / Kyverno / OPA", "NetworkPolicy / Security Groups for Pods", "ECR scanning / image signing (Cosign / Notation)", "EKS audit logging", "etcd / secrets encryption", or regulated-workload / audit-prep guidance. Walks the discovery-driven 7-layer security stack (OS/AMI → identity → workload → image → runtime → audit → compliance accelerators), the compliance-regime scope view, the AWS-canonical baseline, and a 30/60/90 hardening roadmap. Trigger even if "compliance" is never said — any EKS hardening, audit-prep, or regulated-workload decision qualifies. Skip for non-EKS (ECS/ROSA), account-level security with no EKS angle, or GenAI-workload security (use eks-genai).
- ▌ Ecs Architect · aws-samples bundleUse when choosing and architecting an Amazon ECS deployment model for a NEW workload — Fargate vs ECS on EC2 vs Managed Instances vs Express Mode vs ECS Anywhere/External — plus capacity-provider strategy, task sizing, awsvpc/ENI density, networking, service parameters, and launch-type or topology migration (EC2 launch type to capacity providers/Managed Instances; Service Discovery to Service Connect). Also the shared ECS best-practices corpus. Triggers include "which ECS launch type", "Fargate or EC2", "should I use Managed Instances", "migrate off EC2 launch type", "App Mesh to Service Connect", "migrate off App Runner". Skip for existing-app replatform (ecs-modernize); auditing a live estate (ecs-operation-review); cost/TCO (ecs-cost-intelligence); inventory (ecs-recon); security (ecs-security); deployment/CICD (ecs-devops); observability (ecs-observability); GPU/ML design AND GPU launch-type choice (ecs-genai); Kubernetes/EKS (eks-design); Terraform generation of a settled design (use ecs-build).
- ▌ Ecs Modernize · aws-samples bundleAssess an existing app (VMware/EC2) by source code analysis for the replatform vs rearchitect decision, and execute the approved migration onto Amazon ECS. Scope: assessment, strategy decision, migration execution. Covers: source code analysis; language/framework detection (Java, .NET, Spring, Struts, WebSphere tWAS/Liberty); cloud/container fit scoring; strategy recommendation; tWAS containerization and Liberty migration; migration planning; AWS Transform orchestration; containerization and ECR push; Replatform (ECS on EC2, bridge, sticky sessions) and Windows-container environment build; deploy and verification. Triggers: "migrate this app from EC2 to ECS", "can we containerize this VMware-hosted app?", "replatform or rearchitect for ECS?", "modernize this WebSphere app". Skip for greenfield design (ecs-architect), Rearchitect compute-model Terraform (ecs-build), live ECS inventory (ecs-recon), security hardening (ecs-security), cloud-ready .NET IaC (dotnet-aws-ecs), Kubernetes/EKS (eks-design).
- ▌ Eks MCP Server · aws-samples bundleInstall, configure, and troubleshoot the EKS MCP Server connection in your AI assistant (Claude Code, Cursor, Kiro). Use ONLY for MCP server setup problems — config file location (.mcp.json), IAM permissions for eks-mcp actions, uvx installation, choosing AWS-hosted vs self-hosted mode, or debugging why MCP tools fail to appear after config. Also activate if user mentions "eks mcp", "mcp server", "mcp.json", or "mcp tools not showing". Do NOT use for actual cluster operations once MCP is working — those go to eks-recon (discovery), eks-operation-review (audits), or eks-upgrade-check (upgrades). For setting up the Arm migration MCP server used for arm64 readiness scanning, use graviton-migration, not this skill.
- ▌ Ecs Observability · aws-samples bundleAdvise on Amazon ECS observability architecture — select the logs/metrics/traces stack (CloudWatch, Container Insights, X-Ray, ADOT/OpenTelemetry, Managed Prometheus/Grafana, FireLens to third-party) by compliance needs, existing tooling, scale, budget, and launch types (EC2, Fargate, Managed Instances, ECS Anywhere). Use for "how should we monitor our ECS services", "Container Insights or Prometheus for ECS", "are we losing ECS container logs", "set up tracing on Fargate", "ECS logging best practices", "Datadog vs CloudWatch for ECS", "GPU metrics for ECS tasks", or "plan live-debug access to an ECS task". Any ECS logging, metrics, tracing, or alerting design question qualifies even if "observability" is never said. Skip for EKS/Kubernetes (eks-* skills), deployment mechanics/CI-CD/deploy-failure diagnosis (ecs-devops; deploy-failure alerting stays here), security posture beyond observability audit logging (ecs-security), live-estate audits (ecs-operation-review), and FinOps audits of observability spend.
- ▌ Eks Upgrade Check · aws-samples bundleAssess EKS cluster upgrade readiness — run automated checks across 8 areas (version, breaking changes, deprecated APIs, add-on compatibility, node readiness, workload risks, AWS Insights, upgrade plan), calculate a 0-100 readiness score with a hard-blocker override, and generate a markdown/HTML report with prioritized remediation. Use this skill whenever someone asks "can I upgrade my cluster?", "is my cluster ready for 1.32?", "are we good to go to 1.33?", "what is blocking my upgrade?", or "should we move to the next version?" — even if they do not say "readiness" or "score". Falls back to AWS CLI and kubectl when the EKS MCP server is unavailable.
- ▌ Eks Best Practices · aws-samples bundleAdvisory guidance for Amazon EKS architecture and configuration decisions — compute strategy, networking, security, reliability, cost, autoscaling, observability, multi-tenancy, upgrade planning, on-prem/hybrid (EKS Hybrid Nodes, EKS Anywhere, Outposts), and surge readiness for planned traffic peaks. Also answers Terraform questions about terraform-aws-modules/terraform-aws-eks. Use for any EKS planning or architectural judgment call, even when phrased casually. Do NOT use for generating documents or code (eks-design, eks-build), scoring or auditing a live cluster (eks-operation-review, eks-upgrade-check), discovering what is running (eks-recon), MCP tooling setup (eks-mcp-server), developer platforms/IDPs (eks-platform-engineering), GenAI/LLM workloads — GPU vs Trainium/Inferentia, vLLM/Ray serving, distributed training (eks-genai), or compliance hardening and audit prep — HIPAA/PCI/FedRAMP, CIS benchmarks, GuardDuty, image signing (eks-security) or an x86→arm64/Graviton migration (use graviton-migration).
- ▌ Graviton Migration · aws-samples bundleExecute a workload migration from x86 (amd64) to AWS Graviton (arm64) — set up the Arm migration MCP server for code, dependency, and container arm64-readiness scanning, then run the migration — pre-migration scanning, Karpenter arm64 node cutover, and multi-arch CI pipelines. Use when someone says "migrate to Graviton", "move my workloads to arm64", "is my app arm64-ready", "graviton migration", "port this service to Graviton", "scan my code for arm64 blockers", "set up multi-arch container builds", or "cut my nodes over to arm64". This skill owns migration EXECUTION (readiness scanning, NodePool cutover, multi-arch builds). Do NOT use for scoring Graviton cost savings, quantifying Spot/Graviton adoption, or "how much would Graviton save me?" (use eks-cost-intelligence); for advisory "should I use Graviton?" architecture guidance (use eks-best-practices); or for general, non-Graviton MCP server setup like the EKS MCP server (use eks-mcp-server).
- ▌ Ecs Operation Review · aws-samples bundleRun a structured Amazon ECS operational-excellence assessment against a live estate (Fargate/EC2/Managed Instances/ECS Anywhere) and score it GREEN/AMBER/RED. Skip for EKS/Kubernetes (use eks-operation-review). Covers 8 domains — clusters & capacity, networking, task definitions, services & deployment safety (circuit breaker, blue/green, canary), service health & autoscaling (grace period, draining, AZ rebalancing), observability, security posture, and operational processes — producing a rated report with prioritized actions. Activate for "audit my ECS estate", "ECS health check", "score my ECS posture", "review my ECS services", "GREEN/AMBER/RED my ECS clusters", including single-domain reviews. For Day-0 design use ecs-architect; for security hardening use ecs-security; for cost/TCO use ecs-cost-intelligence; for observability design use ecs-observability; for CI/CD engineering use ecs-devops; for replatform/refactor use ecs-modernize; for read-only inventory use ecs-recon (siblings once available).
- ▌ Eks Operation Review · aws-samples bundleRun a structured EKS operational excellence assessment against a live cluster. Covers 10 areas — networking, autoscaling, observability, access & identity, add-ons, workload config, deployments, cluster lifecycle, IaC, operational processes — and produces a GREEN/AMBER/RED rated report with prioritized recommendations. Activate for any request to audit, review, health-check, or score an EKS cluster's operational posture, including section-scoped reviews of individual areas and version currency / current-state add-on / deprecated-API review with no target version. Not for upgrade readiness assessment against a target version, cluster discovery, or architectural design advice.
- ▌ Eks Cost Intelligence · aws-samples bundleRun a live EKS cluster cost efficiency assessment — analyze spending across 6 dimensions (compute efficiency, Spot/Graviton adoption, networking, storage, observability, idle resources), calculate a weighted 0-100 Cost Score, and generate a prioritized report with dollar-quantified findings and ready-to-apply remediation snippets. Use this skill when someone asks "how much am I wasting on EKS?", "run a cost audit on my cluster", "what's my biggest cost driver?", "analyze my cluster's cost efficiency", or needs dollar-denominated findings for a FinOps review — even if they don't say "cost intelligence" or "score". Combines live Cost Explorer data, CloudWatch utilization metrics, and Kubernetes resource analysis. Falls back to AWS CLI and kubectl when the EKS MCP server is unavailable. Distinct from eks-best-practices (static advisory guidance), eks-operation-review (operational health), and eks-recon (cluster discovery). Distinct from graviton-migration, which EXECUTES the x86→arm64 move, not scoring savings.
- ▌ Eks Ingress Migration · aws-samples bundleAssess a live EKS cluster's NGINX/Ingress estate and plan migration to Gateway API, the AWS Load Balancer Controller (ALB Ingress), or AWS Transform (ATX). Discovers ingress controllers and routes, scores migration difficulty 0–100 with a separate re-architecture gate, and generates per-cluster reports plus ready-to-apply manifests. Use when someone asks "how hard is it to move off nginx ingress?", "assess my ingress migration", "migrate nginx to ALB or Gateway API", "ingress migration audit", or "nginx ingress retirement plan". Not for upgrade readiness (eks-upgrade-check), operational audits (eks-operation-review), general cluster discovery (eks-recon), or general ingress configuration advice (eks-best-practices).
- ▌ Eks Platform Engineering · aws-samples bundleUse whenever someone is designing or building an Internal Developer Platform (IDP) or doing platform engineering on Amazon EKS — phrased as "build a developer platform", "self-service for developers", "golden paths", "IDP", or "set up Backstage / ArgoCD / Kargo". Covers the opinionated platform stack — developer portal (Backstage), GitOps delivery (ArgoCD, Argo Workflows), progressive delivery (Argo Rollouts) and multi-stage promotion (Kargo), infrastructure abstraction (ACK, kro), the developer-facing app abstraction (Backstage templates + kro, or KubeVela/OAM), self-service provisioning, hub-and-spoke topology with the GitOps Bridge, identity/SSO (Keycloak, Pod Identity), measuring success (DORA, Apache DevLake), GenAI-assisted platform engineering (Kiro), and golden paths for AI/ML and data. Trigger even if "platform engineering" is never said. Skip for single-cluster EKS architecture or cost/ops tuning with no platform angle (use eks-best-practices); for standalone Terraform use terraform-skill.
- ▌ Steering Workflow Creator · aws-samples bundleAuthor a new steering workflow for any AWS service and pair it with a matching slash-command shim. Use when the user asks to create a steering workflow, add a workflow to apex, standardize steering, write a new workflow for EKS / RDS / Lambda / IAM / any AWS service, or build a phased playbook that plugs into a service hub. Covers the convention (frontmatter, header block, required sections), tool routing (knowledge vs. live MCP vs. setup-bridge), and the lint pass before handoff.
- ▌ Eks Discovery · aws-samplesEKS cluster reconnaissance and environment discovery. Detects compute strategy, IaC tooling, CI/CD pipelines, add-on inventory, networking, security posture, and observability.
- ▌ S3 · aws-samplesDeep-dive into Amazon S3 bucket configuration, storage optimization, and access control. Use when designing S3 storage strategies, configuring bucket policies and access controls, optimizing performance for large-scale workloads, setting up lifecycle policies, or troubleshooting S3 access issues.
- ▌ Ec2 · aws-samplesDesign, configure, and optimize Amazon EC2 workloads. Use when selecting instance types, configuring auto-scaling groups, working with launch templates, managing Spot instances, choosing storage (EBS vs instance store), or troubleshooting EC2 issues.