aws-samples

Use this skill to investigate and troubleshoot IAM Access Analyzer problems by analyzing analyzer creation, findings, external access, unused access, policy validation, policy generation, archive rules, and following structured runbooks. Activate when:…

Use this skill to investigate and troubleshoot AWS Certificate Manager (ACM) problems by analyzing certificate status, validation state, renewal configuration, and following structured runbooks. Activate when: DNS validation failures, email validation issues,…

Use this skill to investigate and troubleshoot Amazon Managed Grafana (AMG) problems by analyzing workspace configurations, data source connectivity, dashboard errors, authentication/SSO settings, alerting rules, plugin issues, API access, VPC connectivity,…

Use this skill to investigate and troubleshoot Amazon Managed Service for Prometheus (AMP) problems by analyzing workspace configurations, remote write failures, query performance, alerting/ruler issues, ingestion problems, Prometheus-compatible API issues,…

Use this skill to investigate and troubleshoot AWS Amplify Hosting problems by analyzing build failures, deployment issues, custom domains, backend environments, SSR configuration, access control, and CDN performance using structured runbooks. Activate when:…

Use this skill to investigate and troubleshoot Amazon API Gateway problems including REST API, HTTP API, and WebSocket API types by analyzing configurations, integrations, authorizers, deployments, and following structured runbooks. Activate when: Lambda…

Use this skill to investigate and troubleshoot AWS AppConfig problems. Activate when: configuration deployment fails, feature flags not toggling, deployment strategy issues, configuration validation errors, environment or application creation failures, hosted…

Use this skill to investigate and troubleshoot AWS Application Discovery Service problems by analyzing agent deployment, agentless discovery, data collection, export, dependency mapping, and Athena integration using structured runbooks. Activate when: agent…

Remediate security vulnerabilities in Node.js/npm projects — map a CVE to the offending package and fixed version, choose between a direct bump, a transitive-dependency override, or a code change, assess semver/breaking-change risk, update the lockfile, and…

Locate GitLab vulnerability reports and deliver remediations back to GitLab — branch/commit strategy, raising merge requests via glab CLI, the GitLab REST API, or a GitLab MCP, MR descriptions that carry the triage rationale, and optional write-back of…

Parse, normalize, group, and prioritize security findings from GitLab vulnerability reports (JSON), and produce evidence-backed dispositions (fix vs. justified false positive). Triggers on phrases like: vulnerability report,…

Use when upgrading a Java service to the latest Java LTS (target newest — e.g. Java 25; fall back to 21/17 only if a dependency blocks it), performing the associated framework upgrade (Spring Boot 2→3, javax→jakarta), and containerising the result for…

Use when planning or writing a behaviour-first regression safety net BEFORE a major change — a Java/JDK version upgrade, a framework migration (e.g. Spring Boot 2→3, AngularJS→React), a runtime change, or a large refactor. Prioritises tests that validate…

Use when designing, choosing tools for, or writing automated tests for web applications — E2E and UI tests, visual regression, web accessibility (axe-core), API testing inside browser flows, flaky-test debugging, page object model, and CI integration.…

Designs, reviews, and debugs DynamoDB data layers from design axioms — enumerates access patterns, chooses partition/sort keys and GSIs, decides single-table vs. multi-table, configures Streams, Global Tables, TTL, and zero-ETL integrations to…

Domain architecture guidance for event-driven financial-services systems on AWS — real-time market-data pipelines, stream processing, alert/subscription matching, multi-channel notification delivery, idempotency, and event-driven CDK stack design. Triggers on…

Stand up the four Diátaxis mode directories, each seeded with an index page, in a project that has no documentation tree. Invoke ONLY via the /ai-diataxis-scaffold slash command. Do not activate from intent, keywords, or near-synonyms — slash incantation is…

Create, assess, or survey documentation against the Diátaxis compass. Invoke ONLY via the /ai-diataxis slash command. Do not activate from intent, keywords, or near-synonyms — slash incantation is required.

Initialize or refine unified project context (.context/README.md). Invoke ONLY via the /ai-init slash command. Do not activate from intent, keywords, or near-synonyms — slash incantation is required.

Keep a project's architecture decision log — stand it up on first run, then write records and move them through propose, accept, and decline. Invoke ONLY via the /ai-adr slash command. Do not activate from intent, keywords, or near-synonyms — slash…

Execute an implementation plan for a feature by building all code specified in it. Invoke ONLY via the /ai-implement slash command. Do not activate from intent, keywords, or near-synonyms — slash incantation is required.

Create a comprehensive implementation plan for a feature, with phases, code samples, and testing strategy. Invoke ONLY via the /ai-plan slash command. Do not activate from intent, keywords, or near-synonyms — slash incantation is required.

Export a markdown file to a branded PDF. Invoke ONLY via the /ai-util-export-pdf slash command. Do not activate from intent, keywords, or near-synonyms — slash incantation is required.

Design software architecture for a feature before planning implementation. Invoke ONLY via the /ai-architect slash command. Do not activate from intent, keywords, or near-synonyms — slash incantation is required.

Run the AI-DLC `application-design` stage (inception phase) in isolation, without advancing the main workflow. Packages `/aidlc --stage application-design --single`: the engine emits one run-stage directive for application-design and its gate, the conductor…

Run the AI-DLC `approval-handoff` stage (ideation phase) in isolation, without advancing the main workflow. Packages `/aidlc --stage approval-handoff --single`: the engine emits one run-stage directive for approval-handoff and its gate, the conductor runs it,…

Run the AI-DLC workflow with the bugfix scope baked in — no scope detection. Fix a specific bug. Packaging over `/aidlc --scope bugfix`, which works without this skill.

Run the AI-DLC `build-and-test` stage (construction phase) in isolation, without advancing the main workflow. Packages `/aidlc --stage build-and-test --single`: the engine emits one run-stage directive for build-and-test and its gate, the conductor runs it,…

Run the AI-DLC `ci-pipeline` stage (construction phase) in isolation, without advancing the main workflow. Packages `/aidlc --stage ci-pipeline --single`: the engine emits one run-stage directive for ci-pipeline and its gate, the conductor runs it, then the…

Run the AI-DLC `code-generation` stage (construction phase) in isolation, without advancing the main workflow. Packages `/aidlc --stage code-generation --single`: the engine emits one run-stage directive for code-generation and its gate, the conductor runs…

Run the AI-DLC `delivery-planning` stage (inception phase) in isolation, without advancing the main workflow. Packages `/aidlc --stage delivery-planning --single`: the engine emits one run-stage directive for delivery-planning and its gate, the conductor runs…

Run the AI-DLC `deployment-execution` stage (operation phase) in isolation, without advancing the main workflow. Packages `/aidlc --stage deployment-execution --single`: the engine emits one run-stage directive for deployment-execution and its gate, the…

Search and retrieve AWS blog posts (service guides, customer stories, event recaps, new feature announcements, etc.) from the public AWS Blog directory API. Supports both English (en_US) and Japanese (ja_JP) blogs — these are independent content sets, not…

Research AWS public customer case studies across multiple sources and organize the findings. Use this skill when an AWS partner or Solutions Architect is asked "is there a public case study for X?" and needs to search broadly — the official directory API, the…

Covers AWS Payment Cryptography (APC) adoption, design, and migration support for issuers, acquirers, PSPs, and network processors. Provides architectural guidance on HSM migration, PIN verification, PIN translation, key management, card issuance, merchant…

Fetch, search, and retrieve AWS Security Bulletins (vulnerability advisories and security announcements published by AWS). Use this skill when the user wants to check, search, list, or get details of AWS security bulletins, CVEs affecting AWS services, or AWS…

Pre-execution security guard for AWS operations. Detects security risks before executing AWS CLI commands, IaC code (CloudFormation/Terraform/CDK), or AWS resource creation/modification/deletion, and presents warnings with reasons and alternatives. Trigger…

Fetch AWS What's New announcements from the official AWS API. Use when users ask about recent AWS announcements, new features, service updates, or want to know what's new in AWS. Supports date range filtering and returns structured JSON with headline, URL,…

Fetch, search, and analyze time-series statistical data from the Bank of Japan (BOJ) public API. Covers all BOJ databases including interest rates, money markets, foreign exchange, monetary base, Tankan survey, price indices, balance of payments, flow of…

Manage customer-specific context that LLMs cannot know on their own — abbreviations, internal system names, org structures, key contacts, deal history, and relationship notes. Stores context as human-readable Markdown files organized per customer, following…

Generate a complete ECS Fargate SOCI (Seekable OCI) example with Terraform. Demonstrates lazy-loading container images for faster task startup using SOCI index v2 manifests. Includes a heavy ML inference container (PyTorch + FastAPI) with and without SOCI for…

Guide customers from idea to AWS architecture with structured discovery, service selection, and Well-Architected review. Use when brainstorming new projects on AWS, helping customers choose AWS services, designing new architectures, or when someone says "I…

Guided migration from AWS App Runner to Amazon ECS Express Mode. Covers IAM setup, deployment, custom domains, DNS cutover, cost comparison, and troubleshooting. Use when the user asks to "migrate from App Runner", "move to ECS Express Mode", "replace App…

Azure to AWS migration guidance with service mappings, gotchas, and assessment. Use when migrating from Microsoft Azure, mapping Azure services to AWS equivalents, assessing Azure environments, or planning Azure-to-AWS migrations.

GCP to AWS migration guidance with service mappings, gotchas, and assessment. Use when migrating from Google Cloud Platform, mapping GCP services to AWS equivalents, assessing GCP environments, or planning GCP-to-AWS migrations.

Deep-dive into Amazon RDS and Aurora database design, engine selection, high availability, and operations. This skill should be used when the user asks to "design an RDS database", "choose between RDS and Aurora", "configure Aurora Serverless", "set up read…

Deep-dive into Amazon Bedrock AgentCore platform design, service selection, deployment, and production operations. This skill should be used when the user asks to "design an AgentCore architecture", "deploy agents on AgentCore", "configure AgentCore Runtime",…

Design and review AWS architectures following Well-Architected Framework principles. Use when planning new infrastructure, reviewing existing architectures, evaluating trade-offs between AWS services, or when asked about AWS best practices.

EKS security and compliance assessment — 7-layer hardening stack, CIS/HIPAA/PCI/FedRAMP/SOC2/GDPR audit prep, and 30/60/90 roadmap. Covers OS/AMI selection (Bottlerocket, AL2023, RHEL, Ubuntu), identity (EKS Pod Identity vs IRSA, Access Entries vs aws-auth),…

Security and compliance guidance for Amazon ECS — "ECS was unable to assume the role", task role vs execution role, iam:PassRole, confused-deputy aws:SourceArn trust, Fargate vs EC2 shared responsibility, injecting Secrets Manager/SSM secrets (trailing-colon…

Use whenever someone needs security or compliance guidance for Amazon EKS — phrased as "CIS Benchmark for EKS", "HIPAA / PCI-DSS / FedRAMP / SOC 2 / GDPR on EKS", "harden my EKS cluster", "Bottlerocket vs AL2023 vs RHEL/Ubuntu AMI", "EKS Pod Identity vs…

EKS cluster reconnaissance and environment discovery — reports the raw FACTS of a cluster and its environment. Detects compute (Karpenter, MNG, Auto Mode, Fargate, nodes/AMI), networking (VPC/CNI, subnets, load balancers, DNS), security facts (auth mode,…

EKS cluster reconnaissance and environment discovery — reports the raw FACTS of a cluster and its environment. Detects compute (Karpenter, MNG, Auto Mode, Fargate, nodes/AMI), networking (VPC/CNI, subnets, load balancers, DNS), security facts (auth mode,…

Use whenever someone is building, training, fine-tuning, or serving a generative AI / LLM workload on Amazon EKS — phrased as "GPU vs Trainium/Inferentia", "vLLM on EKS", "Ray Serve / KubeRay", "distributed training on EKS", "FSx for Lustre for ML",…

Advisory guidance for Amazon EKS architecture and configuration decisions — compute strategy, networking, security, reliability, cost, autoscaling, observability, multi-tenancy, upgrade planning, on-prem/hybrid (EKS Hybrid Nodes, EKS Anywhere, Outposts), and…

Perform a structured EKS operational excellence assessment against a live cluster. Covers 10 areas: cluster lifecycle, infrastructure as code, access and identity, observability, workload configuration, networking, autoscaling, deployment practices,…

CloudWatch 메트릭과 Prometheus 시계열 데이터에서 통계적 이상 징후를 자동 탐지하여 incident-response의 입력 소스로 제공한다. 베이스라인 학습(7일 이동 평균 + 3σ), 다변량 상관 분석, 계절성 보정을 수행하며 탐지된 anomaly를 severity 분류하여 알람을 생성한다.

알려진 장애 패턴에 대해 사전 정의된 Runbook 기반 자동 복구를 실행한다. RCA 결과 또는 incident-response의 가설을 입력으로 받아 매칭되는 remediation playbook을 선택하고, 복구 전/후 상태를 검증하며, 실패 시 에스컬레이션한다. SEV2/3만 자동 복구 대상이며 SEV1은 사람 전용이다.

Agent 또는 skill의 프로덕션 배포를 canary 1% → 10% → 50% → 100% 4단계로 자동 진행한다. 각 단계는 continuous-eval 통과와 SLO 준수를 gate로 하며 circuit breaker가 SLO 위반을 감지하면 즉시 이전 단계로 자동 롤백한다. 100% 승격은 사람 승인이 필수다.

Ragas 기반 품질·안전 평가를 매 배포 직후와 매 1시간 cron으로 실행하여 faithfulness, answer relevance, context precision, toxicity, PII leakage 지표를 측정한다. Golden dataset 관리와 regression gate(baseline 대비 5%p 하락 시 차단)를 수행하며 autopilot-deploy의 canary gate에 사용된다.

AWS Pricing과 Cost Explorer를 MCP로 조회하여 agent별 비용 귀속을 집계하고 예산 alert을 발행하며, 사용 패턴이 정당하면 Opus → Sonnet → Haiku 모델 다운그레이드를 권고한다. 월간 예산 ceiling을 초과할 것으로 예상되는 배포는 veto하여 autopilot-deploy의 pre-flight gate로 작동한다.

과거 트래픽 패턴과 시계열 예측을 기반으로 리소스 수요를 사전 예측하고 스케일링을 권고한다. 시간대별/요일별 계절성 분석, 이벤트 기반 수요 급증 예측, 비용 대비 성능 최적 구성 제안을 수행하며 cost-governance와 연동하여 예산 범위 내 스케일링을 보장한다.

인시던트 발생 시 관련 메트릭·로그·이벤트·변경 이력을 자동 수집하고 인과 관계를 추론하여 근본 원인을 식별한다. 타임라인 기반 이벤트 상관관계 분석, 변경-장애 매핑, 의존성 그래프 탐색을 수행하며 RCA 보고서를 자동 생성한다.

Langfuse production trace를 관찰하고 품질 regression·비용 이상·실패 패턴을 자동 분석한 뒤 prompt·skill 수정안을 PR draft 형태로 제안한다. Observe → Analyze → Propose → PR 4단계 루프를 실행하며 self-improving-agent-loop ADR의 자동화 경계(Rollout/Score/Filter까지만 자동, Train/Deploy는 사람 승인)를 강제한다.

Place search, directions, geocoding, and interactive maps

Test and prototype code in a sandboxed environment. Use for debugging, verifying logic, or installing packages.

Autonomous coding agent. Delegate any task that involves understanding, writing, or running code — from a GitHub issue, a bug report, or a user request. It explores, implements, and verifies on its own.

Create, inspect, edit, and validate professional PowerPoint presentations (.pptx), including uploaded source decks and templates, with design-system extraction, OOXML-preserving edits, structural linting, and rendered visual QA.

Read and write files in the shared session workspace. Use this to access files created by any skill — code-agent outputs, office documents, images, and more. All within the same isolated session.

Delegate one independent, context-heavy task to an isolated asynchronous analyst or reviewer. Use when the parent can continue without the result and the task has one concrete deliverable. Do not use for simple questions, tightly coupled next steps, external…

Deep research with structured reports and charts. ONLY use when the user explicitly requests research/analysis, or needs data visualization with charts, or quantitative/comparative analysis across multiple sources. Do NOT use for simple questions or quick…

Read, send, draft, delete, and organize Gmail emails

Build and deploy a small Slack Events API adapter for an Amazon Bedrock AgentCore Harness, with incremental responses delivered through Slack chat.startStream, chat.appendStream, and chat.stopStream. Use when a customer wants to create or reuse an AgentCore…

Guide developer teams through AIDLC Inception — structured requirements gathering, design, and artifact generation

Reviews agent code for security vulnerabilities, quality issues, and agent-specific best practices. Checks for prompt injection, credential exposure, unsafe execution, error handling, and testing.

Debugging specialist for AgentCore deployments: container failures, IAM permission errors, runtime exceptions, networking issues, and performance problems. Use when developers report errors, crashes, deployment failures, or need help troubleshooting their…

Generates deployment configurations for Amazon Bedrock AgentCore. Produces Dockerfiles, IAM policies, CDK stacks, buildspec files, runtime configs, and environment variable templates following AWS security best practices and least-privilege principles.

Reviews agent applications for platform deployment readiness. Checks containerization, secrets, config, health endpoints, statefulness, error handling, dependencies, and security.

Fleet operations specialist for agent restart, scaling, graceful draining, and capacity planning. Use when teams need to restart agents, scale the fleet up or down, drain agents for maintenance, or plan capacity.

Governance specialist for agent registration, Cedar policy management, message routing configuration, and platform compliance. Use when teams need to register agents, configure policies, set up routing patterns, or enforce governance standards.

Corporate KYC onboarding risk method — how to combine credit analysis and AML/compliance screening into one APPROVE / REJECT / ESCALATE decision with a 0-100 risk score. Use when assessing a prospective corporate customer for account opening or a periodic KYC…

Explains the overall structure, architecture, authentication flow, AWS services used, configuration values, design decisions, and implementation code of this demo application itself (FAST - Fullstack AgentCore Solution Template). Always use this skill when a…

Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore. Use when invoking models, setting up Knowledge Bases, creating agents, applying…

Analyze AWS costs, find savings, manage budgets, evaluate Savings Plans and Reserved Instances, right-size EC2/Lambda/RDS/EBS with Compute Optimizer, look up service pricing, query CUR with Athena, detect cost anomalies, scope costs to billing views, and…

Authors, deploys, and troubleshoots AWS infrastructure using CDK with TypeScript or Python. Covers best practices, stack architecture, and construct patterns. Always use when writing CDK constructs, bootstrapping environments, running cdk deploy/synth/diff,…

Author, validate, and troubleshoot AWS CloudFormation templates. Covers template authoring with secure defaults, pre-deployment validation (cfn-lint, cfn-guard, change sets), and root-cause diagnosis of failed stacks using CloudFormation events and CloudTrail…

Deploys and operates containerized workloads on ECS, Fargate, and ECR. Covers task definitions, Fargate services, ECR repository setup and lifecycle policies, ECS Exec debugging, service scaling, deployment strategies, load balancer integration, and logging…

Verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Use alongside documentation when working with IAM roles,…

Run a 5-domain CAF security posture assessment for an AWS service. Produces (1) assessment-summary.md — CAF-structured findings with GAPS tables, (2) sar-facts.json — extracted SAR data, (3) checkpoint-results.json — factual checkpoint verification. These…

Run live AWS CLI probes against deployed compliant resources to prove each mapped control is enforced. Produces control x CLI x verdict matrix. Phase 7 of the pipeline.

Generate detective and responsive security control artifacts — Config rules with Lambda handlers, EventBridge rules, CloudWatch alarms, SSM runbooks, Step Functions workflows, CloudTrail configuration. Reads from mapping-results.json and validated.json.

Generate compliant IaC templates in all 4 formats — modular Terraform, CDK TypeScript, CloudFormation YAML, and CDK for Terraform. Uses parameter coverage matrix from mapping-results.json and API surface from validated.json.

Generate preventive and proactive security control artifacts — SCPs, resource policies, KMS key policies, permission boundaries, tag policies, OPA policies, and CloudFormation Guard rules. Reads from mapping-results.json and validated.json.

Generate all security control artifacts and compliant IaC templates from mapping-results.json and validated.json. Split into 3 focused sub-skills for better accuracy; this skill orchestrates them.

Precursor intake phase for the Service Approval pipeline. Collects service name, input type, and testing preferences. Produces intake-manifest.json consumed by all downstream phases. Supports file-based input (intake YAML) for repeatable, batch-friendly…

Deterministic assembly of map sub-skill outputs into final mapping-results.json, controls-catalog.md, and framework-mapping.md. Builds traceability, identifies coverage gaps, and runs comprehensive validation. No LLM reasoning required — pure data assembly.