● Comunidade
zxkane
⚡ Instantâneo
aws-skills
por zxkane · zxkane/aws-skills
Claude agent skills for AWS — shell-first workflows covering common services, with sensible defaults and least-privilege IAM.
aws-skills wraps common AWS CLI workflows as agent skills: EC2 fleet ops, S3 policy checks, IAM audits, CloudFormation/CDK scaffolding, and cost queries. Shell-first so you always see the commands being run. Pairs well with TerraShark for IaC.
Por que usar
Principais recursos
- Shell-first — commands visible before execution
- Common services: EC2, S3, IAM, Lambda, CloudFormation, Cost Explorer
- Least-privilege IAM defaults
- Region and profile aware
- Works with Claude Code and Codex
Demo ao vivo
Como fica na prática
aws-skill.replay
▶ pronto
Casos de uso
Usos do mundo real: aws-skills
Quando usar: You need to patch or restart a group of instances matching a tag, without writing the whole script yourself.
Fluxo
-
Dry-run the query
Use aws-skill. List EC2 instances tagged Env=staging, App=api. Just describe, don't mutate.✓ Copiado
→ Table of instance IDs with state
-
Plan the action
Now propose the command to restart all running ones. Show me the exact aws cli call before running it.✓ Copiado
→ Command printed; no execution yet
-
Execute with guardrails
Execute in batches of 3 with 30s between batches. Abort if any fails.✓ Copiado
→ Batched output with success/failure per batch
Resultado: A controlled fleet operation with no unpleasant surprises.
Armadilhas
- Wrong profile/region destroys prod — Always echo the resolved profile + region as the first line of any action
Quando usar: Before a compliance review, or after a misconfig alert.
Fluxo
-
List buckets
List all S3 buckets in our account with their public access block settings and any bucket policies that allow *.✓ Copiado
→ Table with per-bucket status
-
Triage
Flag buckets that have public access and don't match our known public-bucket allowlist (list: [...]). Propose remediation for each.✓ Copiado
→ Remediation plan per flagged bucket
Resultado: A prioritized remediation list for S3 public exposure.
Armadilhas
- OAI / OAC for CloudFront looks public at the bucket level — Check CloudFront origin config before flagging
Quando usar: A service account works with AdministratorAccess and you want to scope it down.
Fluxo
-
Collect usage
Pull the Access Analyzer / CloudTrail-derived actions used by this role over last 30 days.✓ Copiado
→ Actions table
-
Generate scoped policy
Write the minimal policy matching those actions. No wildcard Resource unless necessary; comment where wildcards are justified.✓ Copiado
→ Policy JSON with comments
Resultado: A least-privilege policy with documented rationale.
Armadilhas
- 30 days isn't long enough to capture all paths — Verify against known monthly or quarterly jobs before flipping the policy
Quando usar: Finance asks 'why did S3 spend spike in April?' — you want an answer before the meeting.
Fluxo
-
Query
Use Cost Explorer to compare S3 spend April vs March by usage type.✓ Copiado
→ Diff table by usage type
-
Explain
Which usage type grew most, and which bucket is most likely responsible?✓ Copiado
→ Hypothesis with specific bucket candidates
Resultado: A specific attribution you can follow up on.
Combinações
Combine com outros MCPs para 10× de alavancagem
AWS-skill for one-off ops, TerraShark for codified infra
Investigate with aws-skill, then codify the fix as Terraform with terrashark.✓ Copiado
Security reviews on IAM and S3 configs
After IAM scoping, run OWASP review on the resulting policy.✓ Copiado
Custo e limites
O que custa rodar
- Cota de API
- AWS API limits vary per service; usually non-issue for interactive use
- Tokens por chamada
- 5-15k for planning; execution is free of Claude tokens
- Monetário
- Free skill; AWS usage billed as normal
- Dica
- Cost Explorer API has per-request pricing. Cache results when iterating.
Segurança
Permissões, segredos, alcance
Armazenamento de credenciais: Standard AWS CLI credentials (shared config, SSO). Skill reads active profile.
Saída de dados: All AWS API calls. Command outputs may contain sensitive data (ARNs, tags).
Nunca conceda: AdministratorAccess for interactive use
- Always verify active profile and region before destructive commands. Skill prints both before execution — don't skip the check.
- Use SSO short-lived credentials rather than long-lived access keys.
Solução de problemas
Erros comuns e correções
AccessDenied despite correct profile
Role session may have expired. Re-authenticate (aws sso login or STS refresh)
Verificar: aws sts get-caller-identity
Commands hit the wrong region
Skill respects AWS_REGION env; set explicitly or pass --region each call
Rate-limiting on large fleet ops
Use the skill's batch mode with delays
Alternativas
aws-skills vs. outros
| Alternativa | Quando usar | Troca |
|---|
| AWS MCP server | You want native MCP tool calls instead of shell-first | Less shell visibility; different trust model |