● Сообщество
zxkane
⚡ Сразу
aws-skills
автор zxkane · zxkane/aws-skills
Claude agent skills for AWS — shell-first workflows covering common services, with sensible defaults and least-privilege IAM.
aws-skills wraps common AWS CLI workflows as agent skills: EC2 fleet ops, S3 policy checks, IAM audits, CloudFormation/CDK scaffolding, and cost queries. Shell-first so you always see the commands being run. Pairs well with TerraShark for IaC.
Зачем использовать
Ключевые функции
- Shell-first — commands visible before execution
- Common services: EC2, S3, IAM, Lambda, CloudFormation, Cost Explorer
- Least-privilege IAM defaults
- Region and profile aware
- Works with Claude Code and Codex
Живое демо
Как выглядит на практике
aws-skill.replay
▶ готово
Сценарии использования
Реальные сценарии: aws-skills
Когда использовать: You need to patch or restart a group of instances matching a tag, without writing the whole script yourself.
Поток
-
Dry-run the query
Use aws-skill. List EC2 instances tagged Env=staging, App=api. Just describe, don't mutate.✓ Скопировано
→ Table of instance IDs with state
-
Plan the action
Now propose the command to restart all running ones. Show me the exact aws cli call before running it.✓ Скопировано
→ Command printed; no execution yet
-
Execute with guardrails
Execute in batches of 3 with 30s between batches. Abort if any fails.✓ Скопировано
→ Batched output with success/failure per batch
Итог: A controlled fleet operation with no unpleasant surprises.
Подводные камни
- Wrong profile/region destroys prod — Always echo the resolved profile + region as the first line of any action
Когда использовать: Before a compliance review, or after a misconfig alert.
Поток
-
List buckets
List all S3 buckets in our account with their public access block settings and any bucket policies that allow *.✓ Скопировано
→ Table with per-bucket status
-
Triage
Flag buckets that have public access and don't match our known public-bucket allowlist (list: [...]). Propose remediation for each.✓ Скопировано
→ Remediation plan per flagged bucket
Итог: A prioritized remediation list for S3 public exposure.
Подводные камни
- OAI / OAC for CloudFront looks public at the bucket level — Check CloudFront origin config before flagging
Когда использовать: A service account works with AdministratorAccess and you want to scope it down.
Поток
-
Collect usage
Pull the Access Analyzer / CloudTrail-derived actions used by this role over last 30 days.✓ Скопировано
→ Actions table
-
Generate scoped policy
Write the minimal policy matching those actions. No wildcard Resource unless necessary; comment where wildcards are justified.✓ Скопировано
→ Policy JSON with comments
Итог: A least-privilege policy with documented rationale.
Подводные камни
- 30 days isn't long enough to capture all paths — Verify against known monthly or quarterly jobs before flipping the policy
Когда использовать: Finance asks 'why did S3 spend spike in April?' — you want an answer before the meeting.
Поток
-
Query
Use Cost Explorer to compare S3 spend April vs March by usage type.✓ Скопировано
→ Diff table by usage type
-
Explain
Which usage type grew most, and which bucket is most likely responsible?✓ Скопировано
→ Hypothesis with specific bucket candidates
Итог: A specific attribution you can follow up on.
Комбинации
Сочетайте с другими MCP — эффект x10
AWS-skill for one-off ops, TerraShark for codified infra
Investigate with aws-skill, then codify the fix as Terraform with terrashark.✓ Скопировано
Security reviews on IAM and S3 configs
After IAM scoping, run OWASP review on the resulting policy.✓ Скопировано
Стоимость и лимиты
Во что обходится
- Квота API
- AWS API limits vary per service; usually non-issue for interactive use
- Токенов на вызов
- 5-15k for planning; execution is free of Claude tokens
- Деньги
- Free skill; AWS usage billed as normal
- Совет
- Cost Explorer API has per-request pricing. Cache results when iterating.
Безопасность
Права, секреты, радиус поражения
Хранение учётных данных: Standard AWS CLI credentials (shared config, SSO). Skill reads active profile.
Исходящий трафик: All AWS API calls. Command outputs may contain sensitive data (ARNs, tags).
Никогда не давайте: AdministratorAccess for interactive use
- Always verify active profile and region before destructive commands. Skill prints both before execution — don't skip the check.
- Use SSO short-lived credentials rather than long-lived access keys.
Устранение неполадок
Частые ошибки и исправления
AccessDenied despite correct profile
Role session may have expired. Re-authenticate (aws sso login or STS refresh)
Проверить: aws sts get-caller-identity
Commands hit the wrong region
Skill respects AWS_REGION env; set explicitly or pass --region each call
Rate-limiting on large fleet ops
Use the skill's batch mode with delays
Альтернативы
aws-skills в сравнении
| Альтернатива | Когда использовать | Компромисс |
|---|
| AWS MCP server | You want native MCP tool calls instead of shell-first | Less shell visibility; different trust model |