# AWS Agent Toolkit Main Components: Core Skills, Plugins, Rules, and Tools > Discover the core components of the AWS agent toolkit: skills, plugins, rules, and tools. Build secure, autonomous agents for AWS actions with this powerful toolkit. - Repository: [Amazon Web Services/agent-toolkit-for-aws](https://github.com/aws/agent-toolkit-for-aws) - Tags: deep-dive - Published: 2026-06-28 --- **The AWS agent toolkit comprises five modular components—core skills, specialized skills, plugins, rules, and validation tools—that enable autonomous agents to securely discover, compose, and execute AWS-specific actions.** The AWS agent toolkit (repository: `aws/agent-toolkit-for-aws`) provides a modular, skill-based architecture for building AWS automation agents. This open-source framework organizes functionality into discrete, reusable units that agent runtimes can dynamically load and execute according to declarative security policies. ## Core Components of the AWS Agent Toolkit The AWS agent toolkit implements a "skill-based" architecture where functionality is encapsulated in modular units. According to the source code, the toolkit consists of five primary component categories. ### Core Skills **Core skills** provide the fundamental building blocks that every agent requires for basic AWS operations. These skills handle authentication, session management, and foundational serverless patterns. In [`skills/core-skills/signing-in-to-aws/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/core-skills/signing-in-to-aws/SKILL.md), the toolkit defines the authentication interface that agents use to establish AWS sessions. These core capabilities ensure agents can securely sign in before executing any service-specific operations. ### Specialized Skills **Specialized skills** expose fine-grained, service-specific commands for individual AWS services. These skills extend agent capabilities into domains such as storage, analytics, networking, and web development. For example, the storage skill located at [`skills/specialized-skills/storage-skills/storing-and-querying-vectors/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/specialized-skills/storage-skills/storing-and-querying-vectors/SKILL.md) provides S3 operations, while [`skills/specialized-skills/web-and-mobile-development/aws-amplify/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/specialized-skills/web-and-mobile-development/aws-amplify/SKILL.md) defines Amplify deployment capabilities. Each specialized skill wraps AWS SDK calls into agent-friendly interfaces. ### Plugins **Plugins** bundle related core and specialized skills into loadable packages that the agent runtime can consume. Each plugin represents a first-class deployment unit that groups functionality by domain. The repository includes several plugin packages: - `aws-core` - Foundational skills for basic AWS operations - `aws-data-analytics` - Specialized skills for data processing services - `aws-agents` - General agent capabilities - `aws-agents-for-devsecops` - Security and compliance automation As implemented in [`plugins/aws-core/skills/aws-serverless/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-serverless/SKILL.md), plugins wrap skill definitions and expose them to the runtime through a standardized interface. ### Rules **Rules** are declarative policy files that govern agent permissions and ensure safe interaction with AWS resources. Located at [`rules/aws-agent-rules.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/rules/aws-agent-rules.md), these configuration files define what actions agents are authorized to perform, implementing a governance layer that restricts potentially dangerous operations. The rules system evaluates execution requests against security policies before allowing skill invocation, preventing unauthorized access to sensitive resources. ### Tools **Tools** are utility scripts that maintain repository integrity and skill consistency. The [`tools/validate.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/tools/validate.py) script runs during CI pipelines to validate skill metadata, check file references, and ensure rule syntax compliance. These validation tools ensure that skill definitions remain syntactically correct and that all references to AWS resources and documentation resolve properly before deployment. ## How the AWS Agent Toolkit Components Work Together The AWS agent toolkit orchestrates components through a standardized execution flow: 1. **Plugin Loading** - The agent runtime loads one or more plugins (e.g., `aws-core`, `aws-agents-for-devsecops`) during initialization. 2. **Skill Registration** - Each plugin registers its core and specialized skills with the runtime, making them available for invocation. 3. **Request Routing** - When a user requests a task, the runtime selects the appropriate skill based on the intent (e.g., S3 upload, Amplify deployment). 4. **Policy Enforcement** - Before execution, the runtime checks [`rules/aws-agent-rules.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/rules/aws-agent-rules.md) to verify the action is permitted under current security policies. 5. **Execution** - The skill executes, typically wrapping AWS SDK calls to perform the requested operation. 6. **Validation** - During development, [`tools/validate.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/tools/validate.py) ensures skill metadata and references remain consistent. ## Practical Code Examples for the AWS Agent Toolkit The AWS agent toolkit exposes skills through a CLI-style interface. While the actual agent runtime operates outside this repository, the following examples demonstrate the command syntax for invoking specific skills. ### Authenticating with AWS (Core Skill) Invoke the core authentication skill defined in [`skills/core-skills/signing-in-to-aws/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/core-skills/signing-in-to-aws/SKILL.md): ```bash aws-agent-toolkit sign-in \ --profile my-aws-profile \ --region us-east-1 ``` ### Uploading Files to S3 (Specialized Storage Skill) Execute the storage skill implemented in [`skills/specialized-skills/storage-skills/storing-and-querying-vectors/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/specialized-skills/storage-skills/storing-and-querying-vectors/SKILL.md): ```bash aws-agent-toolkit s3 upload \ --bucket my-bucket \ --key path/to/object.txt \ --source ./local-file.txt ``` ### Deploying Amplify Applications (Specialized Web Skill) Deploy using the Amplify skill from [`skills/specialized-skills/web-and-mobile-development/aws-amplify/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/specialized-skills/web-and-mobile-development/aws-amplify/SKILL.md): ```bash aws-agent-toolkit amplify deploy \ --app-id d1abcd2efgh3 \ --branch main \ --framework react ``` ### Running Security Compliance Checks (DevSecOps Plugin) Execute the security skill from [`plugins/aws-agents-for-devsecops/skills/setup-security-agent/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-agents-for-devsecops/skills/setup-security-agent/SKILL.md): ```bash aws-agent-toolkit security check \ --target my-ec2-instance \ --profile devsecops-profile ``` ## Key Files and Directory Structure Understanding the AWS agent toolkit requires familiarity with its repository layout: - `skills/core-skills/` - Contains fundamental capabilities like authentication and basic serverless operations - `skills/specialized-skills/` - Houses service-specific implementations for Amplify, RDS, S3, Analytics, and Networking - `plugins/` - Contains loadable plugin packages including `aws-core`, `aws-data-analytics`, and `aws-agents-for-devsecops` - [`rules/aws-agent-rules.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/rules/aws-agent-rules.md) - Central policy definition file for agent permissions - [`tools/validate.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/tools/validate.py) - CI validation script for skill metadata and syntax checking - [`README.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/README.md) - High-level overview and quick-start documentation ## Summary The AWS agent toolkit provides a flexible, extensible foundation for building AWS automation agents through these key components: - **Core skills** deliver essential authentication and session management capabilities required by all agents - **Specialized skills** expose service-specific commands for individual AWS services like S3, Amplify, and RDS - **Plugins** bundle related skills into loadable units such as `aws-core` and `aws-agents-for-devsecops` - **Rules** enforce security policies through declarative configuration files that restrict agent actions - **Tools** maintain code quality through validation scripts like [`tools/validate.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/tools/validate.py) that check skill metadata and references This modular architecture enables developers to compose agents capable of automating virtually any AWS service while maintaining strict governance through rule-based security controls. ## Frequently Asked Questions ### What is the difference between core skills and specialized skills in the AWS agent toolkit? **Core skills** provide fundamental capabilities required by all agents, such as authentication and basic serverless operations, as defined in [`skills/core-skills/signing-in-to-aws/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/core-skills/signing-in-to-aws/SKILL.md). **Specialized skills** extend functionality into specific AWS service domains like S3, Amplify, or RDS, allowing agents to perform targeted operations like file uploads or application deployments. While core skills handle universal prerequisites, specialized skills implement domain-specific business logic. ### How do plugins work in the AWS agent toolkit architecture? Plugins package related skills into deployable units that the agent runtime loads dynamically. According to the source code in [`plugins/aws-core/skills/aws-serverless/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-serverless/SKILL.md), plugins expose both core and specialized skills through standardized interfaces, allowing the runtime to discover and invoke capabilities without hardcoding service dependencies. This plugin system enables modular deployment where you can load only the AWS service capabilities your agent requires. ### What is the purpose of the rules component in the AWS agent toolkit? The **rules** component, located at [`rules/aws-agent-rules.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/rules/aws-agent-rules.md), implements declarative security policies that restrict what actions agents can perform on AWS resources. Before executing any skill, the agent runtime checks these rules to ensure the requested operation is permitted, preventing unauthorized access or accidental infrastructure modifications. This governance layer ensures that even autonomous agents operate within defined security boundaries. ### How does the validation tool ensure skill consistency in the AWS agent toolkit? The [`tools/validate.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/tools/validate.py) script executes during CI pipelines to verify that skill definitions contain valid metadata, proper file references, and correct syntax. This validation tool checks that all skills referenced in plugins actually exist and that their documentation links resolve correctly, preventing broken dependencies in production. By automating these checks, the toolkit maintains high code quality across hundreds of service-specific skill definitions.