# AWS Agent Toolkit Skills: Complete Guide to Core Capabilities and Usage > Explore 15 core AWS Agent Toolkit skills for serverless, containers, IAM, and Bedrock. This guide details their capabilities and usage for AI agent development. - Repository: [Amazon Web Services/agent-toolkit-for-aws](https://github.com/aws/agent-toolkit-for-aws) - Tags: deep-dive - Published: 2026-06-28 --- **The AWS Agent Toolkit provides 15 core skills—including serverless, containers, IAM, observability, and Bedrock integrations—that enable AI coding agents to execute AWS development tasks through self-contained markdown definitions stored in `plugins/aws-core/skills/`.** The AWS Agent Toolkit is an open-source repository (`aws/agent-toolkit-for-aws`) that equips AI coding agents with domain-specific expertise for AWS development and operations. These **AWS Agent Toolkit skills** are packaged under the `aws-core` plugin and loaded on demand by agents such as Claude Code, Codex, Cursor, and Kiro to handle everything from authentication to infrastructure deployment. ## What Are AWS Agent Toolkit Skills? Each skill is a self-contained markdown definition ([`SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/SKILL.md)) located in `plugins/aws-core/skills//` that contains concise capability descriptions, step-by-step instructions for agents, and reference materials. According to the source code, a typical skill directory includes: - **SKILL.md** – The master skill definition containing capability descriptions and agent instructions - **references/** – Markdown files with detailed guidance on specific patterns or services - **assets/** – Helper scripts, templates, or executable code (e.g., [`powertools-handler.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/powertools-handler.py) for Lambda) This architecture allows agents to retrieve only relevant guidance for the current task, reducing noise while ensuring access to vetted best practices. ## Core Skill Categories The AWS Agent Toolkit organizes its 15 core skills by functional domain. Each skill is implemented as a dedicated directory under `plugins/aws-core/skills/` with its own [`SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/SKILL.md) file. ### Authentication and Security - **signing-in-to-aws** – Authenticates the agent with AWS credentials and configures MCP server sessions. Located at [`plugins/aws-core/skills/signing-in-to-aws/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/signing-in-to-aws/SKILL.md). - **aws-iam** – Builds IAM policies, roles, and permission boundaries with guardrails. Located at [`plugins/aws-core/skills/aws-iam/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-iam/SKILL.md). - **aws-secrets-manager** – Stores, retrieves, and rotates secrets securely within agent workflows. Located at [`plugins/aws-core/skills/aws-secrets-manager/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-secrets-manager/SKILL.md). ### Compute and Infrastructure - **aws-serverless** – Creates, deploys, and troubleshoots Lambda functions, API Gateway, Step Functions, and event sources. References include [`lambda.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/lambda.md) and [`api-gateway.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/api-gateway.md) under `references/`. - **aws-containers** – Authors ECS task definitions, runs Fargate services, and handles App Runner deployments. Located at [`plugins/aws-core/skills/aws-containers/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-containers/SKILL.md). - **aws-cloudformation** – Validates, deploys, and troubleshoots CloudFormation stacks with pre-deployment validation scripts. Located at [`plugins/aws-core/skills/aws-cloudformation/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-cloudformation/SKILL.md). - **aws-cdk** – Migrates between CDK v1/v2, handles synthesis troubleshooting, and manages bootstrap and compliance checks. Located at [`plugins/aws-core/skills/aws-cdk/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-cdk/SKILL.md). ### SDK Integration - **aws-sdk-python-usage** – Implements best-practice patterns for boto3, including pagination, waiters, error handling, and service-specific examples for S3 and DynamoDB. Located at [`plugins/aws-core/skills/aws-sdk-python-usage/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-sdk-python-usage/SKILL.md). - **aws-sdk-js-v3-usage** – Works with the modular AWS SDK for JavaScript v3, covering type definitions, SigV4a support, and performance optimization. Located at [`plugins/aws-core/skills/aws-sdk-js-v3-usage/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-sdk-js-v3-usage/SKILL.md). - **aws-sdk-swift-usage** – Provides guidance for the AWS SDK for Swift, including client creation and credential handling. Located at [`plugins/aws-core/skills/aws-sdk-swift-usage/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-sdk-swift-usage/SKILL.md). ### Operations and Observability - **aws-observability** – Configures CloudWatch metrics, logs, alarms, X-Ray tracing, and CloudWatch Synthetics. Located at [`plugins/aws-core/skills/aws-observability/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-observability/SKILL.md). - **aws-messaging-and-streaming** – Handles SNS, SQS, Kinesis, and EventBridge patterns for reliable message processing. Located at [`plugins/aws-core/skills/aws-messaging-and-streaming/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-messaging-and-streaming/SKILL.md). - **aws-billing-and-cost-management** – Optimizes spend through Savings Plans, Reserved Instances, Cost Explorer, and CUR-Athena queries. Located at [`plugins/aws-core/skills/aws-billing-and-cost-management/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-billing-and-cost-management/SKILL.md). ### AI and Reusable Components - **amazon-bedrock** – Interacts with Bedrock models, sets up agents, guardrails, and knowledge bases. Located at [`plugins/aws-core/skills/amazon-bedrock/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/amazon-bedrock/SKILL.md). - **aws-blocks** – Provides reusable building blocks such as Lambda-as-a-Service and API Gateway wrappers that agents compose into larger solutions. Located at [`plugins/aws-core/skills/aws-blocks/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-blocks/SKILL.md). ## How to Install and Use Skills Agents consume AWS Agent Toolkit skills through the `aws-core` plugin. The installation process loads the skill definitions into the agent's context. ### Installing the Plugin ```bash # Add the repository to the marketplace (Cursor, Kiro, etc.) npx skills add aws/agent-toolkit-for-aws/skills # Install the core plugin /plugin install aws-core@claude-plugins-official ``` ### Invoking Specific Skills Once installed, agents invoke skills by referencing their directory name. The skill returns ready-to-deploy code or configuration based on its reference materials. **Generate a Lambda function** using the serverless skill: ```bash skill aws-serverless create-lambda \ --runtime python3.11 \ --handler handler.handle \ --description "Process S3 upload events" ``` This command processes the request against [`aws-serverless/references/lambda.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/aws-serverless/references/lambda.md) and returns a SAM/CloudFormation snippet plus a minimal handler file. **Query cost optimization** using the billing skill: ```bash skill aws-billing-and-cost-management recommend-savings \ --service ec2 \ --region us-east-1 ``` The skill reads [`references/service-optimization.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/references/service-optimization.md) to return Savings Plans versus Reserved Instances comparisons. **Access Python SDK patterns**: ```bash skill aws-sdk-python-usage list-s3-objects \ --bucket my-data-bucket \ --prefix logs/ ``` This generates a boto3 script with proper pagination and error handling as defined in [`references/s3.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/references/s3.md). **Configure Bedrock models**: ```bash skill amazon-bedrock create-model \ --model-id anthropic.claude-v2 \ --instance-type ml.g5.xlarge ``` The skill produces the required IAM policy, runtime configuration, and sample invoke script from [`references/sdk-converse-api-python.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/references/sdk-converse-api-python.md). ## Key Implementation Files The AWS Agent Toolkit's architecture relies on specific configuration and hook files: - **[`plugins/aws-core/.cursor-plugin/plugin.json`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/.cursor-plugin/plugin.json)** – Plugin manifest used by Cursor to expose core skills - **[`plugins/aws-core/.mcp.json`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/.mcp.json)** – MCP Server configuration defining AWS MCP endpoint connectivity - **[`plugins/aws-core/hooks/secret-safety.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/hooks/secret-safety.py)** – Security hook that redacts secrets before transmission back to the agent - **`plugins/aws-core/skills/*/SKILL.md`** – Master definitions for each of the 15 core skills - **`plugins/aws-core/skills/*/references/*.md`** – Detailed documentation referenced by skills during execution - **`plugins/aws-core/skills/*/assets/*`** – Executable scripts and templates (e.g., validation scripts for CloudFormation) ## Summary The AWS Agent Toolkit provides a comprehensive skill set for AI-assisted AWS development: - **15 core skills** covering authentication, compute, SDKs, observability, and AI services - **Markdown-based architecture** where each skill in `plugins/aws-core/skills/` contains a [`SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/SKILL.md) definition and supporting references - **Agent compatibility** with Claude Code, Codex, Cursor, and Kiro through the `aws-core` plugin - **Security enforcement** via the [`secret-safety.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/secret-safety.py) hook that redacts sensitive credentials - **On-demand loading** that retrieves only relevant guidance, ensuring agents use current best practices ## Frequently Asked Questions ### What file structure defines an AWS Agent Toolkit skill? Each skill is a directory under `plugins/aws-core/skills/` containing a [`SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/SKILL.md) file with capability descriptions and agent instructions, a `references/` subdirectory with detailed markdown documentation, and an optional `assets/` folder with helper scripts or templates. ### How do AI agents consume AWS Agent Toolkit skills? Agents install the `aws-core` plugin via commands like `/plugin install aws-core@claude-plugins-official`, then invoke specific skills by name (e.g., `skill aws-serverless create-lambda`). The skill processes the request against its reference materials and returns implementation code or configuration guidance. ### Which AWS Agent Toolkit skill should I use for serverless development? Use the **aws-serverless** skill, located at [`plugins/aws-core/skills/aws-serverless/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-serverless/SKILL.md), which provides guidance for Lambda functions, API Gateway, Step Functions, and event sources, including ready-to-deploy SAM templates and handler code. ### Are AWS Agent Toolkit skills secure for handling AWS credentials? Yes. The toolkit includes a security hook at [`plugins/aws-core/hooks/secret-safety.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/hooks/secret-safety.py) that automatically redacts secrets and credentials before they are transmitted back to the agent, while the **signing-in-to-aws** and **aws-secrets-manager** skills provide secure patterns for authentication and secret handling.