# Core Skills in the AWS Agent Toolkit: Complete Guide to the aws-core Plugin > Master core skills in the AWS Agent Toolkit with the aws core plugin. Learn to perform authenticated AWS operations across serverless, containers, observability, and cost optimization. - Repository: [Amazon Web Services/agent-toolkit-for-aws](https://github.com/aws/agent-toolkit-for-aws) - Tags: deep-dive - Published: 2026-06-27 --- **The AWS Agent Toolkit provides 15 core skills through the `aws-core` plugin, each defined as a self-contained markdown document ([`SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/SKILL.md)) that enables AI agents to perform authenticated AWS operations across serverless, containers, observability, and cost optimization.** The `aws/agent-toolkit-for-aws` repository delivers these **core skills** as the primary interface between AI coding agents—such as Claude Code, Codex, and Cursor—and AWS services. Each skill is a modular package containing step-by-step instructions, reference documentation, and reusable assets that agents load on demand to execute specific AWS tasks. ## What Are Core Skills in the AWS Agent Toolkit? **Core skills** are self-contained capability modules packaged under the `aws-core` plugin in the `aws/agent-toolkit-for-aws` repository. Each skill follows a standardized structure centered on a [`SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/SKILL.md) file that contains concise descriptions, procedural instructions, and links to reference materials. According to the source code, these skills reside in `plugins/aws-core/skills/` with each subdirectory representing a distinct functional domain. The agent loads these markdown definitions dynamically, retrieving only the relevant guidance for the current task to minimize context noise and ensure up-to-date best practices. ## Complete List of Core Skills by Domain The `aws-core` plugin ships **15 distinct skills** organized across infrastructure, security, SDKs, and operations: ### Authentication and Security - **Signing‑in to AWS** (`signing-in-to-aws`): Authenticate agents with AWS credentials and configure MCP server sessions. Defined in [`plugins/aws-core/skills/signing-in-to-aws/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/signing-in-to-aws/SKILL.md). - **AWS IAM** (`aws-iam`): Build policies, roles, and permission boundaries with guardrails. Source: [`plugins/aws-core/skills/aws-iam/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-iam/SKILL.md). - **AWS Secrets Manager** (`aws-secrets-manager`): Store, retrieve, and rotate secrets securely. Located in [`plugins/aws-core/skills/aws-secrets-manager/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-secrets-manager/SKILL.md). ### Compute and Serverless - **AWS Serverless** (`aws-serverless`): Create, deploy, and troubleshoot Lambda functions, API Gateway, and Step Functions. Reference: [`plugins/aws-core/skills/aws-serverless/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-serverless/SKILL.md). - **AWS Containers** (`aws-containers`): Author ECS task definitions, run Fargate services, and manage App Runner deployments. Found in [`plugins/aws-core/skills/aws-containers/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-containers/SKILL.md). - **AWS Blocks** (`aws-blocks`): Reusable building blocks like Lambda-as-a-Service wrappers for composition. See [`plugins/aws-core/skills/aws-blocks/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-blocks/SKILL.md). ### Infrastructure as Code - **AWS CloudFormation** (`aws-cloudformation`): Validate, deploy, and troubleshoot stacks with pre-deployment scripts. Source: [`plugins/aws-core/skills/aws-cloudformation/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-cloudformation/SKILL.md). - **AWS CDK** (`aws-cdk`): Migrate between CDK versions, troubleshoot synthesis, and manage bootstrap compliance. Located in [`plugins/aws-core/skills/aws-cdk/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-cdk/SKILL.md). ### Observability and Operations - **AWS Observability** (`aws-observability`): Configure CloudWatch metrics, X-Ray tracing, and Logs Insights queries. Defined in [`plugins/aws-core/skills/aws-observability/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-observability/SKILL.md). - **AWS Messaging and Streaming** (`aws-messaging-and-streaming`): Work with SNS, SQS, Kinesis, and EventBridge patterns. Reference: [`plugins/aws-core/skills/aws-messaging-and-streaming/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-messaging-and-streaming/SKILL.md). ### Cost and AI Services - **AWS Billing and Cost Management** (`aws-billing-and-cost-management`): Optimize spend with Savings Plans, Reserved Instances, and Cost Explorer analysis. Source: [`plugins/aws-core/skills/aws-billing-and-cost-management/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-billing-and-cost-management/SKILL.md). - **Amazon Bedrock** (`amazon-bedrock`): Interact with Bedrock models, agents, and knowledge bases. Located in [`plugins/aws-core/skills/amazon-bedrock/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/amazon-bedrock/SKILL.md). ### SDK Support - **AWS SDK for Python** (`aws-sdk-python-usage`): Boto3 patterns for pagination, waiters, and service-specific examples (S3, DynamoDB). See [`plugins/aws-core/skills/aws-sdk-python-usage/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-sdk-python-usage/SKILL.md). - **AWS SDK for JavaScript v3** (`aws-sdk-js-v3-usage`): Modular SDK usage with SigV4a support and performance optimization. Found in [`plugins/aws-core/skills/aws-sdk-js-v3-usage/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-sdk-js-v3-usage/SKILL.md). - **AWS SDK for Swift** (`aws-sdk-swift-usage`): Swift SDK client creation and credential handling. Source: [`plugins/aws-core/skills/aws-sdk-swift-usage/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-sdk-swift-usage/SKILL.md). ## Skill Architecture and Key Files Each core skill follows a consistent directory structure within `plugins/aws-core/skills/`. The [`SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/SKILL.md) file serves as the entry point, while supporting materials reside in standardized subdirectories: - **`references/`**: In-depth markdown documentation for specific service implementations (e.g., [`lambda.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/lambda.md), [`s3.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/s3.md)). - **`assets/`**: Helper scripts, templates, and boilerplate code (e.g., [`powertools-handler.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/powertools-handler.py) for Lambda functions). - **`hooks/`**: Security and validation scripts such as [`secret-safety.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/secret-safety.py), which redacts sensitive credentials before agent transmission. The plugin manifest at [`plugins/aws-core/.cursor-plugin/plugin.json`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/.cursor-plugin/plugin.json) exposes these skills to Cursor, while [`plugins/aws-core/.mcp.json`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/.mcp.json) configures the MCP server endpoint for agent communication. ## Practical Usage: Invoking Core Skills Agents consume core skills through natural language commands or structured skill invocations. Below are executable patterns for common workflows. ### Installing the aws-core Plugin Add the toolkit to your agent's marketplace and install the core plugin: ```bash # Add repository to marketplace (Cursor, Kiro, etc.) npx skills add aws/agent-toolkit-for-aws/skills # Install the core plugin /plugin install aws-core@claude-plugins-official ``` ### Generating Serverless Resources Use the **AWS Serverless** skill to scaffold Lambda functions with proper structure: ```bash skill aws-serverless create-lambda \ --runtime python3.11 \ --handler handler.handle \ --description "Process S3 upload events" ``` The skill retrieves templates from [`aws-serverless/references/lambda.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/aws-serverless/references/lambda.md) and returns a ready-to-deploy SAM template along with a minimal handler file. ### Optimizing Costs with the Billing Skill Query cost recommendations using the **AWS Billing and Cost Management** skill: ```bash skill aws-billing-and-cost-management recommend-savings \ --service ec2 \ --region us-east-1 ``` This invocation reads [`references/service-optimization.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/references/service-optimization.md) and returns a comparison table of Savings Plans versus Reserved Instances. ### Working with AWS SDKs Generate boto3 code with proper pagination and error handling: ```bash skill aws-sdk-python-usage list-s3-objects \ --bucket my-data-bucket \ --prefix logs/ ``` The skill generates Python code based on [`references/s3.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/references/s3.md), ensuring correct pagination patterns and exception handling. ### Configuring Amazon Bedrock Provision Bedrock models with the necessary IAM policies: ```bash skill amazon-bedrock create-model \ --model-id anthropic.claude-v2 \ --instance-type ml.g5.xlarge ``` The skill produces the IAM policy, runtime configuration, and sample invocation scripts from [`references/sdk-converse-api-python.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/references/sdk-converse-api-python.md). ## Security Controls and Secret Handling The `aws-core` plugin implements safety guardrails through [`plugins/aws-core/hooks/secret-safety.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/hooks/secret-safety.py). This hook automatically redacts AWS credentials and sensitive tokens before they are transmitted back to the agent, ensuring that authentication materials never leak into chat logs or model contexts. ## Summary - The **AWS Agent Toolkit** delivers **15 core skills** via the `aws-core` plugin, each defined in `plugins/aws-core/skills//SKILL.md`. - Skills cover **authentication, serverless, containers, infrastructure as code, observability, cost optimization, and SDK usage** across Python, JavaScript, and Swift. - Each skill packages **reference documentation** (`references/`) and **reusable assets** (`assets/`) for comprehensive guidance. - Security is enforced through **pre-transmission hooks** like [`secret-safety.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/secret-safety.py) that prevent credential leakage. - Agents invoke skills through natural language commands, receiving vetted code templates and deployment configurations. ## Frequently Asked Questions ### How do I install the aws-core plugin in my coding agent? Install the plugin by adding the repository to your agent's marketplace with `npx skills add aws/agent-toolkit-for-aws/skills`, then run `/plugin install aws-core@claude-plugins-official`. The plugin manifest at [`plugins/aws-core/.cursor-plugin/plugin.json`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/.cursor-plugin/plugin.json) handles the rest of the configuration. ### What file format defines a core skill? Each core skill is defined by a [`SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/SKILL.md) file located in its respective directory under `plugins/aws-core/skills/`. This markdown file contains the skill description, procedural instructions, and references to supporting documentation in the `references/` subdirectory. ### How do core skills handle AWS authentication? The **Signing‑in to AWS** skill manages credential configuration and MCP server sessions. Additionally, the [`hooks/secret-safety.py`](https://github.com/aws/agent-toolkit-for-aws/blob/main/hooks/secret-safety.py) script automatically redacts sensitive credentials before they are returned to the agent, preventing accidental exposure of access keys or tokens. ### Can I use core skills with any AI coding agent? Yes, the `aws-core` plugin is designed for compatibility with multiple agents including Claude Code, Codex, Cursor, and Kiro. The MCP server configuration in [`plugins/aws-core/.mcp.json`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/.mcp.json) standardizes the interface, allowing any MCP-compliant client to load and invoke the skills.