23 skills · 8 categories
Claude Code skills for AWS
AWS skills for Lambda, DynamoDB single-table design, S3, IAM least privilege, cost audits and CI that deploys with OIDC instead of long-lived keys. Multi-cloud skills that include AWS are listed too.
Start with these
- 1
AWS IAM Least Privilege
Exact permissions, and AccessDenied solved by evidence
Claude maps each API call to the exact IAM actions, ARNs and condition keys it needs instead of reaching for wildcards. AccessDenied errors are traced through caller identity, CloudTrail, decoded messages and the evaluation order to the policy type that denied. Policies are validated with Access Analyzer and a bundled stdlib linter that flags PassRole, escalation paths and open OIDC trusts.
- 2
AWS CDK
CDK diffs you can trust before you hit deploy
Claude structures CDK apps into explicit-environment stateful and stateless stacks, uses L2 grant methods instead of hand-written policies, and reads every cdk diff for replacements before deploy. It keeps logical IDs stable through refactors, untangles cross-stack export deadlocks, and adds assertion tests and cdk-nag so encryption and retention regressions fail CI.
- 3
AWS CloudFront
Private origins, small cache keys, high hit ratios
Claude puts S3 behind Origin Access Control with the bucket fully private, splits traffic into per-path behaviors, and keeps cache keys limited to what changes the response while forwarding the rest through origin request policies. Assets get long immutable TTLs, HTML stays fresh, edge logic starts with CloudFront Functions, and every change is verified with x-cache headers and hit-ratio metrics.
All 23 AWS skills
Grouped by category. Each card opens the full playbook, example prompts and install commands.
DevOps & SRE 3
Chaos Engineering
Break one thing on purpose, with an abort button
Claude plans fault injection the way a reliability team does: a written hypothesis against a user-facing SLI, a blast radius of one pod or one dependency, abort conditions, and a verified rollback before anything runs. It picks the right tool for the target, confirms the fault actually applied, and closes every experiment with a result, evidence and follow-up tickets.
GitHub Actions
Faster CI, read-only tokens, zero stored cloud keys
Claude rewrites workflows so irrelevant changes skip CI, superseded runs cancel, and package and Docker caches make the warm path fast. Tokens default to read-only, deploys use OIDC with subject-restricted trust policies and protected environments, and untrusted PR text never reaches a shell. Results are linted with actionlint and zizmor and reported with before-and-after timings.
Blue-Green and Canary Deploys
Ship gradually, roll back in one command
Claude first checks that both versions can run side by side, covering additive migrations, tolerant consumers and cron jobs that would run twice, then picks blue/green, canary or a flagged launch based on traffic. It wires per-version metric gates, shifts traffic in steps with bake time, and writes a rollback plan with triggers, commands and data caveats.
Cloud Platforms 11
AWS IAM Least Privilege
Exact permissions, and AccessDenied solved by evidence
Claude maps each API call to the exact IAM actions, ARNs and condition keys it needs instead of reaching for wildcards. AccessDenied errors are traced through caller identity, CloudTrail, decoded messages and the evaluation order to the policy type that denied. Policies are validated with Access Analyzer and a bundled stdlib linter that flags PassRole, escalation paths and open OIDC trusts.
AWS CDK
CDK diffs you can trust before you hit deploy
Claude structures CDK apps into explicit-environment stateful and stateless stacks, uses L2 grant methods instead of hand-written policies, and reads every cdk diff for replacements before deploy. It keeps logical IDs stable through refactors, untangles cross-stack export deadlocks, and adds assertion tests and cdk-nag so encryption and retention regressions fail CI.
AWS CloudFront
Private origins, small cache keys, high hit ratios
Claude puts S3 behind Origin Access Control with the bucket fully private, splits traffic into per-path behaviors, and keeps cache keys limited to what changes the response while forwarding the rest through origin request policies. Assets get long immutable TTLs, HTML stays fresh, edge logic starts with CloudFront Functions, and every change is verified with x-cache headers and hit-ratio metrics.
AWS ECS on Fargate
Containers that deploy, drain and roll back cleanly
Claude writes task definitions with valid Fargate sizes, separate execution and task roles, secrets pulled by reference and logs that cannot block the app. Services run in private subnets with the endpoints they need, deploy with a circuit breaker or native blue/green and canary strategies, drain on SIGTERM, and scale on request count or queue backlog instead of guesses.
AWS Lambda
Fast cold starts, safe retries, no silent drops
Claude writes Lambda handlers that create clients once at init, stay well inside timeouts, and return partial batch failures so one bad SQS message does not replay the rest. It measures Init Duration before tuning, chooses between bundling, arm64, SnapStart and provisioned concurrency, and makes sure every async trigger has a failure destination and alarms.
AWS Messaging
Queues, topics and buses that survive duplicates
Claude picks between SQS, SNS fan-out, EventBridge rules, Pipes and Scheduler based on ordering, routing and consumer count, then configures visibility timeouts, long polling and DLQs with alarms. Consumers are written idempotently with partial batch failure reporting, and the poison message, duplicate and redrive paths are tested before anything ships.
AWS RDS and Aurora
Right engine, tested failover, no surprise I/O bill
Guides Claude through running PostgreSQL and MySQL on AWS from measured load: choosing RDS, Aurora, or Serverless v2, sizing for the working set, testing failover, and keeping settings in custom parameter groups. It plans major upgrades as blue/green deployments with the logical-replication and PITR caveats, reduces RDS Proxy pinning, and runs a script that compares Aurora Standard and I/O-Optimized from your bill.
S3 and R2 Object Storage
Private buckets, presigned uploads, no surprise bills
Claude keeps buckets private with Block Public Access and ACLs disabled, then serves files through short-lived presigned URLs or CloudFront with origin access control. Uploads go straight from the browser with server-chosen keys and enforced size limits, large files use multipart with exposed ETags, and lifecycle rules abort stale uploads and expire old versions on S3 or R2.
Cloud Cost Audit
Find the money, prove it, cut it with sign-off
Claude breaks the bill down by service, usage type and tag, explains the handful of items that make up most of the spend, and hunts idle disks, unused IPs, log groups without retention and NAT traffic that a gateway endpoint would remove. It rightsizes before recommending commitments, never deletes without approval, and delivers a savings report with evidence for every number.
Google Cloud Run
Containers tuned for concurrency, cost and calm rollouts
Claude prepares containers that honor the Cloud Run contract, then picks concurrency, CPU allocation and instance limits from how the app actually behaves instead of defaults. Services run as dedicated service accounts with Secret Manager secrets, new revisions deploy with no traffic behind a tag, and traffic shifts in steps with an exact rollback command ready.
Google BigQuery
Scan less, pay less, know who spent what
Claude starts a BigQuery task by finding the real cost drivers in INFORMATION_SCHEMA, then fixes table design with partitioning, clustering and required partition filters, rewrites the worst queries and proves the savings with dry runs. It adds byte caps and daily quotas, compares on-demand with editions using measured slot-hours, and grants access through datasets, authorized views and row policies.
Databases 3
DynamoDB Modeling
Keys designed from queries, not from entity diagrams
Claude refuses to write a key until an access-pattern inventory with rates exists, then maps each pattern to one GetItem, Query, or transaction. It co-locates entities read together, adds sparse or multi-attribute GSIs only where the base table falls short, enforces uniqueness with guard items and condition expressions, and shards keys that would exceed per-partition throughput.
Connection Pooling
Pools sized to database cores, not request counts
Claude writes down every process that connects and sums its maximum connections against the database limit at full autoscale before touching a setting. Pools are sized from database parallelism, PgBouncer transaction mode is configured with its session-state caveats and prepared statement support, serverless platforms get a proxy, and exhaustion is diagnosed from pg_stat_activity and SHOW POOLS.
DuckDB Analytics
SQL over Parquet and CSV files, no warehouse needed
Claude queries data files directly with DuckDB instead of loading them into pandas first. It inspects schemas with DESCRIBE and SUMMARIZE, pins types that auto-detection gets wrong such as zip codes and day-first dates, writes analysis with GROUP BY ALL, QUALIFY and ASOF JOIN, sets memory limits so big jobs spill to disk, and checks row counts and totals against the source.
Security 2
Cloud Security Posture
Find the public bucket before someone else does
Claude audits cloud accounts with read-only roles across every region: it confirms logging baselines, runs Prowler against a CIS framework, adds targeted CLI checks for public data, open admin ports and risky identities, then collapses findings into root causes. Fixes go into Terraform or CDK after usage evidence and confirmation, each paired with an SCP or org policy guardrail.
Secure File Uploads
Uploads that can't execute, escape, or exhaust you
Claude designs uploads from a per-type policy: size limits at proxy, app and storage, content-based type detection, generated storage keys, and private buckets. Images are re-encoded to strip EXIF and polyglots, archives are checked for zip slip and bombs, shared files pass through a quarantine bucket and ClamAV, and everything is served from a separate domain with attachment and nosniff headers.
Install
Every AWS skill in one command
Installs into ~/.claude/skills/. Add --project after -- to install into the current repository.
curl -fsSL https://claudeskills.page/install.sh | sh -s -- aws-iam aws-cdk aws-cloudfront aws-ecs-fargate aws-lambda aws-messaging aws-rds-aurora dynamodb-modeling s3-object-storage chaos-engineering cloud-cost-audit cloud-security-posture secure-file-uploads data-partitioning github-actions bun-runtime blue-green-deploys cloud-run gcp-bigquery connection-pooling duckdb-analytics lakehouse-iceberg esp32-firmware AWS skills FAQ
What is the best Claude Code skill for AWS?
Start with AWS IAM Least Privilege: Exact permissions, and AccessDenied solved by evidence. Then add AWS CDK and AWS CloudFront, which cover the next most common AWS requests.
How do I install all 23 AWS skills at once?
Pass every name to the installer in one command: curl -fsSL https://claudeskills.page/install.sh | sh -s -- aws-iam aws-cdk aws-cloudfront aws-ecs-fargate aws-lambda aws-messaging aws-rds-aurora dynamodb-modeling s3-object-storage chaos-engineering cloud-cost-audit cloud-security-posture secure-file-uploads data-partitioning github-actions bun-runtime blue-green-deploys cloud-run gcp-bigquery connection-pooling duckdb-analytics lakehouse-iceberg esp32-firmware. Add --project to install them into the current repository's .claude/skills/ folder so your team gets them too.
Do these AWS skills work outside Claude Code?
Yes. Each skill uses only the portable Agent Skills frontmatter, so the same folder works on claude.ai, through the Claude API and in the Agent SDK. Skills that run bundled scripts need an environment with code execution.