● 社区
zxkane
⚡ 即开即用
aws-skills
作者 zxkane · zxkane/aws-skills
Claude agent skills for AWS — shell-first workflows covering common services, with sensible defaults and least-privilege IAM.
aws-skills wraps common AWS CLI workflows as agent skills: EC2 fleet ops, S3 policy checks, IAM audits, CloudFormation/CDK scaffolding, and cost queries. Shell-first so you always see the commands being run. Pairs well with TerraShark for IaC.
为什么要用
核心特性
- Shell-first — commands visible before execution
- Common services: EC2, S3, IAM, Lambda, CloudFormation, Cost Explorer
- Least-privilege IAM defaults
- Region and profile aware
- Works with Claude Code and Codex
使用场景
实战用法： aws-skills
何时使用： You need to patch or restart a group of instances matching a tag, without writing the whole script yourself.
步骤
-
Dry-run the query
Use aws-skill. List EC2 instances tagged Env=staging, App=api. Just describe, don't mutate.✓ 已复制
→ Table of instance IDs with state
-
Plan the action
Now propose the command to restart all running ones. Show me the exact aws cli call before running it.✓ 已复制
→ Command printed; no execution yet
-
Execute with guardrails
Execute in batches of 3 with 30s between batches. Abort if any fails.✓ 已复制
→ Batched output with success/failure per batch
结果： A controlled fleet operation with no unpleasant surprises.
注意事项
- Wrong profile/region destroys prod — Always echo the resolved profile + region as the first line of any action
何时使用： Before a compliance review, or after a misconfig alert.
步骤
-
List buckets
List all S3 buckets in our account with their public access block settings and any bucket policies that allow *.✓ 已复制
→ Table with per-bucket status
-
Triage
Flag buckets that have public access and don't match our known public-bucket allowlist (list: [...]). Propose remediation for each.✓ 已复制
→ Remediation plan per flagged bucket
结果： A prioritized remediation list for S3 public exposure.
注意事项
- OAI / OAC for CloudFront looks public at the bucket level — Check CloudFront origin config before flagging
何时使用： A service account works with AdministratorAccess and you want to scope it down.
步骤
-
Collect usage
Pull the Access Analyzer / CloudTrail-derived actions used by this role over last 30 days.✓ 已复制
→ Actions table
-
Generate scoped policy
Write the minimal policy matching those actions. No wildcard Resource unless necessary; comment where wildcards are justified.✓ 已复制
→ Policy JSON with comments
结果： A least-privilege policy with documented rationale.
注意事项
- 30 days isn't long enough to capture all paths — Verify against known monthly or quarterly jobs before flipping the policy
何时使用： Finance asks 'why did S3 spend spike in April?' — you want an answer before the meeting.
步骤
-
Query
Use Cost Explorer to compare S3 spend April vs March by usage type.✓ 已复制
→ Diff table by usage type
-
Explain
Which usage type grew most, and which bucket is most likely responsible?✓ 已复制
→ Hypothesis with specific bucket candidates
结果： A specific attribution you can follow up on.
组合
与其他 MCP 搭配，撬动十倍杠杆
AWS-skill for one-off ops, TerraShark for codified infra
Investigate with aws-skill, then codify the fix as Terraform with terrashark.✓ 已复制
Security reviews on IAM and S3 configs
After IAM scoping, run OWASP review on the resulting policy.✓ 已复制
成本与限制
运行它的成本
- API 配额
- AWS API limits vary per service; usually non-issue for interactive use
- 每次调用 Token 数
- 5-15k for planning; execution is free of Claude tokens
- 费用
- Free skill; AWS usage billed as normal
- 提示
- Cost Explorer API has per-request pricing. Cache results when iterating.
安全
权限、密钥、影响范围
凭据存储： Standard AWS CLI credentials (shared config, SSO). Skill reads active profile.
数据出站： All AWS API calls. Command outputs may contain sensitive data (ARNs, tags).
切勿授予： AdministratorAccess for interactive use
- Always verify active profile and region before destructive commands. Skill prints both before execution — don't skip the check.
- Use SSO short-lived credentials rather than long-lived access keys.
故障排查
常见错误与修复
AccessDenied despite correct profile
Role session may have expired. Re-authenticate (aws sso login or STS refresh)
验证： aws sts get-caller-identity
Commands hit the wrong region
Skill respects AWS_REGION env; set explicitly or pass --region each call
Rate-limiting on large fleet ops
Use the skill's batch mode with delays
替代方案
aws-skills 对比其他方案
| 替代方案 | 何时用它替代 | 权衡 |
|---|
| AWS MCP server | You want native MCP tool calls instead of shell-first | Less shell visibility; different trust model |