aws-skills MCP — 使用场景, 安装 & 实时演示

为什么要用

核心特性

Shell-first — commands visible before execution
Common services: EC2, S3, IAM, Lambda, CloudFormation, Cost Explorer
Least-privilege IAM defaults
Region and profile aware
Works with Claude Code and Codex

实时演示

实际使用效果

aws-skill.replay ▶ 就绪

0/0

安装

选择你的客户端

~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "aws-skill": {
      "command": "git",
      "args": [
        "clone",
        "https://github.com/zxkane/aws-skills",
        "~/.claude/skills/aws-skills"
      ],
      "_inferred": true
    }
  }
}

打开 Claude Desktop → Settings → Developer → Edit Config。保存后重启应用。

~/.cursor/mcp.json · .cursor/mcp.json

{
  "mcpServers": {
    "aws-skill": {
      "command": "git",
      "args": [
        "clone",
        "https://github.com/zxkane/aws-skills",
        "~/.claude/skills/aws-skills"
      ],
      "_inferred": true
    }
  }
}

Cursor 使用与 Claude Desktop 相同的 mcpServers 格式。项目级配置优先于全局。

VS Code → Cline → MCP Servers → Edit

{
  "mcpServers": {
    "aws-skill": {
      "command": "git",
      "args": [
        "clone",
        "https://github.com/zxkane/aws-skills",
        "~/.claude/skills/aws-skills"
      ],
      "_inferred": true
    }
  }
}

点击 Cline 侧栏中的 MCP Servers 图标，然后选 "Edit Configuration"。

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "aws-skill": {
      "command": "git",
      "args": [
        "clone",
        "https://github.com/zxkane/aws-skills",
        "~/.claude/skills/aws-skills"
      ],
      "_inferred": true
    }
  }
}

格式与 Claude Desktop 相同。重启 Windsurf 生效。

~/.continue/config.json

{
  "mcpServers": [
    {
      "name": "aws-skill",
      "command": "git",
      "args": [
        "clone",
        "https://github.com/zxkane/aws-skills",
        "~/.claude/skills/aws-skills"
      ]
    }
  ]
}

Continue 使用服务器对象数组，而非映射。

~/.config/zed/settings.json

{
  "context_servers": {
    "aws-skill": {
      "command": {
        "path": "git",
        "args": [
          "clone",
          "https://github.com/zxkane/aws-skills",
          "~/.claude/skills/aws-skills"
        ]
      }
    }
  }
}

加入 context_servers。Zed 保存后热重载。

claude mcp add aws-skill -- git clone https://github.com/zxkane/aws-skills ~/.claude/skills/aws-skills

一行命令搞定。用 claude mcp list 验证，claude mcp remove 卸载。

使用场景

实战用法： aws-skills

How to run a fleet-wide operation on EC2 safely

👤 Cloud ops engineers running one-off fleet operations ⏱ ~20 min intermediate

何时使用： You need to patch or restart a group of instances matching a tag, without writing the whole script yourself.

前置条件

Skill installed — git clone https://github.com/zxkane/aws-skills ~/.claude/skills/aws-skills
aws CLI configured — aws configure or SSO profile

步骤

Dry-run the query

Use aws-skill. List EC2 instances tagged Env=staging, App=api. Just describe, don't mutate.✓ 已复制

→ Table of instance IDs with state
Plan the action

Now propose the command to restart all running ones. Show me the exact aws cli call before running it.✓ 已复制

→ Command printed; no execution yet
Execute with guardrails

Execute in batches of 3 with 30s between batches. Abort if any fails.✓ 已复制

→ Batched output with success/failure per batch

结果： A controlled fleet operation with no unpleasant surprises.

注意事项

Wrong profile/region destroys prod — Always echo the resolved profile + region as the first line of any action

Audit S3 bucket policies for public exposure

👤 Security engineers looking for public S3 risk ⏱ ~30 min intermediate

何时使用： Before a compliance review, or after a misconfig alert.

步骤

List buckets

List all S3 buckets in our account with their public access block settings and any bucket policies that allow *.✓ 已复制

→ Table with per-bucket status
Triage

Flag buckets that have public access and don't match our known public-bucket allowlist (list: [...]). Propose remediation for each.✓ 已复制

→ Remediation plan per flagged bucket

结果： A prioritized remediation list for S3 public exposure.

注意事项

OAI / OAC for CloudFront looks public at the bucket level — Check CloudFront origin config before flagging

Scope an IAM policy to least privilege

👤 Engineers with an overly-broad policy to tighten ⏱ ~45 min advanced

何时使用： A service account works with AdministratorAccess and you want to scope it down.

步骤

Collect usage

Pull the Access Analyzer / CloudTrail-derived actions used by this role over last 30 days.✓ 已复制

→ Actions table
Generate scoped policy

Write the minimal policy matching those actions. No wildcard Resource unless necessary; comment where wildcards are justified.✓ 已复制

→ Policy JSON with comments

结果： A least-privilege policy with documented rationale.

注意事项

30 days isn't long enough to capture all paths — Verify against known monthly or quarterly jobs before flipping the policy

搭配使用： claude-code-owasp-skill

Answer a cost question quickly

👤 Engineers and finance owners chasing spend ⏱ ~20 min intermediate

何时使用： Finance asks 'why did S3 spend spike in April?' — you want an answer before the meeting.

步骤

Query

Use Cost Explorer to compare S3 spend April vs March by usage type.✓ 已复制

→ Diff table by usage type
Explain

Which usage type grew most, and which bucket is most likely responsible?✓ 已复制

→ Hypothesis with specific bucket candidates

结果： A specific attribution you can follow up on.

组合

与其他 MCP 搭配，撬动十倍杠杆

aws-skill + terrashark-skill

AWS-skill for one-off ops, TerraShark for codified infra

Investigate with aws-skill, then codify the fix as Terraform with terrashark.✓ 已复制

aws-skill + claude-code-owasp-skill

Security reviews on IAM and S3 configs

After IAM scoping, run OWASP review on the resulting policy.✓ 已复制

工具

此 MCP 暴露的能力

工具	输入参数	何时调用	成本
EC2 fleet ops	-	Tag-scoped fleet ops	1+ AWS API calls
S3 policy audit	-	Security review	1+ API calls
IAM scoping	role_name	Tightening access	Access Analyzer + CloudTrail calls
Cost queries	service, range	Spend investigations	Cost Explorer calls
CFN/CDK scaffolding	-	New stacks	Claude tokens

成本与限制

运行它的成本

API 配额: AWS API limits vary per service; usually non-issue for interactive use
每次调用 Token 数: 5-15k for planning; execution is free of Claude tokens
费用: Free skill; AWS usage billed as normal
提示: Cost Explorer API has per-request pricing. Cache results when iterating.

安全

权限、密钥、影响范围

凭据存储： Standard AWS CLI credentials (shared config, SSO). Skill reads active profile.

数据出站： All AWS API calls. Command outputs may contain sensitive data (ARNs, tags).

切勿授予： AdministratorAccess for interactive use

Always verify active profile and region before destructive commands. Skill prints both before execution — don't skip the check.
Use SSO short-lived credentials rather than long-lived access keys.

故障排查

常见错误与修复

AccessDenied despite correct profile

Role session may have expired. Re-authenticate (aws sso login or STS refresh)

验证： aws sts get-caller-identity

Commands hit the wrong region

Skill respects AWS_REGION env; set explicitly or pass --region each call

Rate-limiting on large fleet ops

Use the skill's batch mode with delays

替代方案

aws-skills 对比其他方案

替代方案	何时用它替代	权衡
AWS MCP server	You want native MCP tool calls instead of shell-first	Less shell visibility; different trust model

aws-skills

为什么要用

核心特性

实时演示

实际使用效果

安装

选择你的客户端

使用场景

实战用法： aws-skills

How to run a fleet-wide operation on EC2 safely

前置条件

步骤

注意事项

Audit S3 bucket policies for public exposure

步骤

注意事项

Scope an IAM policy to least privilege

步骤

注意事项

Answer a cost question quickly

步骤

组合

与其他 MCP 搭配，撬动十倍杠杆

工具

此 MCP 暴露的能力

成本与限制

运行它的成本

安全

权限、密钥、影响范围

故障排查

常见错误与修复

替代方案

aws-skills 对比其他方案

更多

资源