DevOps skills

Investigate AWS incidents with AWS DevOps Agent using service details, recent code changes, and error logs. Provides progress updates during the investigation, then summarizes findings and recommended fixes, with proposed infrastructure changes presented for review.

• Investigate 503 errors or a service outage
• Trace latency spikes or out-of-memory failures
• Examine deployment failures alongside recent commits

Create API Gateway stages for development, testing, and production REST APIs. Configure CloudWatch logging, X-Ray tracing, request throttling, WAF protection, and IAM roles, with troubleshooting guidance for missing logs, failed stage creation, and blocked requests.

• Create separate API stages for development, testing, and production
• Configure logs and request tracing
• Set request limits and WAF integration

Guide AWS Terraform authoring and check generated files for security policy violations. The read-only checker reports issues with file locations and repair hints in JSON, covering encryption, public exposure, load balancer TLS, and overly broad permissions.

• Check generated AWS Terraform for security policy violations
• Review database encryption and public exposure
• Find overly broad IAM permissions

Diagnose Amazon EFS mount failures, access errors, and slow file access. Check network connectivity, permissions, throughput, encryption, and DNS settings to identify likely causes and guide the corresponding configuration fixes.

• Investigating EFS mount failures and timeouts
• Separating IAM access errors from file permission problems
• Checking slow throughput and depleted burst credits

Set up or diagnose the AWS DevOps Agent connection in Claude applications through MCP, a protocol for connecting agent tools. Check credentials, choose Bearer token or SigV4 authentication, verify connectivity, and write the connection configuration.

• Connect Claude to AWS DevOps Agent for the first time
• Diagnose connection failures or missing tools
• Choose between Bearer token and SigV4 authentication

Plan an AWS resilience program from recovery objectives to operational controls. Connect Resilience Hub v2 assessments with Fault Injection Service experiments and Application Recovery Controller, validating that fixes meet recovery targets before findings are marked resolved.

• Plan an end-to-end AWS resilience program
• Turn assessment findings into failure experiments
• Validate recovery before closing findings

Create and manage credentials in AWS Secrets Manager with dedicated encryption keys, automatic credential rotation, narrowly scoped access permissions, audit logging, and lifecycle management. Covers database credentials, API keys, OAuth tokens, and custom secrets.

• Store database credentials and API keys
• Configure automatic credential rotation
• Review encryption and access permissions

Set up CloudWatch alarm notifications through Amazon SNS for email, SMS, or webhook destinations. The skill covers encrypted topics, access policies, alarm connections, and checks for common problems when notifications fail to arrive.

• Sending CloudWatch alarms by email
• Adding SMS or webhook notification destinations
• Configuring SNS encryption and access policies

Configure AWS Transit Gateway as a central router for multiple VPCs, isolated cloud networks, and on-premises networks. Set up traffic separation, shared internet access, firewall inspection, connections between Regions, and migration from existing VPC peering connections.

• Connect multiple VPCs through a central hub
• Separate development and production traffic
• Centralize internet access and firewall inspection

Understand and design cross-Region recovery with Amazon Application Recovery Controller (ARC) Region switch. Get guidance on recovery plans, execution workflows, triggers, cross-account permissions, recovery timing, and troubleshooting for applications already deployed across Regions.

• Designing recovery plans across AWS Regions
• Comparing active/active and active/passive recovery
• Investigating cross-account execution failures

Build an AWS VPC, an isolated cloud network, across multiple Availability Zones. Configure public and private subnets, address ranges, internet and NAT gateways, routing, and security groups to support a production network layout.

• Building a production network across multiple Availability Zones
• Separating public and private subnets
• Planning subnet address ranges automatically

Set up Network Flow Monitor agents on EC2 to track network latency and packet loss. Configure publishing permissions, verify agent operation, and troubleshoot missing metrics, HTTP 403 errors, or connectivity failures.

• Installing Network Flow Monitor agents on EC2
• Configuring IAM permissions for publishing metrics
• Investigating missing metrics and HTTP 403 errors

Run AWS Resilience Hub v2 assessments to understand how a service could fail. Interpret findings, prioritize fixes by severity and whether resilience targets are achievable, and correct AI generated descriptions of service functions.

• Run a failure mode assessment
• Prioritize assessment findings
• Investigate how to resolve a specific finding

Plan and manage Amazon RDS databases running MySQL, MariaDB, or PostgreSQL. Get production instance setup, upgrade checks, commitment pricing comparisons, connection management advice, and deployment plans that reduce downtime.

• Create an RDS database for production
• Check upgrade paths and prerequisites
• Compare Reserved Instances and Database Savings Plans

Build custom machine images for EC2 and container images with EC2 Image Builder. Set up scheduled rebuilds for operating system updates, configure image distribution, and investigate failed builds using logs and platform-specific guidance.

• Build a custom AMI for a specific environment
• Schedule image rebuilds to include OS updates
• Distribute images across AWS Regions

Configure AWS Shield Advanced to protect public resources from DDoS attacks, which overwhelm services with traffic. Covers automatic mitigation, health-based detection, expert response support, event review, and requests for credits covering eligible attack-related scaling charges.

• Adding DDoS protection to public AWS resources
• Configuring automatic mitigation for application traffic attacks
• Setting up expert support during an attack

Helps configure Amazon CloudFront content delivery, including distributions, caching, pricing choices, and custom-domain certificates. Guides protection of the origin, the server supplying content, viewer access restrictions, multi-tenant setups, and traffic analysis through standard or real-time logs.

• Setting up CloudFront delivery, caching, and pricing
• Configuring HTTPS certificates for a custom domain
• Protecting origins and restricting viewer access

Connect two AWS VPCs, private cloud networks, through VPC peering. Check address overlap, update routing and DNS settings, and review security group requirements for connections within or across regions and accounts.

• Connect two VPCs over a private network
• Set up peering across AWS regions or accounts
• Investigate pending connections or failed route creation

Connect an AI agent to remote Windows applications on Amazon WorkSpaces Applications through MCP, a protocol for agent tools. Get guidance on connection setup, mouse and keyboard actions, session cleanup, and troubleshooting connection failures.

• Connect an AI agent to a remote Windows application
• Plan screenshot, mouse, and keyboard automation
• Investigate desktop connection failures

Connect applications to Amazon RDS for SQL Server with guidance on drivers, encrypted connections, authentication, and networking. Diagnose connection timeouts, login failures, and Windows authentication problems across supported languages and AWS deployment environments.

• Investigating SSMS connection timeouts from EC2
• Connecting Lambda to SQL Server with pymssql
• Diagnosing Windows authentication failures

Create an Amazon Aurora MySQL or PostgreSQL environment by building the cluster, adding a database instance, and managing passwords through AWS Secrets Manager. Includes status monitoring and retries to follow the setup through to a queryable database.

• Create a new Aurora MySQL environment
• Create a new Aurora PostgreSQL environment
• Configure database password management with AWS Secrets Manager

Configure AWS Application Recovery Controller routing controls and safety rules for switching traffic between Regions. Set up manual or automatic traffic shifts away from an impaired Availability Zone, a separate infrastructure area within a Region.

• Set up traffic failover between AWS Regions
• Add safety rules to traffic switching
• Move traffic away from an impaired Availability Zone

Enable outbound internet access for AWS Lambda functions inside a VPC, a private cloud network. Set up a NAT Gateway, configure subnet routes and security rules, and troubleshoot connection failures or timeouts.

• Enabling internet access for a Lambda function in a VPC
• Setting up a NAT Gateway and subnet routes
• Investigating Lambda timeouts during external connections

Configure and extend AWS Direct Connect links between data centers and AWS. The skill guides connection selection, access to multiple virtual private clouds, traffic encryption, resilient failover, and migration to a transit gateway.

• Choose a connection model between a data center and AWS
• Connect multiple VPCs across accounts or Regions
• Add encryption and improve failure recovery