Official agent skill

AWS Compute

by aws in aws/agent-toolkit-for-aws

Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU, instance store vs EBS), launch templates, Auto Scaling…

OfficialApache-2.0Auto-check passedDevOps & Cloud

Install AWS Compute

skills CLI
$ npx skills add aws/agent-toolkit-for-aws --skill aws-compute -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install aws/agent-toolkit-for-aws aws-compute --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/core-skills/aws-compute .claude/skills/aws-compute && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
aws-compute
GitHub stars
2.8k
Token cost
~2.2k tokens
SKILL.md length
886 words
Files
7 (incl. references)
Skills in repo
138
Repo updated
First seen
Licence
Apache-2.0

At a glance

Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU, instance store vs EBS), launch templates, Auto Scaling…

  • Tasks that involve Cloud security
  • SKILL.md covers Critical Warnings, Which do you need?, Quick Navigation and Common Workflows, plus 3 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

AWS Compute is an agent skill from aws/agent-toolkit-for-aws, published by the product's own GitHub organization. Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU, instance store vs EBS), launch templates, Auto Scaling groups (scaling policies, instance refresh, mixed instances, Spot, warm pools, lifecycle hooks), IMDSv2, placement groups, Elastic IPs, AMI lifecycle, and Systems Manager fleet operations (Session Manager, Run Command, Patch Manager). Applies to EC2 instance and fleet questions, InsufficientInstanceCapacity…

Its SKILL.md is about 2.2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 7 other files, including reference files (for example `references/ami-management.md`, `references/auto-scaling.md` and `references/instance-selection.md`).

It sits in DevOps & Cloud, covering Cloud security. It works with Amazon Web Services. The repository describes itself as: Official, AWS-supported MCP servers, skills, and plugins to help AI agents build on AWS. The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Cloud security

Example prompts

  • “/aws-compute”

What it can do on your machine

Read from SKILL.md and the folder at commit bd49cc8. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • docs.aws.amazon.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

AWS Compute loads about 2.2k tokens when it runs, and up to ~13k if it reads all its reference files. Until then it costs about 256 tokens; SKILL.md has 886 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~256
When it runs · the whole SKILL.md, loaded when a task matches
~2.2k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~13k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from aws/agent-toolkit-for-aws at commit bd49cc8, republished under its Apache-2.0 licence (© aws). 886 words, ~2,220 tokens.

Download SKILL.mdSave it as .claude/skills/aws-compute/SKILL.md (or your agent's skills folder). This skill also uses 6 other files; get the full folder from GitHub.
name
aws-compute
description
Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU, instance store vs EBS), launch templates, Auto Scaling groups (scaling policies, instance refresh, mixed instances, Spot, warm pools, lifecycle hooks), IMDSv2, placement groups, Elastic IPs, AMI lifecycle, and Systems Manager fleet operations (Session Manager, Run Command, Patch Manager). Applies to EC2 instance and fleet questions, InsufficientInstanceCapacity, CPU-credit/surplus charges, IMDSv2 401s, instances stuck in Pending:Wait, ASG not replacing unhealthy instances, status-check failures, SSH refused/timed out, or instances missing as SSM managed nodes. For a single secure instance launch, the launching-ec2-instance-with-best-practices skill is more appropriate; for instance profiles, see setting-up-ec2-instance-profiles; for Image Builder, see amazon-ec2-image-builder. Does NOT cover Lambda, ECS/Fargate, EKS, VPC/ALB/NLB design, or IAM policy authoring.
metadata.version
2

Amazon EC2 Compute

Best experience with the AWS MCP server; also works with the AWS CLI alone — no hard dependency on either.

Critical Warnings

Launch configurations are deprecated and do not support current EC2 instance types; new accounts cannot create them. Use launch templates for every new Auto Scaling group. See auto-scaling.md.

ASGs ignore ELB health checks by default: An Auto Scaling group only uses EC2 status checks unless you set --health-check-type ELB. Without it, instances failing the load balancer's health check stay in service forever. See auto-scaling.md.

IMDSv2 hop limit breaks containers: the default HttpPutResponseHopLimit of 1 makes the IMDSv2 token PUT response fail to reach a containerized process (the extra hop exceeds the response TTL), so the token request times out. Set HttpPutResponseHopLimit=2 for bridge/awsvpc container workloads. (If IMDSv2 is required, a subsequent tokenless GET returns 401; if optional, it silently falls back to IMDSv1.) See provisioning.md.

T3/T3a/T4g default to unlimited mode: Unlike T2 (standard), these burst without throttling but bill surplus CPU credits when 24h-average CPU exceeds baseline — a silent cost leak. See instance-selection.md.

Instance store is ephemeral: Data on instance store volumes is lost on stop, hibernate, terminate, instance-type change, and host failure — it survives only a reboot. Put anything durable on EBS/EFS/S3. See instance-selection.md.

Which do you need?

If you're deciding...Guidance
Instance family / size / Graviton / GPU / burstableinstance-selection.md — start with the workload→family table
How to define instances once and reuse (launch template)provisioning.md
How to run many instances that scale automaticallyauto-scaling.md
How to access/patch/manage instances without SSH keyssystems-manager.md

Quick Navigation

You want to...Go to
Pick an instance type, Graviton vs x86, burstable credits, GPU, instance store vs EBSinstance-selection.md
Create a launch template, user data, key pairs, IMDSv2, placement groups, Elastic IPsprovisioning.md
Set up or fix an Auto Scaling group, scaling policies, instance refresh, Spot, lifecycle hooksauto-scaling.md
Get SSH-less access, patch a fleet, or fix an instance not showing as a managed nodesystems-manager.md
Create, share, or retire (deprecate/disable/deregister) an AMIami-management.md
Fix something broken (can't connect, status-check fail, capacity error, stuck instances)troubleshooting.md

Common Workflows

"Stand up an autoscaling web fleet" → Create a launch template (AMI, type, IMDSv2), then an ASG referencing it with --health-check-type ELB and a target-tracking policy, see auto-scaling.md. For the public entry point, secure the load balancer (TLS/ACM, WAF, security response headers) per the Security Considerations below and the load-balancer notes in auto-scaling.md — the load-balancer build itself belongs to aws-networking.

"Roll out a new AMI to my fleet" → New launch template version → instance refresh; pin a numeric launch-template version so rollback works, see auto-scaling.md.

"Connect to a private instance without a bastion" → Give the instance SSM permissions (an instance profile with AmazonSSMManagedInstanceCore, or account-level DHMC) plus a network path, then use Session Manager, see systems-manager.md.

"Cut EC2 cost" → Right-size (burstable vs fixed-performance), Graviton where the app supports Arm64, Spot with price-capacity-optimized for fault-tolerant fleets, release idle Elastic IPs, see instance-selection.md.

Show full SKILL.md (400 more words)Show less

Troubleshooting

SymptomLikely causeQuick fix
SSH "Connection timed out"Network path (SG/NACL/route/no public IP)Open TCP 22 from your IP; check route to IGW; verify public IP — see troubleshooting.md
SSH "Connection refused"Host: sshd down or still bootingWait for boot; check sshd/port via Session Manager or serial console
InsufficientInstanceCapacityAWS lacks capacity of that type in the AZ (NOT a quota)Try another AZ / instance type / retry; don't request a quota increase
InstanceLimitExceededvCPU quota reached (this IS a quota)Request a Service Quotas increase for the instance family
ASG never replaces LB-unhealthy instancesHealth check type still EC2Set --health-check-type ELB
Instances stuck in Pending:Wait, terminated after ~1hLifecycle hook never completed (heartbeat 3600s, default ABANDON)Call complete-lifecycle-action CONTINUE, or set DefaultResult CONTINUE
System status check failedAWS host/hardwareStop/start to migrate to new hardware (reboot won't)
Instance status check failedInstance OS/network configReboot or fix the OS/network config

Full tables and more errors in troubleshooting.md.

Security Considerations

  • Enforce IMDSv2 (HttpTokens=required) on launch templates to block SSRF-based credential theft; set the account-level default per Region (applies to new launches only).
  • Prefer Session Manager over inbound SSH — no open port 22, no key management, and a CloudTrail record of session API calls; enable Session Manager session logging to CloudWatch Logs/S3 (off by default) to capture the in-session commands themselves — see systems-manager.md.
  • Use instance profiles, never embedded credentials; scope the role to least privilege.
  • Encrypt EBS/AMIs; to share an encrypted AMI cross-account, re-encrypt under a customer-managed KMS key (the default aws/ebs key can't be shared).
  • Enable CloudTrail in all Regions to audit EC2/ASG/SSM API activity, and alarm on sensitive actions (security-group changes, RunInstances/TerminateInstances from unexpected principals) so unauthorized changes surface.
  • For public-facing web fleets, encrypt traffic in transit with an ACM certificate on the load balancer's HTTPS listener and add AWS WAF for defense in depth against common web exploits — the load-balancer/WAF setup itself lives in aws-networking.
  • For hardening beyond this guidance, see AWS EC2 security best practices and CIS Benchmarks for the guest OS.

Not Covered By This Skill

  • Launching a single hardened instance with best-practice defaults → use the launching-ec2-instance-with-best-practices skill
  • Creating IAM roles / instance profiles for EC2 → use the setting-up-ec2-instance-profiles skill
  • Building AMIs with an Image Builder pipeline → use the amazon-ec2-image-builder skill
  • Lambda / serverless → aws-serverless; ECS/Fargate → aws-containers; EKS/Kubernetes → kubernetes
  • VPC, subnets, ALB/NLB, endpoints → aws-networking or built-in knowledge
  • IAM policy logic and CloudWatch dashboards/agent setup → aws-iam, aws-observability

© aws, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 6 other files (references) in skills/core-skills/aws-compute of aws/agent-toolkit-for-aws.

  • SKILL.md
  • references/ami-management.md
  • references/auto-scaling.md
  • references/instance-selection.md
  • references/provisioning.md
  • references/systems-manager.md
  • references/troubleshooting.md

Open the folder on GitHubat commit bd49cc8

Compare with similar skills

AWS Compute next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

AWS Compute compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
AWS Compute this skillaws/agent-toolkit-for-aws2.8k—~2.2kAutomated safety check: PassApache-2.0
Cloud Misconfig Auditorcriptogus/agent-evolve-network288—~965Automated safety check: PassCC-BY-SA-4.0
Conducting Cloud Incident Responsemukul975/Anthropic-Cybersecurity-Skills34k—~3kAutomated safety check: PassApache-2.0
Securing Azure With Microsoft Defendermukul975/Anthropic-Cybersecurity-Skills34k—~3kAutomated safety check: PassApache-2.0
AWS Essentialsericrisco/rsc-harness156—~2.9kAutomated safety check: NotesMIT
Cloud AuditCommonHuman-Lab/nyxstrike156—~1.1kAutomated safety check: PassCustom licence

Similar skills

  • Cloud Misconfig Auditor

    criptogus/agent-evolve-network

    Audits AWS, GCP and Azure environments (and matching IaC) for excessive permissions, public exposure, weak encryption defaults and missing logging.

    288 GitHub stars~965 tokensUpdated 28 days ago
    DevOps & CloudAuto-check passed
  • Conducting Cloud Incident Response

    mukul975/Anthropic-Cybersecurity-Skills

    Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic…

    34k GitHub stars~3k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed
  • Securing Azure With Microsoft Defender

    mukul975/Anthropic-Cybersecurity-Skills

    Deploys and configures Microsoft Defender for Cloud as a CNAPP for Azure, multi-cloud, and hybrid environments: enabling Defender plans for servers, containers, storage, and databases, configuring…

    34k GitHub stars~3k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed
  • AWS Essentials

    ericrisco/rsc-harness

    A skill your agent uses when standing up the core AWS surface a small product needs: hardening a fresh account, a private S3 bucket, encrypted RDS Postgres, ECS Fargate vs EC2, CloudFront + OAC, or…

    156 GitHub stars~2.9k tokensUpdated yesterday
    DevOps & CloudAuto-check: notes
  • Cloud Audit

    CommonHuman-Lab/nyxstrike

    Cloud and container security auditing workflow using prowler, trivy, kube-hunter, and docker-bench for AWS, GCP, Azure, Kubernetes, and container images

    156 GitHub stars~1.1k tokensUpdated yesterday
    DevOps & CloudAuto-check passed
  • Cloud Audit

    briiirussell/cybersecurity-skills

    Audit cloud infrastructure (AWS, GCP, Azure) for misconfigurations, excessive permissions, and security gaps.

    412 GitHub stars~1.3k tokensUpdated 4 mo ago
    SecurityAuto-check: notes

More from aws/agent-toolkit-for-aws

All 138 skills in this repo
  • Agent Advisor

    aws/agent-toolkit-for-aws

    Official

    Entry point for AI-agent work on AWS: pick a runtime, plan a migration for existing workloads, and build an executable POC — one phased flow.

    2.8k GitHub stars~4.9k tokensUpdated today
    Auto-check passed
  • Agents Build

    aws/agent-toolkit-for-aws

    Official

    A skill your agent uses to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments, or resource removal.

    2.8k GitHub stars~2.3k tokensUpdated today
    Auto-check: notes
  • Launch With AWS

    aws/agent-toolkit-for-aws

    Official

    Migrates vibe-coded web applications to AWS. An agent skill from aws/agent-toolkit-for-aws.

    2.8k GitHub stars~3.2k tokensUpdated today
    Auto-check passed
  • Official

    Deploy an event-driven workflow that routes S3 uploads to either Lambda or Fargate via Step Functions based on file size.

    2.8k GitHub stars~4k tokensUpdated today
    Auto-check passed
  • AWS Marketplace Metering

    aws/agent-toolkit-for-aws

    Official

    Deploys, queries, and debugs AWS Marketplace usage-based (PAYG) metering — the pipeline (ResolveCustomer, BatchMeterUsage, EventBridge via SAM) and querying/debugging metering records, statuses…

    2.8k GitHub stars~18k tokensUpdated today
    Auto-check passed
  • Agents Pay

    aws/agent-toolkit-for-aws

    Official

    A skill your agent uses when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments, and applying operator-defined spend limits.

    2.8k GitHub stars~6.5k tokensUpdated today
    Auto-check: notes

Questions about AWS Compute

What does AWS Compute do?

Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU, instance store vs EBS), launch templates, Auto Scaling…. AWS Compute is an agent skill from aws/agent-toolkit-for-aws, published by the product's own GitHub organization. Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU, instance store vs EBS), launch templates, Auto Scaling groups (scaling policies, instance refresh, mixed instances, Spot, warm pools, lifecycle hooks), IMDSv2, placement groups, Elastic IPs, AMI lifecycle, and Systems Manager fleet operations (Session Manager, Run Command, Patch Manager).

When should I use AWS Compute?

AWS Compute fits situations like: tasks that involve Cloud security.

How do I install AWS Compute in Claude Code?

Run `npx skills add aws/agent-toolkit-for-aws --skill aws-compute -a claude-code`. Or copy the skill folder (skills/core-skills/aws-compute in aws/agent-toolkit-for-aws) into .claude/skills/aws-compute in your project. Claude Code loads it when a task matches its description.

How do I install AWS Compute in Codex?

Run `npx skills add aws/agent-toolkit-for-aws --skill aws-compute -a codex`. Or copy the skill folder (skills/core-skills/aws-compute in aws/agent-toolkit-for-aws) into .agents/skills/aws-compute in your project. Codex loads it when a task matches its description.

Can I use AWS Compute in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add aws/agent-toolkit-for-aws --skill aws-compute -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/aws-compute, .gemini/skills/aws-compute, .github/skills/aws-compute and .opencode/skills/aws-compute in your project.

What does AWS Compute need to run?

SKILL.md names no scripts, command-line tools or credentials: AWS Compute is instructions for the agent only.

Does AWS Compute access the network?

SKILL.md names 1 domain. As links in the text: docs.aws.amazon.com. This is read from the text; nothing was executed.

Is AWS Compute safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does AWS Compute use?

AWS Compute is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does AWS Compute use?

About 2.2k tokens (SKILL.md is roughly 8.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 11k tokens, read only when the agent opens those files.

What are the alternatives to AWS Compute?

Skills that share tags, products or a category with AWS Compute: Cloud Misconfig Auditor (criptogus/agent-evolve-network, 288 stars), Conducting Cloud Incident Response (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Securing Azure With Microsoft Defender (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and AWS Essentials (ericrisco/rsc-harness, 156 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains AWS Compute?

aws (a GitHub organization, an official publisher) maintains it in aws/agent-toolkit-for-aws, which has 2,816 GitHub stars. The repository holds 138 skills in this directory. The repository was last updated on October 7, 2026.

Source: aws/agent-toolkit-for-aws on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.