amazon-aurora-postgresql

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aurora, cloud, database, performance, postgresql.

What it does

Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I/O-Optimized storage, commitment pricing, or PostgreSQL upgrade planning. For Aurora MySQL, use amazon-aurora-mysql instead. Contains safety guardrails, express-first routing, and response templates that override defaults.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill amazon-aurora-postgresql

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/database-skills/amazon-aurora-postgresql ~/.claude/skills/amazon-aurora-postgresql

Safety box score

Grade D, elevated risk: 60 of 100 risk points, rated 2026-10-15. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill manages Amazon Aurora PostgreSQL clusters: it can create and modify clusters, size serverless capacity, compare commitment/I/O costs, and guide upgrade planning. The main risks are AWS-networked operations, handling database credentials/tokens, and the ability to mutate production database settings and storage/instance configuration; destructive deletes and purchases are blocked, but many other changes remain executable after confirmation.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It runs AWS CLI/API operations and bundled Python analyzers/scripted workflows (e.g. `python scripts/acu_calculator.py`, `python scripts/io_optimized_analyzer.py`) rather than just giving advice.
Network access	2 (moderate)	It talks to AWS services and remote endpoints: RDS/CloudWatch/Pricing/SSM/Data API calls, plus token-based database connections like `aws rds generate-db-auth-token` and `psql` to cluster endpoints.
Filesystem reach	1 (low)	The workflow uses temporary home-directory files such as `~/.pgpass`/`PGPASSFILE` in the migration and precheck examples, but it does not appear to edit system paths or shell startup files.
Secrets & credentials	2 (moderate)	It handles secret material indirectly via Secrets Manager, temporary password files, Data API `secretArn`s, and short-lived IAM auth tokens (`PGPASSWORD=$TOKEN` appears in the connection example).
Privilege & persistence	1 (low)	Some host-side setup examples require elevated package installs like `sudo yum install -y postgresql` or `sudo apt-get install -y postgresql-client`, but the skill does not itself demand broad admin control of the machine.
Instruction hijack surface	1 (low)	The skill heavily constrains response shape and workflow (for example, “response templates that override defaults” and “Do NOT answer ... from general knowledge alone”), but I did not find hidden text or instructions to bypass confirmation/safety rules.
Irreversible actions	3 (high)	Its purpose is to create and modify Aurora resources, including cluster creation, instance changes, storage-type switches, enabling HTTP endpoints, tagging, and other state changes after confirmation; that is inherently high-blast-radius.
Transparency	3 (high)	Several executable parts were not readable: `scripts/acu_calculator.py`, `scripts/commitment_pricing_analyzer.py`, `scripts/io_optimized_analyzer.py`, and the `express-create-*` files listed in the inventory, so their exact behavior could not be verified.

Before installing

Read the unreadable shipped scripts (`scripts/acu_calculator.py`, `scripts/commitment_pricing_analyzer.py`, `scripts/io_optimized_analyzer.py`) before trusting any automation.
Confirm the AWS principal is limited to the specific RDS/CloudWatch/Pricing actions the skill needs; do not install it with broad admin credentials.
Test on a scratch cluster/account first, and verify that no workflow will create `~/.pgpass`, enable public access, or trigger an unwanted storage-type switch.

Rated 2026-10-15 by an automated review of 35 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/database-skills/amazon-aurora-postgresql/SKILL.md
Branch: main
Updated: 2026-09-19

amazon-aurora-mysql — Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query).
amazon-elasticache — Activate when developers have latent caching needs: slow API responses, database read bottlenecks, DynamoDB throttling or cost, RDS/Aurora scaling pressure.
amazon-keyspaces — Provides authoritative compatibility checks, pricing estimates, connection troubleshooting, pre-warming guidance.
creating-amazon-aurora-db-cluster-with-instances — Creates a complete Amazon Aurora database cluster with instances, handling cluster creation, instance provisioning.
aws-billing-and-cost-management — Analyze AWS costs, find savings, manage budgets, evaluate Savings Plans and Reserved Instances, right-size EC2/Lambda/RDS/EBS with Compute Optimizer.
aws-compute — Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU.