amazon-bedrock

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: ai, api, cloud, generative, ml.

What it does

Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore (including the Harness managed agent loop). Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, migrating/porting/converting a Bedrock Agent (including inline agents) to an AgentCore Harness, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching, quota health checks and throttling diagnosis, cost attribution, migrating between Claude model generations, chunking strategies, API selection (Converse vs InvokeModel), and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Coinbase CDP, Stripe Privy, 402 Payment Required, paid endpoint). NOT for custom model training, Rekognition, or Comprehend.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill amazon-bedrock

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-core/skills/amazon-bedrock ~/.claude/skills/amazon-bedrock

Safety box score

Grade F, high risk: 88 of 100 risk points, rated 2026-10-14. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a broad AWS Bedrock/AgentCore operational skill: it runs shell/Python/container commands, reads and writes local project files, and can create, deploy, and delete cloud resources. The main risks are high-blast-radius AWS actions, live network fetches and package installs, and handling of secrets/PII in manifests, logs, and retrieval data; several bundled docs and one script were not readable here, so some behavior is opaque.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	It explicitly runs `python3` scripts, `pip install`, `npm install`, `docker buildx`, `curl`, and AWS CLI commands, so it can execute code and shell commands on the host.
Network access	3 (high)	It fetches live remote content and talks to many external services, including `https://raw.githubusercontent.com/.../README.md`, `npm view @aws/agentcore version`, AWS APIs, S3, ECR, and CloudWatch.
Filesystem reach	2 (moderate)	It writes and edits project-local control files and sensitive artifacts such as `./out/source-agent.json`, `agentcore/aws-targets.json`, and `agentcore/.cli/deployed-state.json`.
Secrets & credentials	2 (moderate)	It handles API keys, OAuth client secrets, AWS credentials, `sessionId`, and warns that KB retrieval and CloudWatch logs can contain PII/PHI, but it does not directly read credential stores.
Privilege & persistence	3 (high)	It directs global installs and account-wide/service configuration changes such as `npm install -g @aws/agentcore@latest`, ECR settings, Lambda permissions/concurrency, and CloudWatch/KMS configuration.
Instruction hijack surface	3 (high)	It tells the agent to treat the skill files as the "primary source of truth," says to "do not summarize — execute," and pushes live fetched guidance into the workflow, creating strong instruction pressure from bundled and remote content.
Irreversible actions	3 (high)	Its workflows can provision, deploy, and tear down cloud infrastructure (`agentcore deploy`, `aws cloudformation delete-stack`, `aws budgets create-budget`, `docker push`) with broad blast radius.
Transparency	2 (moderate)	Five shipped files and one script could not be read here, including `scripts/fetch_bedrock_agent.py` and core docs for harness, guardrails, KB setup, and payments, so important behavior is not fully inspectable.

Before installing

Read `references/bedrock-agents-to-agentcore-harness/deploy.md` and confirm you are okay with it creating or deleting AWS resources in the target account/region.
Verify `agentcore --help` and `aws --version` on a scratch profile first; do not point it at production credentials on the first run.
Inspect `scripts/fetch_bedrock_agent.py` and the unread harness/guardrail/KB/payment docs before allowing the skill to run.
Use throwaway values for any `API_KEY`, OAuth client secret, or AWS profile you provide to the workflow.

Rated 2026-10-14 by an automated review of 25 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-core/skills/amazon-bedrock/SKILL.md
Branch: main
Collection: aws-core
Updated: 2026-09-19

fine-tuning-expert — Use when fine-tuning LLMs, training custom models, or adapting foundation models for specific tasks.
stepfun-tts — Generate Chinese / Japanese speech with StepFun's Contextual TTS — default `stepaudio-2.5-tts` (blind-judged better on neutral/emotive preset voices).
aws-ai-ml — Selects, deploys, and customizes AI models on Amazon SageMaker.
aws-sdk-js-v3-usage — AWS SDK for JavaScript v3 development patterns.
aws-sdk-python-usage — AWS SDK for Python (boto3/botocore) development patterns. You MUST use this skill when writing Python code that uses AWS services via boto3 or botocore.
aws-sdk-swift-usage — AWS SDK for Swift development patterns. Use when writing Swift code that uses AWS services via aws-sdk-swift package.