Skills Explorer Add Skills

amazon-documentdb

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: database, documentdb, migration, mongodb, security.

What it does

Manages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS/VPC/driver config, flexible-schema and vector-search data modeling, MongoDB compatibility assessment, DMS-based migration, slow-query diagnosis, major version upgrades (4.0->5.0->8.0), Well-Architected reviews (41-check wa_review.py), cost estimation, and security hardening. Retrieve for every DocumentDB question and when the user asks to set up or migrate MongoDB to AWS — DocumentDB is AWS's MongoDB-compatible managed database. Triggers: JSON document store, document database, MongoDB on AWS, Nested fields, Lambda cannot connect, TLS handshake, VPC port 27017, IAM auth, Secrets Manager, encryption at rest, $graphLookup, flexible schema, COLLSCAN, compound index, DMS migration, CDC cutover, $vectorSearch, RAG, Global Clusters, DR replication, cost sizing, audit, health check, production-readiness.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill amazon-documentdb

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/database-skills/amazon-documentdb ~/.claude/skills/amazon-documentdb

Safety box score

Grade D, elevated risk: 49 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a live AWS operator for Amazon DocumentDB: it creates clusters, runs DMS migrations, executes mongosh/explain against databases, and writes review artifacts. The main risks are broad cloud-side autonomy, secret handling in CLI examples, and runtime fetching/execution of external tooling.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution3 (high)The skill explicitly says it "runs AWS CLI commands, DMS tasks, index tools, and `explain()` against the user's cluster" and ships a Python review script that invokes boto3/pymongo.
Network access2 (moderate)It makes outbound requests to AWS and public internet, including `curl` to the RDS trust store and `git clone https://github.com/awslabs/amazon-documentdb-tools`.
Filesystem reach1 (low)Writes reports under `artifacts/{app-name}/` and uses local clone/temp paths, but does not target broad system paths or dotfiles.
Secrets & credentials2 (moderate)The workflow uses inline credentials such as `--master-user-password '<password>'` and `--password '<pw>'`, although it also recommends Secrets Manager for production.
Privilege & persistence0 (none)There is no `sudo`, service registration, shell startup editing, or other local OS privilege escalation in the shipped files; changes are cloud-resource scoped.
Instruction hijack surface0 (none)The files are directive-heavy, but they do not instruct the agent to ignore its own rules, hide content, or follow untrusted injected instructions.
Irreversible actions3 (high)It can create clusters, DMS replication resources, start cutovers, modify security groups, and even delete a cluster clone during rollback, all of which are consequential live actions.
Transparency2 (moderate)It clones external tooling at runtime and installs its dependencies, so the exact code executed from `amazon-documentdb-tools` is not visible in this bundle.

Before installing

Rated 2026-10-20 by an automated review of 11 files from the skill's repository.

Source

Repository
aws/agent-toolkit-for-aws (all skills from this repository)
Path
skills/specialized-skills/database-skills/amazon-documentdb/SKILL.md
Branch
main
Updated
2026-09-19