amazon-ec2-image-builder

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: automation, cloud, debugging, ec2, image-builder.

What it does

Creates and automates custom image builds with EC2 Image Builder - Linux, Windows, and macOS AMIs, and container images to ECR. Covers the build IAM role, Amazon-managed and custom components, image recipes, infrastructure and distribution configuration (launch templates, SSM parameters, other Regions), one-off builds, recurring scheduled pipelines for golden AMI automation and OS patching, custom image workflows, and diagnosing failed builds. Applies when creating, automating, or scheduling AMI or container image builds with Image Builder, or when debugging a failed build. Not for launching instances from existing AMIs, AMI lifecycle/retirement, or general EC2 fleet management.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill amazon-ec2-image-builder

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/ec2-skills/amazon-ec2-image-builder ~/.claude/skills/amazon-ec2-image-builder

Safety box score

Grade C, moderate risk: 44 of 100 risk points, rated 2026-10-15. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill drives AWS Image Builder end to end: it creates IAM roles, build recipes, pipelines, workflows, and optional distribution to launch templates, SSM parameters, other Regions, and other accounts. The main risks are cloud-side blast radius from automated AMI rollouts and broad distribution, plus accidental secret exposure in build logs and command output.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It relies on AWS CLI operations that create and run Image Builder workflows, and custom workflows/components can execute commands on build instances (`ExecuteBash`, `ExecutePowerShell`, `RunCommand`, `ExecuteComponents`).
Network access	2 (moderate)	It sends data to AWS services including Image Builder, IAM, SSM, CloudWatch Logs, SNS, ECR, and can publish/distribute artifacts to other Regions and accounts.
Filesystem reach	1 (low)	There are no destructive local file operations shipped; the only file access is bounded to local skill/reference files and `file://` YAML inputs in the working directory.
Secrets & credentials	1 (low)	The docs explicitly warn that build logs capture full command output and that secrets must not be embedded in component YAML (`Build logs capture full command output`; `Never put secrets ... in component YAML`).
Privilege & persistence	2 (moderate)	It creates IAM roles and instance profiles and attaches managed policies (`aws iam create-role`, `attach-role-policy`, `create-instance-profile`), and custom workflows add more service permissions.
Instruction hijack surface	0 (none)	No hidden instructions to ignore policies, fetch remote instructions, or conceal actions were present in the shipped markdown.
Irreversible actions	3 (high)	It can schedule recurring pipelines and configure distribution so Image Builder automatically updates launch-template defaults and publishes AMIs/SSM parameters (`create-image-pipeline`, `launchTemplateConfigurations`, `ssmParameterConfigurations`).
Transparency	0 (none)	All shipped files are readable markdown; there are no binaries, packed payloads, or runtime-decoded code.

Before installing

Decide now whether you want automatic rollout via launch-template distribution; if not, skip that option.
Review `references/creating-images.md` step 3 and `references/custom-workflows.md` before use, because the skill creates IAM roles and can run build commands on EC2 hosts.
Confirm your component YAML contains no secrets and plan to fetch any credentials at runtime from Secrets Manager or SSM.
If you will use cross-account or multi-Region distribution, verify the target accounts/launch permissions explicitly before installing.

Rated 2026-10-15 by an automated review of 6 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/ec2-skills/amazon-ec2-image-builder/SKILL.md
Branch: main
Updated: 2026-09-19

agents-deploy — Use when deploying your agent to AWS, or when a deploy has failed.
aws-blocks — Guides building full-stack applications with AWS Blocks — an Infrastructure-from-Code framework.
aws-messaging-and-streaming — Guides general use of AWS messaging and streaming services.
connecting-to-data-source — Create and troubleshoot AWS Glue connections to JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS), Redshift, Snowflake, and BigQuery.
coordinating-multi-space-devops-agent — Coordinate the AWS DevOps Agent across multiple AgentSpaces from one Claude Code session — route questions to the right space (prod vs staging vs knowledge).
setup-security-agent — Configure AWS Security Agent for the current workspace — provision or reuse an agent space, IAM service role, and S3 bucket.