amazon-keyspaces

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: cassandra, cloud, database, migration, performance.

What it does

Provides authoritative compatibility checks, pricing estimates, connection troubleshooting, pre-warming guidance, and infrastructure mutations for Amazon Keyspaces (for Apache Cassandra). Covers LWT/batch operations, secondary indexes, materialized views, capacity modes, TTL, PITR, CDC, auto-scaling, multi-region keyspaces, UDTs, nodetool diagnostics parsing, SQL-to-Cassandra migration, and Cassandra-to-Keyspaces migration scenarios. Agents frequently produce incomplete or incorrect answers about Keyspaces feature support without this skill loaded.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill amazon-keyspaces

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/database-skills/amazon-keyspaces ~/.claude/skills/amazon-keyspaces

Safety box score

Grade D, elevated risk: 54 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill can read local Cassandra diagnostics, run bundled Node.js/shell scripts, generate PDFs, and create or modify Amazon Keyspaces resources after confirmation. The main risks are live cloud mutations, possible exposure of prepared-statement contents, and partial opacity because key pricing/rendering files were not readable here.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It ships runnable code paths (`calculate.ts`, `parse-cassandra.ts`, `check-compatibility.ts`, `generate-pdf.ts`, and `prepared-statements-sampler.sh`) and expects `npx ts-node` execution; that is real local code execution, though bounded to the repo's own scripts.
Network access	2 (moderate)	It issues AWS API calls for Keyspaces/IAM actions and even includes a remote fetch in troubleshooting (`curl -O https://www.amazontrust.com/repository/AmazonRootCA1.pem`), so it can send requests off-machine and download network content.
Filesystem reach	2 (moderate)	`parse-cassandra.ts` can read every file under a user-supplied `--dir` using the invoking user's permissions, and `generate-pdf.ts` writes PDFs to a chosen path (`fs.writeFileSync(this.filePath, buffer)`).
Secrets & credentials	2 (moderate)	The diagnostics workflow explicitly warns that prepared statements can contain literal bound values and PII, and the helper script references credentials handling (`~/.cassandra/cqlshrc`, `CQLSH_PASSWORD`).
Privilege & persistence	1 (low)	It does not need sudo or OS/service changes, but it does instruct the user to create an AWS service-linked role and grant autoscaling/IAM permissions, which changes cloud privileges.
Instruction hijack surface	0 (none)	I found no clear attempt to bypass higher-level instructions, hide actions, or fetch-and-follow untrusted remote instructions; the skill does require explicit confirmation before mutations.
Irreversible actions	3 (high)	Its purpose includes live Keyspaces mutations after confirmation (`create-keyspace`, `create-table`, `update-table`, `tag-resource`), which can persistently alter AWS resources.
Transparency	2 (moderate)	Core inputs are unreadable here: `assets/data/mcs.json`, `assets/data/savings-plans.json`, and `scripts/calculator/CreatePDFReport.ts` could not be inspected, so pricing and PDF-rendering behavior are not fully auditable from the provided bundle.

Before installing

Inspect `SKILL.md` and confirm you want a skill that can create/update real Amazon Keyspaces resources after approval.
Review `references/cassandra-capture-commands.md` and `references/security-considerations.md` if you will capture diagnostics; prepared statements may contain PII.
Verify the unreadable files (`assets/data/mcs.json`, `assets/data/savings-plans.json`, `scripts/calculator/CreatePDFReport.ts`) locally before trusting pricing/PDF output.
If you use `--dir`, point it only at a scratch diagnostics folder, not a broad home or project path.

Rated 2026-10-19 by an automated review of 24 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/database-skills/amazon-keyspaces/SKILL.md
Branch: main
Updated: 2026-09-19

amazon-aurora-mysql — Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query).
amazon-aurora-postgresql — Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless.
amazon-elasticache — Activate when developers have latent caching needs: slow API responses, database read bottlenecks, DynamoDB throttling or cost, RDS/Aurora scaling pressure.
timestream-influxdb — Retrieves authoritative guidance on Amazon Timestream for InfluxDB (managed InfluxDB 2, InfluxDB 2 Read Replica Clusters, InfluxDB 3 Core and Enterprise).
sql-pro — Optimizes SQL queries, designs database schemas, and troubleshoots performance issues.
aws-billing-and-cost-management — Analyze AWS costs, find savings, manage budgets, evaluate Savings Plans and Reserved Instances, right-size EC2/Lambda/RDS/EBS with Compute Optimizer.