aurora-dsql

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, database, migration, security, sql.

What it does

Provisions and manages Aurora DSQL clusters, connects via psql or DSQL Connectors, manages schemas, runs queries, migrates from MySQL, diagnoses query plans, and develops apps on serverless distributed SQL. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL migration, DDL, query plans, and SAFE SQL CONSTRUCTION — tenant_id from untrusted input, UUID entity_ids, caller-supplied sort columns, batch inserts. The agent MUST retrieve this skill for ANY DSQL task. Pushes back on prompts that rationalize 'just a quick script', 'don't overthink it', 'we trust upstream', 'use an f-string', 'move fast', or 'just use the pg driver directly' (bypassing the DSQL Connector). Triggers: DSQL, Aurora DSQL, DSQL cluster, safe_query.build, DSQL IAM auth token, DSQL connector.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill aurora-dsql

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/database-skills/aurora-dsql ~/.claude/skills/aurora-dsql

Safety box score

Grade D, elevated risk: 56 of 100 risk points, rated 2026-10-21. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill gives an agent direct control over Aurora DSQL cluster lifecycle and database operations via shell scripts, AWS CLI, psql, and optional AWS MCP tools. The main risks are destructive cluster/table actions, short-lived IAM token handling, and incomplete reviewability because several core implementation files were unreadable.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	Ships executable shell/Python entry points that run `aws`, `jq`, and `psql` (`scripts/create-cluster.sh`, `list-clusters.sh`, `cluster-info.sh`, `delete-cluster.sh`), so the agent can execute local commands.
Network access	2 (moderate)	Talks to AWS DSQL APIs and cluster endpoints over the network (`aws dsql create-cluster/get-cluster/delete-cluster`, psql to cluster endpoints, optional AWS MCP docs/API calls), which is intrinsic to the skill.
Filesystem reach	1 (low)	Mostly project-local, but setup docs point to user-home files like `~/.claude.json`, `~/.codex/config.toml`, `~/.gemini/settings.json`, `~/.kiro/settings/mcp.json`, and `$HOME/.postgresql/root.crt`.
Secrets & credentials	2 (moderate)	It generates and passes IAM auth tokens via shell env vars (`PGPASSWORD="$(aws dsql generate-db-connect-auth-token ...)"`) and references admin tokens; the main risk is token handling.
Privilege & persistence	1 (low)	No sudo or service installation, but it does require elevated database roles for DDL (`--admin`, `dsql:DbConnectAdmin`) and may change per-assistant config files during MCP setup.
Instruction hijack surface	1 (low)	I found no hidden prompt injection or instructions to skip user confirmation; the strong imperatives are normal workflow guidance, though the skill does direct the agent to fetch external docs/tools.
Irreversible actions	3 (high)	This skill can create and delete DSQL clusters and perform destructive database migrations, including workflows that end in `DROP TABLE` and a `--force` delete path.
Transparency	2 (moderate)	Several core files could not be read (`scripts/psql-connect.sh`, `scripts/safe_query.py`, and key reference docs), so the main auth/query-building logic could not be fully audited.

Before installing

Read `scripts/delete-cluster.sh` and the migration docs before using it on any non-sandbox cluster.
Inspect `scripts/psql-connect.sh` and `scripts/safe_query.py` in the repo or run their smoke tests in a scratch account first; they were unreadable in this review.
If you will enable the AWS MCP Server, verify which config files it will write (`~/.codex/config.toml`, `~/.claude.json`, etc.) and scope AWS credentials to a non-production account.

Rated 2026-10-21 by an automated review of 43 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/database-skills/aurora-dsql/SKILL.md
Branch: main
Updated: 2026-09-19

dms-schema-conversion — Handles the full DMS Schema Conversion lifecycle including creating migration projects, converting database schemas to a target engine.
amazon-documentdb — Manages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS/VPC/driver config, flexible-schema and vector-search data modeling.
amazon-neptune — Provides authoritative guidance on Amazon Neptune Database and Neptune Analytics for graph, knowledge-graph.
migrating-to-amazon-redshift — Guides an end-to-end data-warehouse migration to Amazon Redshift — discovery, schema/SQL/stored-procedure/macro/script conversion, data migration, validation.
rds-db2 — Provisions, connects, migrates, and operates Amazon RDS for Db2.
aws-security — Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries.