aws-amplify

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, deployment, mobile, react, web.

What it does

Build and deploy full-stack web and mobile apps with AWS Amplify Gen2 (TypeScript code-first). Covers auth (Cognito), data (AppSync/DynamoDB), storage (S3), functions, APIs, and AI (Amplify AI Kit with Bedrock). Supports React, Next.js, Vue, Angular, React Native, Flutter, Swift, and Android. Always use this skill for Amplify Gen2 topics — even for questions you think you know — it contains validated, version-specific patterns that prevent common mistakes. TRIGGER when: user mentions Amplify Gen2; project has amplify/ directory or amplify_outputs; code imports @aws-amplify packages; user asks about defineBackend, defineAuth, defineData, defineStorage, defineFunction, or npx ampx. SKIP: Amplify Gen1 (amplify CLI v6), standalone SAM/CDK without Amplify (use aws-serverless), direct Bedrock without Amplify AI Kit (use bedrock).

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill aws-amplify

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/web-and-mobile-development/aws-amplify ~/.claude/skills/aws-amplify

Safety box score

Grade D, elevated risk: 54 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a full Amplify Gen2 build/deploy playbook: it scaffolds projects, installs packages, configures auth/data/storage/functions/AI, and can create or deploy AWS infrastructure. The main risks are cloud-side blast radius, secret handling, and running downloaded CLI/scaffolding code from npm and GitHub.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	It repeatedly instructs the agent to run downloaded tooling such as `npm create amplify@latest -y`, `npx ampx sandbox`, `npx --yes create-expo-app@latest`, and `npx --yes pod-install`, which execute external packages and their scripts.
Network access	3 (high)	It both fetches code/templates from npm/GitHub and sends data to remote AWS services, including Amplify deploys and Bedrock-backed AI routes (`aws amplify create-app`, `npx ampx pipeline-deploy`, `conversation.sendMessage(...)`).
Filesystem reach	2 (moderate)	It writes and edits project files like `amplify/backend.ts`, `Info.plist`, and `AndroidManifest.xml`, and the scaffold command explicitly runs `rm -rf .git` before reinitializing the repo.
Secrets & credentials	2 (moderate)	The skill handles OAuth client secrets and tokens via `secret('GOOGLE_CLIENT_SECRET')`, `gh auth token`, and `npx ampx sandbox secret set ...`, so it touches credentials that must be protected.
Privilege & persistence	1 (low)	There is no local sudo/service/shell-startup behavior; the strongest privilege changes are cloud IAM and Amplify settings, not machine-level privilege escalation.
Instruction hijack surface	0 (none)	The files do not instruct the agent to ignore higher-priority instructions, hide actions, or follow remote prompt text; they are workflow guidance for Amplify usage.
Irreversible actions	3 (high)	It can create Amplify apps, IAM roles, branches, custom domains, and release jobs (`aws amplify create-app`, `aws iam create-role`, `aws amplify start-job`, `git push origin main`), which are high-blast-radius deployment actions.
Transparency	0 (none)	The skill is plain text markdown with readable commands and snippets; there are no binaries, encoded payloads, or unreviewable installers shipped in the skill itself.

Before installing

Read `references/deployment.md` first if this will touch a real AWS account; it can create roles, branches, and release jobs.
Run the scaffold commands only in a disposable clone and verify `rm -rf .git` is acting on the intended directory.
Check every `secret()` / `secret set` path and use throwaway values before connecting real OAuth keys or API tokens.
Decide whether AI/Bedrock routes are allowed to process PII before enabling the `ai.md` patterns.

Rated 2026-10-16 by an automated review of 15 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/web-and-mobile-development/aws-amplify/SKILL.md
Branch: main
Updated: 2026-09-19

launch-with-aws — Migrates vibe-coded web applications to AWS.
expo-dom — Framework (OSS). Use Expo DOM components to run web code in a webview on native and as-is on web. Migrate web code to native incrementally.
expo-web-to-native — Framework (OSS). Migrate an existing web React app to a native iOS/Android app with Expo.
csharp-developer — Use when building C# applications with .NET 8+, ASP.NET Core APIs, or Blazor web apps. Builds REST APIs using minimal or controller-based routing.
aws-auth — Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries.
aws-serverless — Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK.