aws-auth
An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: access-control, api, mobile, security, web.
What it does
Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries. Covers sign-up/sign-in flows and the login page (Cognito-hosted UI / managed login), MFA, password policies, OAuth 2.0 / OIDC flows (auth-code + PKCE, client credentials), social/SAML federation, tokens (ID/access/refresh, rotation, revocation, storage), Cognito Lambda triggers, identity pools (temp AWS creds), and gating API Gateway (or ALB) routes to signed-in users via Cognito/JWT authorizers. Applies when adding a login or sign-up page, configuring a user pool or app client, choosing user pool vs identity pool, wiring social/SAML, refreshing tokens, requiring sign-in on an API Gateway or ALB, or debugging redirect_uri/token/MFA/CORS/federation errors. Does NOT cover Amplify Gen2 backend definitions (defineAuth, npx ampx → aws-amplify), IAM/STS/Identity Center (→ aws-iam), or API Gateway/Lambda resource config beyond the authorizer (→ aws-serverless).
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add aws/agent-toolkit-for-aws --skill aws-authOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-core/skills/aws-auth ~/.claude/skills/aws-authSafety box score
Grade C, moderate risk: 39 of 100 risk points, rated 2026-09-21. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
Source
- Repository
- aws/agent-toolkit-for-aws (all skills from this repository)
- Path
- plugins/aws-core/skills/aws-auth/SKILL.md
- Branch
- main
- Collection
- aws-core
- Updated
- 2026-09-19
Related skills
- aws-secrets-manager — Secret safety for AWS Secrets Manager, secret management, credentials, API keys, tokens, and passwords.
- csharp-developer — NET Core APIs, or Blazor web apps.
- django-storages-s3 — Use when configuring Django to store static and media files on AWS S3 with django-storages. py.
- dotnet-core-expert — NET 8 applications with minimal APIs, clean architecture, or cloud-native microservices.
- fullstack-guardian — Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level.
- java-architect — x, microservices, or reactive programming.