aws-compute

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: cloud, devops, performance, scalability, troubleshooting.

What it does

Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU, instance store vs EBS), launch templates, Auto Scaling groups (scaling policies, instance refresh, mixed instances, Spot, warm pools, lifecycle hooks), IMDSv2, placement groups, Elastic IPs, AMI lifecycle, and Systems Manager fleet operations (Session Manager, Run Command, Patch Manager). Applies to EC2 instance and fleet questions, InsufficientInstanceCapacity, CPU-credit/surplus charges, IMDSv2 401s, instances stuck in Pending:Wait, ASG not replacing unhealthy instances, status-check failures, SSH refused/timed out, or instances missing as SSM managed nodes. For a single secure instance launch, the launching-ec2-instance-with-best-practices skill is more appropriate; for instance profiles, see setting-up-ec2-instance-profiles; for Image Builder, see amazon-ec2-image-builder. Does NOT cover Lambda, ECS/Fargate, EKS, VPC/ALB/NLB design, or IAM policy authoring.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill aws-compute

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-core/skills/aws-compute ~/.claude/skills/aws-compute

Safety box score

Grade F, high risk: 68 of 100 risk points, rated 2026-10-14. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is an EC2 fleet-operations playbook: it creates launch templates and Auto Scaling groups, rolls instances, runs SSM commands/sessions, and manages AMIs. The main risks are broad infrastructure impact, remote shell execution on fleets, and repeated warnings that secrets can be exposed through user data, AMIs, and session/output logs.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	The docs directly invoke shell/AWS CLI commands such as `aws ec2 create-launch-template`, `aws autoscaling start-instance-refresh`, and `aws ssm send-command`, but there are no shipped binaries or embedded scripts.
Network access	2 (moderate)	It relies on AWS APIs and service endpoints (`ssm`, `ssmmessages`, `s3`, `kms`, CloudWatch Logs) and even references the metadata IP `http://169.254.169.254/latest/user-data`, so it sends operational data off-box.
Filesystem reach	2 (moderate)	The skill provisions user data that runs on instances, creates AMIs from instance disks, and explicitly discusses files like `~/.bash_history`, `authorized_keys`, and `/var/log/cloud-init-output.log`.
Secrets & credentials	3 (high)	It warns that user data is readable via IMDS and cloud-init logs, AMIs can bake in credentials/API keys and SSH keys, and Session Manager/Run Command output can contain sensitive results.
Privilege & persistence	2 (moderate)	Linux user data runs as root, and the launch-template/ASG guidance configures instance profiles, metadata options, and fleet-wide settings that affect privileged OS behavior.
Instruction hijack surface	2 (moderate)	`references/systems-manager.md` explicitly says unsanitized `--targets` and `--parameters` values are a command-injection path into shell execution on the fleet.
Irreversible actions	3 (high)	The skill’s purpose includes creating, scaling, refreshing, disabling, and deregistering fleets/images (`create-auto-scaling-group`, `start-instance-refresh`, `disable-image`, `deregister-image`), which can automatically replace or retire live systems.
Transparency	0 (none)	All supplied files are plain markdown; there are no binaries, obfuscated payloads, or runtime-downloaded installers.

Before installing

Read `references/provisioning.md` and `references/systems-manager.md` to confirm you accept root-level user data and fleet-wide shell execution.
Test first in a sandbox account with disposable instances and no real secrets in user data, AMI contents, or SSM output/logging.
Verify every `--targets` and `--parameters` value is sanitized and never built directly from user input.
Confirm which actions could replace live instances or permanently retire AMIs, and require numeric launch-template versions plus Recycle Bin where appropriate.

Rated 2026-10-14 by an automated review of 7 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-core/skills/aws-compute/SKILL.md
Branch: main
Collection: aws-core
Updated: 2026-09-19

aws-containers — Builds and deploys containerized workloads on Elastic Kubernetes Service (EKS), Elastic Container Service (ECS), Fargate, and ECR (Elastic Container Registry).
aws-observability — Builds, configures, debugs, and optimizes AWS observability with CloudWatch (Log Insights, Metrics, Alarms, Dashboards, EMF), X-Ray, CloudTrail.
use-railway — Operate Railway infrastructure: sign up for or sign in to a Railway account, create projects, provision services, databases, and buckets, deploy code.
cloud-architect — Designs cloud architectures, creates migration plans, generates cost optimization recommendations, and produces disaster recovery strategies across AWS, Azure.
sre-engineer — Defines service level objectives, creates error budget policies, designs incident response procedures, develops capacity models.
aws-billing-and-cost-management — Analyze AWS costs, find savings, manage budgets, evaluate Savings Plans and Reserved Instances, right-size EC2/Lambda/RDS/EBS with Compute Optimizer.