aws-lambda-managed-instances

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, compute, cost-optimization, lambda, performance.

What it does

Evaluates, configures, and migrates workloads to AWS Lambda Managed Instances (LMI). Runs Lambda functions on EC2 instances in the user's account while AWS manages provisioning, patching, scaling, routing, and load balancing. Triggers when queries mention Lambda Managed Instances, LMI, capacity providers, multi-concurrent execution environments, EC2-backed Lambda, persistent Lambda instances, PerExecutionEnvironmentMaxConcurrency, CapacityProviderConfig, cold start elimination via dedicated instances, migrating standard Lambda to managed instances, or cost comparison between standard Lambda and LMI with Savings Plans or Reserved Instances. Also covers long-running and asynchronous workloads and the 90-minute (5400s) function timeout for asynchronous and event-source-mapping (SQS, Kinesis, DynamoDB Streams / ESM) invocations, including how to raise the function timeout up to 90 minutes / 5400s and the related duration limits.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill aws-lambda-managed-instances

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/serverless-skills/aws-lambda-managed-instances ~/.claude/skills/aws-lambda-managed-instances

Safety box score

Grade C, moderate risk: 25 of 100 risk points, rated 2026-10-21. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a documentation-only AWS deployment skill for Lambda Managed Instances, with SAM/CLI examples and migration guidance. The main risk is that it can drive an agent to create, publish, and delete AWS resources in the user’s account, with outbound network access to AWS services.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It includes runnable shell/AWS CLI commands such as `aws lambda create-capacity-provider`, `aws lambda create-function`, and `aws lambda publish-version`, though there are no bundled native scripts.
Network access	2 (moderate)	It requires talking to AWS control-plane and service endpoints, and says the instances need VPC endpoints or NAT to reach AWS services; it also links out to AWS-hosted pricing/docs.
Filesystem reach	0 (none)	No local filesystem access beyond the repository content is described; the actions are cloud-side rather than reads/writes of home or system files.
Secrets & credentials	0 (none)	It does not ask for passwords, tokens, or key files, and instead says to use Secrets Manager or Parameter Store for credentials.
Privilege & persistence	0 (none)	There is no sudo, service registration, shell startup editing, or other privilege-escalation step in the skill files.
Instruction hijack surface	0 (none)	The files do not contain hidden prompts, instructions to ignore safeguards, or requests to follow remote instructions.
Irreversible actions	3 (high)	The skill’s purpose is to deploy and operate infrastructure, including version publishing and cleanup commands; it can create, publish, shift traffic, and delete AWS resources in the user’s account.
Transparency	0 (none)	All shipped files are readable markdown/YAML; there are no binaries, minified blobs, or decoded-at-runtime payloads.

Before installing

Read `references/infrastructure-setup.md` and `assets/sqs-processor/template.yaml` for the exact AWS resources it can create and delete.
Try the workflow in a sandbox AWS account first; it publishes versions and can delete the function and capacity provider.
Confirm your VPC has 3+ AZ subnets and the required AWS service endpoints/NAT before letting an agent run it.
If you do not want cloud changes, do not install this skill in an agent that can execute AWS CLI commands.

Rated 2026-10-21 by an automated review of 8 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/serverless-skills/aws-lambda-managed-instances/SKILL.md
Branch: main
Updated: 2026-09-19

aws-storage — Selects, investigates, and compares AWS object, file, and block storage services, and answers cost, performance, configuration, security.
aws-lambda-microvms — Builds, runs, debugs, and operates applications on AWS Lambda MicroVMs — Firecracker-isolated.
debugging-lambda-timeouts — Debugs AWS Lambda function timeout failures by systematically analyzing function configuration, CloudWatch logs and metrics, VPC/networking, cold starts.
agents-optimize — Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI/CD quality gates, observability, or cost optimization.
aws-billing-and-cost-management — Analyze AWS costs, find savings, manage budgets, evaluate Savings Plans and Reserved Instances, right-size EC2/Lambda/RDS/EBS with Compute Optimizer.
aws-serverless — Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK.