aws-lambda-microvms

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, compute, lambda, sandbox, security.

What it does

Builds, runs, debugs, and operates applications on AWS Lambda MicroVMs — Firecracker-isolated, snapshot-resumable serverless compute environments running inside a container with up to 8 hr lifetimes. Applicable when workloads need strong isolation between tenants, isolated serverless compute, sandbox compute, or secure multi-tenant execution. Also suited for AI/agent code-execution sandboxes, interactive code playgrounds and notebooks (Jupyter, REPLs, dev environments running user-supplied code), reinforcement-learning environments, multi-tenant CI executors and build runners, sessionful game or simulation servers, or isolated security scanners. Also applicable when the workload needs long-lived sessions, a real port-listening server (gRPC, WebSocket, custom TCP protocols), state preserved across periods of inactivity (suspend/resume), container-level access (FUSE, eBPF, custom syscalls), or session-affine routing.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill aws-lambda-microvms

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/serverless-skills/aws-lambda-microvms ~/.claude/skills/aws-lambda-microvms

Safety box score

Grade D, elevated risk: 65 of 100 risk points, rated 2026-10-14. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is for building and operating AWS Lambda MicroVMs, so it can create images, run/suspend/resume/terminate guest environments, and open shell access into them. The main risks are broad cloud-side blast radius: arbitrary code execution inside the MicroVM, guest access to IAM credentials, default public network egress, and snapshotting that can freeze secrets into every instance.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	It explicitly builds and runs containerized workloads and offers interactive shell access (`SHELL_INGRESS`, `websocat ...`), so the agent can execute arbitrary commands inside the guest environment.
Network access	3 (high)	The skill uses AWS APIs and service endpoints, and `references/networking.md` says, `By default a MicroVM can reach any public address`, so guest code can send data out unless you constrain egress.
Filesystem reach	2 (moderate)	The shell lands in `the same container as the running application — same network namespace, filesystem, and process tree`, and snapshots capture disk state, so guest files and runtime state are broadly exposed inside the MicroVM.
Secrets & credentials	3 (high)	`references/iam-and-security.md` says runtime credentials are exposed via IMDSv2 at `169.254.169.254/.../execution_role`, and snapshot docs warn that fetched secrets or tokens are copied into every MicroVM.
Privilege & persistence	2 (moderate)	The workflow requires creating/passing IAM roles and network connectors (`iam:PassRole`, `lambda:PassNetworkConnector`), and can enable `--additional-os-capabilities '[
Instruction hijack surface	0 (none)	No file tells the agent to ignore its rules or follow remote instructions; the scan hits are ordinary commands rather than prompt injection.
Irreversible actions	3 (high)	The workflow can create images, run/suspend/resume/terminate MicroVMs, delete image versions, and enable auto-resume, so it can take destructive cloud actions without a human check.
Transparency	0 (none)	All supplied files are plain markdown; there are no binaries, minified blobs, or downloaded installers to hide behavior.

Before installing

Read `references/iam-and-security.md` and confirm the execution role only has permissions you are comfortable giving to code inside the MicroVM.
Decide whether default public egress is acceptable; if not, plan VPC egress connectors before running anything.
Verify you will not fetch or generate secrets during image build, because snapshots copy build-time state into every instance.
Test shell ingress and auth tokens in a throwaway account first, since the shell is full remote command execution inside the guest.

Rated 2026-10-14 by an automated review of 7 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/serverless-skills/aws-lambda-microvms/SKILL.md
Branch: main
Updated: 2026-09-19

aws-lambda-managed-instances — Evaluates, configures, and migrates workloads to AWS Lambda Managed Instances (LMI).
aws-security — Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries.
aws-serverless — Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK.
app-platform-sandbox — Create and manage isolated container sandboxes for AI agent code execution.
amazon-ses — Guides Amazon SES onboarding for domain-based email sending.
aurora-dsql — Provisions and manages Aurora DSQL clusters, connects via psql or DSQL Connectors, manages schemas, runs queries, migrates from MySQL, diagnoses query plans.