aws-network-monitoring

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, ec2, monitoring, networking, troubleshooting.

What it does

Installs, configures, and troubleshoots Network Flow Monitor agents on EC2 instances to monitor network path health. Covers agent installation, IAM permissions, monitoring network paths, and troubleshooting agents reporting no metrics, HTTP 403 errors, or connectivity failures.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill aws-network-monitoring

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/operations-skills/aws-network-monitoring ~/.claude/skills/aws-network-monitoring

Safety box score

Grade D, elevated risk: 53 of 100 risk points, rated 2026-10-17. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill installs and manages AWS Network Flow Monitor agents on EC2 using SSM, `sudo` package installs, and AWS IAM/SSM commands. The main risks are broad operational reach across instances, system-level changes on the host, and opaque vendor package downloads from AWS URLs.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It runs administrative commands and installs software with `aws ssm send-command`, `sudo yum install`, and `sudo apt-get install`, which execute package-manager and service actions on the host.
Network access	2 (moderate)	It downloads packages from `https://networkflowmonitoragent.awsstatic.com/...` and probes AWS service endpoints with `curl`/`nc`, so it sends traffic to external hosts.
Filesystem reach	1 (low)	The skill mostly installs packages and starts/stops services; it does not describe arbitrary file editing or deletion outside the project.
Secrets & credentials	1 (low)	It relies on the operator's existing AWS CLI/SSM/IAM credentials and instance roles, but it does not ask to paste or store raw secrets.
Privilege & persistence	3 (high)	It explicitly uses root/admin operations such as `sudo yum install`, `sudo apt-get install`, and `sudo service network-flow-monitor stop/start/status`, which require elevated privileges and system-wide changes.
Instruction hijack surface	0 (none)	There is no instruction to ignore higher-priority rules, hide actions, or follow untrusted remote instructions.
Irreversible actions	2 (moderate)	It can apply, deactivate, or remove the agent across one or many instances with `aws ssm send-command`, including tag-targeted bulk actions.
Transparency	2 (moderate)	It installs packages from remote URLs like `https://networkflowmonitoragent.awsstatic.com/latest/...` whose contents are not visible in the skill files.

Before installing

Read `references/agent-install-ec2.md` and choose SSM Distributor vs. direct package install before running anything.
Confirm the target instance role already has only the intended IAM policies: `AmazonSSMManagedInstanceCore` and `CloudWatchNetworkFlowMonitorAgentPublishPolicy`.
Try the workflow on one non-production instance first, especially before using tag-based `aws ssm send-command` targets.
Decide whether you trust the remote package URLs on `networkflowmonitoragent.awsstatic.com` and whether the instance has the required outbound AWS network path.

Rated 2026-10-17 by an automated review of 4 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/operations-skills/aws-network-monitoring/SKILL.md
Branch: main
Updated: 2026-09-19

troubleshooting-efs — Diagnoses and resolves Amazon EFS issues including mount failures, NFS timeouts, permission errors, throughput problems, and burst credit exhaustion.
debugging-network-issues — Investigates network, streaming, and protocol failures with falsification-first layered experiments.
use-railway — Operate Railway infrastructure: sign up for or sign in to a Railway account, create projects, provision services, databases, and buckets, deploy code.
amazon-ses — Guides Amazon SES onboarding for domain-based email sending.
aws-cleanrooms — Troubleshoots and debugs AWS Clean Rooms collaboration issues related to IAM roles, S3 bucket policies, KMS keys, Lake Formation permissions.
configuring-vpc-endpoints-for-private-aws-service-access — Configures VPC endpoints (interface and gateway) for private AWS service access using AWS PrivateLink.