aws-observability

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: analytics, cloud, logs, performance, troubleshooting.

What it does

Builds, configures, debugs, and optimizes AWS observability with CloudWatch (Log Insights, Metrics, Alarms, Dashboards, EMF), X-Ray, CloudTrail, and ADOT (AWS Distro for OpenTelemetry), AND enables/onboards services to Application Signals using ADOT auto-instrumentation SDKs. Covers Log Insights queries, alarms (metric, composite, anomaly), dashboards, custom metrics/EMF, X-Ray tracing and sampling, ADOT collector config, CloudTrail auditing, and end-to-end Application Signals enablement via ADOT SDKs (CloudWatch Observability EKS add-on, CloudWatch Agent IAM, OTLP endpoints, ServiceEvents, Dynamic Instrumentation), breakpoint and snapshot in Dynamic Instrumentation, live data capture in running service, debug without redeploying. Applies to CloudWatch, alarms, dashboards, EMF, X-Ray, traces, CloudTrail, ADOT, monitoring, synthetics/canaries, OR enabling/onboarding/instrumenting a service for Application Signals. Not for app logging or security threat detection.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill aws-observability

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-core/skills/aws-observability ~/.claude/skills/aws-observability

Safety box score

Grade D, elevated risk: 54 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is an AWS observability operator: it queries live CloudWatch/Omni data and can create, update, or delete AWS monitoring and tracing resources. The main risks are remote side effects in the AWS account, exposure of sensitive telemetry/snapshot data, and a few important unread files that limit full review coverage.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It ships real Python tooling (`scripts/cloudwatch/di_*.py`) that builds boto3 clients and invokes AWS operations such as `start_query` and `create_instrumentation_configuration`.
Network access	3 (high)	It routinely sends requests to remote AWS endpoints for CloudWatch, CloudTrail, Synthetics, API Gateway, and Omni; the skill is built around live AWS API calls and queries.
Filesystem reach	1 (low)	Its local file touch is bounded to artifacts like snapshot outputs (`--out /tmp/snaps.json`) and explicit cleanup guidance, with no broad local traversal or deletion.
Secrets & credentials	2 (moderate)	Snapshot docs warn that captured data may contain "credentials, PII, or secrets," and the OTEL config warns telemetry itself may carry request payloads.
Privilege & persistence	0 (none)	I found no sudo, service registration, shell startup edits, or global installs shipped here; the skill uses AWS clients/CLI but does not need local privilege changes.
Instruction hijack surface	1 (low)	The skill uses strong directive language like "This skill owns the scope decision" and "Do NOT stall on a Region/Space clarifying question," but I found no hidden text or jailbreak-style payloads.
Irreversible actions	3 (high)	It can create/update/delete AWS observability resources and live instrumentation, including alarms, canaries, event selectors, tracing settings, and instrumentation configs.
Transparency	2 (moderate)	Several core files were not readable in this review, including `scripts/cloudwatch/di_instrumentation.py`, `di_snapshots.py`, and multiple Omni reference files, so the full blast radius is not completely visible.

Before installing

Read `references/cloudwatch/dynamic-instrumentation/snapshot-parsing.md` and decide where snapshot files will live, because they may contain secrets or PII.
Open the unread entry scripts (`scripts/cloudwatch/di_instrumentation.py`, `scripts/cloudwatch/di_snapshots.py`, `scripts/cloudwatch/di_crud_tools.py`) before trusting any live-account writes.
Confirm your AWS principal is allowed to create/modify alarms, canaries, tracing settings, and instrumentation configs in the target account.
If you plan to use dynamic instrumentation, verify the target log group is KMS-encrypted and that the OTLP ports are restricted in your environment.

Rated 2026-10-20 by an automated review of 29 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-core/skills/aws-observability/SKILL.md
Branch: main
Collection: aws-core
Updated: 2026-09-19

aws-billing-and-cost-management — Analyze AWS costs, find savings, manage budgets, evaluate Savings Plans and Reserved Instances, right-size EC2/Lambda/RDS/EBS with Compute Optimizer.
aws-compute — Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU.
investigating-incidents-with-aws-devops-agent — Run a deep root-cause investigation on the AWS DevOps Agent.
app-platform-troubleshooting — Debug running App Platform applications by accessing containers, analyzing logs, running diagnostics, and applying fixes.
debugging-wizard — Parses error messages, traces execution flow through stack traces, correlates log entries to identify failure points.
spark-engineer — Use when writing Spark jobs, debugging performance issues, or configuring cluster settings for Apache Spark applications.