aws-resilience-lifecycle

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, multi-service, resilience, strategy, testing.

What it does

Guides the end-to-end AWS resilience lifecycle integrating Resilience Hub v2, Fault Injection Service, and Application Recovery Controller. Covers the Define → Test → Operate workflow: from policy creation through failure mode assessment, to FIS experiment validation, to ARC operational controls. Applicable when the user wants a complete resilience strategy, needs to connect findings to experiments to controls, or is planning a resilience program. Also applicable for the meta question of whether marking NGRH findings as resolved is enough, whether they are "done" after resolving findings, or how to validate findings before resolving them. Not applicable for resolving or remediating a specific individual finding (see resilience-hub-failure-mode-assessment), or when a single service is explicitly named (e.g. "what FIS experiment should I run").

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill aws-resilience-lifecycle

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/resilience-skills/aws-resilience-lifecycle ~/.claude/skills/aws-resilience-lifecycle

Safety box score

Grade C, moderate risk: 39 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill orchestrates AWS Resilience Hub v2, FIS, and ARC through live AWS CLI/API calls, including assessment updates, destructive fault-injection experiments, and traffic-routing changes. The main risks are high-blast-radius cloud operations and accidental exposure of architecture details in logs, reports, or CloudTrail.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	The skill is command-oriented and repeatedly shows AWS CLI invocations such as `aws fis start-experiment`, `aws resiliencehubv2 update-failure-mode-finding`, and ARC routing-control updates; it ships no native scripts, but it clearly drives shell execution.
Network access	2 (moderate)	It performs many remote AWS API calls and can send experiment logs, assessment reports, and state changes to AWS services like CloudWatch, S3, and CloudTrail; there are no arbitrary internet downloads.
Filesystem reach	0 (none)	The supplied files do not read, write, or delete local user files or dotfiles; references to local install paths are descriptive only.
Secrets & credentials	1 (low)	It does not ask for credentials or key files, but it explicitly warns not to place PII or secrets in comments, descriptions, or report names because those values surface in logs, reports, and CloudTrail.
Privilege & persistence	1 (low)	There is no sudo, service installation, or shell/OS reconfiguration; the elevated access is in AWS IAM permissions for resilience operations rather than local machine privilege.
Instruction hijack surface	0 (none)	No hidden prompt-injection content or instructions to ignore safeguards are present in the shipped files.
Irreversible actions	3 (high)	The skill can orchestrate destructive FIS experiments and live failover actions, including `start-experiment`, routing-control state changes, and resolving findings after validation, so its operational blast radius is high.
Transparency	1 (low)	All provided files are readable markdown, but the workflow delegates mutating work to companion skills (`resilience-hub-getting-started`, `fault-injection-experiment-design`, `recovery-controller-setup`) that are not included in this bundle.

Before installing

Verify the companion skills named in `references/lifecycle-workflow.md` are also installed and reviewed.
Plan to run this only with a tightly scoped AWS role in a sandbox or non-production account first.
Confirm you will not paste secrets or internal architecture details into experiment descriptions, comments, or report names.
Make sure your team accepts that this skill can trigger live FIS experiments and ARC routing changes.

Rated 2026-10-20 by an automated review of 4 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/resilience-skills/aws-resilience-lifecycle/SKILL.md
Branch: main
Updated: 2026-09-19

arc-region-switch — Answers questions about Amazon Application Recovery Controller (ARC) Region switch including architecture, plans, execution blocks, workflows, triggers.
resilience-hub-getting-started — Sets up AWS Resilience Hub v2 from scratch: creates resilience policies with SLO targets, registers systems and user journeys.
resilience-program-design — Designs a resilience program: how to structure and standardize resilience policies across an organization, team.
guidelines-advisor — Smart contract development advisor based on Trail of Bits' best practices.
recovery-controller-setup — Configures AWS Application Recovery Controller (ARC) for operational resilience: routing controls with safety rules for cross-Region failover.
resilience-hub-failure-mode-assessment — Runs and interprets AWS Resilience Hub v2 failure mode assessments.