Skills Explorer Add Skills

connecting-to-data-source

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: cloud, database, debugging, glue, jdbc.

What it does

Create and troubleshoot AWS Glue connections to JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS), Redshift, Snowflake, and BigQuery. Gathers connection hints from user, discovers existing connections and RDS/Redshift candidates, registers credentials in Secrets Manager or IAM DB auth, configures VPC, and tests. Triggers on: connect to database, set up Glue connection, register data source, connect to Snowflake/BigQuery/RDS, connection timeout, test connection, troubleshoot connection. Do NOT use for moving data (use ingesting-into-data-lake), creating tables (use creating-data-lake-table), queries (use querying-data-lake), catalog exploration (use exploring-data-catalog), or SaaS (Salesforce, ServiceNow, SAP, MongoDB, Kafka).

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill connecting-to-data-source

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-data-analytics/skills/connecting-to-data-source ~/.claude/skills/connecting-to-data-source

Safety box score

Grade D, elevated risk: 51 of 100 risk points, rated 2026-10-15. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill sets up AWS Glue connections to databases and data warehouses, and it can also create related AWS resources like Secrets Manager secrets, VPC endpoints, and test Glue jobs. The main risks are exposure of credentials and broad account-side changes to network and access configuration; it does not appear to touch the local machine deeply.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)It explicitly runs AWS CLI commands and creates a Glue smoke-test job that executes Python in AWS: `aws glue create-job` and `aws glue start-job-run`.
Network access2 (moderate)It can alter connectivity for private sources via `aws ec2 create-vpc-endpoint`, VPC/subnet routing, security groups, and may require internet egress to Google/Snowflake endpoints.
Filesystem reach1 (low)Most work is remote, but the BigQuery and troubleshooting docs write/read local files temporarily, e.g. `base64 -i <service-account>.json ... > sa.b64` and `rm sa.b64`.
Secrets & credentials3 (high)It handles credentials directly and can create or inspect Secrets Manager secrets for JDBC, Snowflake, and BigQuery, including `aws secretsmanager get-secret-value` in troubleshooting.
Privilege & persistence2 (moderate)It drives account-level AWS changes such as Glue connections, Secrets Manager secrets, VPC endpoints, and IAM-scoped database access like `rds-db:connect`.
Instruction hijack surface0 (none)No hidden text, prompt-injection, or instructions to ignore safeguards were found; it actually requires user confirmation before creating a new secret.
Irreversible actions2 (moderate)Its purpose is to create and test reusable Glue connections and related resources, which are meaningful account changes even though they are normally bounded and user-confirmed.
Transparency0 (none)All referenced files are plain markdown and command snippets; no binaries, packed payloads, or decoded-at-runtime code were present.

Before installing

Rated 2026-10-15 by an automated review of 8 files from the skill's repository.

Source

Repository
aws/agent-toolkit-for-aws (all skills from this repository)
Path
plugins/aws-data-analytics/skills/connecting-to-data-source/SKILL.md
Branch
main
Collection
aws-data-analytics
Updated
2026-09-19