Skills Explorer Add Skills

creating-amazon-aurora-db-cluster-with-instances

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aurora, cloud, database, deployment, setup.

What it does

Creates a complete Amazon Aurora database cluster with instances, handling cluster creation, instance provisioning, and Secrets Manager password management in the proper sequence. Use when setting up new Aurora MySQL or PostgreSQL clusters with production-ready configuration.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill creating-amazon-aurora-db-cluster-with-instances

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/database-skills/creating-amazon-aurora-db-cluster-with-instances ~/.claude/skills/creating-amazon-aurora-db-cluster-with-instances

Safety box score

Grade C, moderate risk: 30 of 100 risk points, rated 2026-10-15. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill provisions an Amazon Aurora cluster and a database instance in the user’s AWS account, then polls AWS until both are available. The main risks are cloud-side autonomy/cost, repeated API traffic to AWS, and handling of Secrets Manager-managed database credentials.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)It drives AWS CLI operations through `call_aws` (`aws sts get-caller-identity`, `aws rds create-db-cluster`, `aws rds create-db-instance`, `aws rds describe-db-*`), so it executes commands, though only against the AWS API surface.
Network access2 (moderate)It sends requests to AWS for identity checks, provisioning, status polling, and endpoint retrieval, so outbound network traffic is inherent to the skill (`get-caller-identity`, `create-db-cluster`, `describe-db-clusters`, `describe-db-instances`).
Filesystem reach0 (none)No file reads, writes, deletes, or edits outside the repo are described; the skill is entirely cloud-API driven.
Secrets & credentials1 (low)It uses `--manage-master-user-password` and AWS Secrets Manager, but explicitly says not to retrieve or display the password value; the main exposure is secret metadata/ARN handling.
Privilege & persistence0 (none)There is no sudo, service installation, shell startup modification, or other local privilege change; the only elevated access is AWS IAM permissions.
Instruction hijack surface0 (none)The files do not instruct the agent to ignore higher-level rules, hide actions, or follow remote content; the `MUST` wording is procedural, not prompt injection.
Irreversible actions3 (high)The skill directly provisions live AWS resources and waits for them to become available (`create-db-cluster`, `create-db-instance`), which is a high-blast-radius deployment action and can incur charges.
Transparency0 (none)There are no binaries, base64 blobs, downloaded installers, or unreadable artifacts; the skill is plain markdown.

Before installing

Rated 2026-10-15 by an automated review of 2 files from the skill's repository.

Source

Repository
aws/agent-toolkit-for-aws (all skills from this repository)
Path
skills/specialized-skills/database-skills/creating-amazon-aurora-db-cluster-with-instances/SKILL.md
Branch
main
Updated
2026-09-19