creating-api-gateway-stage

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: api-gateway, aws, deployment, monitoring, security.

What it does

Creates an API Gateway stage with CloudWatch logging, X-Ray tracing, throttling, WAF integration, and IAM roles following AWS best practices. Use when deploying a REST API to different environments such as dev, test, or production.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill creating-api-gateway-stage

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/serverless-skills/creating-api-gateway-stage ~/.claude/skills/creating-api-gateway-stage

Safety box score

Grade D, elevated risk: 46 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill provisions and configures AWS API Gateway stages, plus related CloudWatch, IAM, and WAF resources. The main risk is broad AWS-side blast radius: it can publish stage changes, alter account-level logging settings, and create or attach security policies that affect live traffic.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It repeatedly instructs the agent to run AWS operations via `call_aws`, e.g. `aws apigateway create-stage`, `aws iam create-role`, and `aws wafv2 associate-web-acl`.
Network access	2 (moderate)	The skill makes many outbound AWS API calls for API Gateway, IAM, CloudWatch, and WAF, and it can send logs and metrics to remote AWS services.
Filesystem reach	0 (none)	The reviewed files do not read, write, or delete local files or dotfiles; the only storage touched is AWS-side resources like log groups.
Secrets & credentials	1 (low)	It does not directly read credential stores, but it does reference sensitive configuration handling and says `MUST use SecretsManager for any sensitive configuration values`.
Privilege & persistence	3 (high)	It creates an IAM service role and changes account-level API Gateway settings with `aws iam create-role`, `aws iam attach-role-policy`, and `aws apigateway update-account`.
Instruction hijack surface	0 (none)	No hidden instructions, remote-prompt fetching, or attempts to override the agent's rules were found in the skill text.
Irreversible actions	3 (high)	The skill directly provisions and publishes AWS infrastructure changes, including `create-stage`, `update-stage`, and WAF association, which can affect a live API without further human checks.
Transparency	0 (none)	The skill content is plain Markdown; there are no binaries, base64 blobs, downloaded installers, or unreadable code paths.

Before installing

Read `references/create-api-gateway-stage.md` and confirm you are comfortable with account-level IAM and API Gateway changes.
Test it in a non-production AWS account first; it creates stages, log groups, and optionally a WAF ACL.
Verify who can approve the `aws iam create-role` and `aws apigateway update-account` steps before using it on a shared account.
Check whether the stage should be public or protected, because the skill can enable logging, tracing, and WAF but does not enforce a specific auth mode.

Rated 2026-10-20 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/serverless-skills/creating-api-gateway-stage/SKILL.md
Branch: main
Updated: 2026-09-19

aws-serverless — Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK.
securing-s3-buckets — Create and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation of misconfigurations.
aws-security — Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries.
launch-with-aws — Migrates vibe-coded web applications to AWS.
eas-update-insights — EAS service (paid). Check the health of published EAS Update: crash rates, install/launch counts, unique users, payload size.
seo-drift — SEO drift monitoring: capture baselines of SEO-critical elements, detect changes, and track regressions over time.