creating-data-lake-table

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, data, database, glue, iceberg.

What it does

Create managed Iceberg tables using Amazon S3 Tables (s3tables API namespace) with automatic compaction and snapshot management. Sets up table bucket, namespace, table, schema, Glue catalog registration, partitioning, IAM access control. Triggers on: create table, data lake table, analytics table, structured data storage, S3 Tables, Iceberg, Athena table, partitioning strategy, access permissions. Do NOT use for: importing files (use ingesting-into-data-lake), vector storage (use storing-and-querying-vectors), querying existing tables (use querying-data-lake), or locating existing table (use finding-data-lake-assets).

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill creating-data-lake-table

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-data-analytics/skills/creating-data-lake-table ~/.claude/skills/creating-data-lake-table

Safety box score

Grade C, moderate risk: 33 of 100 risk points, rated 2026-10-18. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill provisions and configures Amazon S3 Tables/Iceberg resources through AWS CLI/Athena/Glue: table buckets, namespaces, Glue catalog registration, table creation, bucket policies, and query checks. The main risk is cloud-side access-control and resource-creation blast radius in the target AWS account; it does not ship local executables or touch local files.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It drives AWS CLI and Athena commands such as `aws s3tables create-table-bucket`, `aws glue create-catalog`, and `aws athena start-query-execution`, but ships no native scripts or code to execute locally.
Network access	2 (moderate)	The workflow makes authenticated calls to AWS services and Athena (`aws sts get-caller-identity`, S3 Tables/Glue APIs, `start-query-execution`), so schemas, ARNs, and table metadata leave the machine.
Filesystem reach	0 (none)	There is no evidence of reading, writing, or deleting files outside the repo; the skill is entirely cloud-API driven.
Secrets & credentials	1 (low)	It requires existing AWS credentials to run `aws sts get-caller-identity` and operate on IAM/KMS-related resources, but it does not ask for raw secret values or key material.
Privilege & persistence	2 (moderate)	It can change AWS access control via `aws s3tables put-table-bucket-policy`, `glue create-catalog`, and the Lake Formation migration guidance that can remove existing grants.
Instruction hijack surface	0 (none)	There is no prompt-injection style content telling the agent to ignore instructions, hide actions, or follow untrusted remote instructions.
Irreversible actions	2 (moderate)	Its purpose is to autonomously create and configure cloud resources and policies (`create-table-bucket`, `create-namespace`, `create-table`, catalog registration), which is a real but bounded account-level change.
Transparency	0 (none)	All provided files are plain Markdown; there are no binaries, installers, or decoded-at-runtime payloads.

Before installing

Verify the target AWS account/region and who owns the `s3tablescatalog` and table bucket you want this skill to touch.
Read the access-control sections first and decide whether you want the default `IAM_ALLOWED_PRINCIPALS` grants.
If Lake Formation is in use, confirm you are willing to risk a catalog migration that can remove existing grants.
Test in a scratch AWS account or empty region first, with the exact IAM/KMS permissions you expect to use.

Rated 2026-10-18 by an automated review of 5 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-data-analytics/skills/creating-data-lake-table/SKILL.md
Branch: main
Collection: aws-data-analytics
Updated: 2026-09-19

connecting-to-data-source — Create and troubleshoot AWS Glue connections to JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS), Redshift, Snowflake, and BigQuery.
exploring-data-catalog — Full inventory and audit of AWS Glue Data Catalog assets across S3 Tables, Redshift-federated, and remote Iceberg catalogs.
finding-data-lake-assets — Resolve data lake and lakehouse asset references across Glue Data Catalog, S3, S3 Tables, and Redshift.
ingesting-into-data-lake — Import data into the AWS data lake from S3 files, local uploads, JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS, Aurora), Amazon Redshift.
storing-and-querying-vectors — Store and query vector embeddings using Amazon S3 Vectors, a cost-effective long-term vector storage service with its own API namespace (s3vectors).
principle-model-the-domain — Apply when writing stateful logic, or when code branches a lot or repeats a shape assumption across files.