Skills Explorer Add Skills

exporting-rds-to-s3

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: analytics, database, migration, rds, s3.

What it does

Exports Amazon RDS or Aurora database snapshots to Amazon S3 in Apache Parquet format for analytics, backup, or data migration. Handles snapshot selection or creation, IAM role setup, KMS encryption, S3 bucket preparation, export task execution, progress monitoring, and data verification. Use when exporting RDS/Aurora data to S3 for Athena, Glue, or Redshift Spectrum consumption.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill exporting-rds-to-s3

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/database-skills/exporting-rds-to-s3 ~/.claude/skills/exporting-rds-to-s3

Safety box score

Grade C, moderate risk: 44 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill orchestrates Amazon RDS/Aurora snapshot export to S3, including snapshot selection or creation, IAM role/policy setup, KMS checks, export monitoring, and S3 verification. Its main blast radius is AWS-side account and data changes: it can create IAM resources, launch export jobs, and its cleanup guidance can delete snapshots and exported objects.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)It drives AWS CLI activity such as `aws rds start-export-task`, `create-db-snapshot`, and `describe-export-tasks`; this is command execution against AWS, though not arbitrary code execution or downloaded scripts.
Network access2 (moderate)The workflow sends authenticated requests to multiple remote AWS services (`rds`, `s3api`, `iam`, `kms`, `glue`, `cloudwatch`) and moves snapshot data to S3, which inherently leaves the machine.
Filesystem reach1 (low)It writes local artifacts like `rds-export-report-${export_task_id}.md` and policy JSON files via `file://trust-policy.json`, `file://export-policy.json`, and `file://lifecycle.json`, but only in the working area.
Secrets & credentials1 (low)The skill does not ask for passwords or read secret stores, but it operates on authenticated AWS credentials and KMS/IAM identifiers; there is no direct secret-store access shown.
Privilege & persistence2 (moderate)It creates, tags, and attaches IAM roles/policies (`aws iam create-role`, `create-policy`, `attach-role-policy`), which changes AWS account permissions even though it does not require local sudo.
Instruction hijack surface0 (none)I found no hidden instructions, remote-content fetching, or guidance to ignore confirmations or hide behavior; the document mainly gives normal procedural steps.
Irreversible actions3 (high)Its purpose includes launching exports and its cleanup guidance can irreversibly remove data (`aws s3 rm --recursive`, `aws rds delete-db-snapshot`, `aws rds delete-db-cluster-snapshot`), which is broad and potentially destructive.
Transparency0 (none)The skill files are plain markdown with readable commands and no binaries, minified blobs, or runtime-decoded code.

Before installing

Rated 2026-10-19 by an automated review of 2 files from the skill's repository.

Source

Repository
aws/agent-toolkit-for-aws (all skills from this repository)
Path
skills/specialized-skills/database-skills/exporting-rds-to-s3/SKILL.md
Branch
main
Updated
2026-09-19