launching-ec2-instance-with-best-practices

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: cloud, cost-optimization, deployment, ec2, security.

What it does

Launches an EC2 instance with secure, cost-efficient defaults including AMI selection, burstable instance sizing, least-privilege IAM roles, hardened security groups, encrypted EBS volumes, and comprehensive tagging. Use when deploying new EC2 instances following AWS best practices for security and cost optimization.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill launching-ec2-instance-with-best-practices

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/ec2-skills/launching-ec2-instance-with-best-practices ~/.claude/skills/launching-ec2-instance-with-best-practices

Safety box score

Grade D, elevated risk: 65 of 100 risk points, rated 2026-10-14. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a procedure skill for provisioning EC2 infrastructure with AWS CLI: it can create instances, IAM roles, security groups, key pairs, and post-launch reports. The main risks are broad account-level changes, secret-bearing SSH key handling, and a few external network downloads/queries during setup.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It directs many shell/AWS CLI actions such as `aws ec2 run-instances`, `aws iam create-role`, and `sudo dnf update -y`, but it does not ship a native script or evaluate arbitrary code.
Network access	2 (moderate)	It talks to AWS APIs throughout and also reaches out to external hosts, including `wget https://s3.amazonaws.com/...amazon-cloudwatch-agent.rpm` and `curl ifconfig.me`.
Filesystem reach	2 (moderate)	It reads and writes local and system files such as `file://~/.ssh/id_rsa.pub`, `${key_pair_name}.pem`, and edits `/etc/ssh/sshd_config` and `/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json`.
Secrets & credentials	2 (moderate)	It generates and stores SSH private key material with `aws ec2 create-key-pair ... > ${key_pair_name}.pem` and uses that private key for Windows password retrieval via `--priv-launch-key file://${key_pair_name}.pem`.
Privilege & persistence	3 (high)	It creates and attaches IAM roles and instance profiles (`aws iam create-role`, `create-instance-profile`, `attach-role-policy`) and instructs privileged OS changes like editing `/etc/ssh/sshd_config` and enabling services.
Instruction hijack surface	0 (none)	No prompt-injection, hidden instructions, or attempts to override safety rules were found; the document is operational and asks for confirmation before launch.
Irreversible actions	3 (high)	Its purpose is to provision and configure infrastructure, with commands to create EC2 resources and even destroy them later via `aws ec2 terminate-instances`.
Transparency	2 (moderate)	It downloads an external installer at runtime (`wget https://s3.amazonaws.com/...amazon-cloudwatch-agent.rpm`), so part of what executes is not inspectable from the skill files alone.

Before installing

Confirm the agent may create EC2, IAM, security-group, and key-pair resources in your AWS account.
Review the key-pair flow and make sure `${key_pair_name}.pem` will be stored securely and never committed.
Decide whether you are comfortable with the external downloads and public-IP lookup (`wget ...amazon-cloudwatch-agent.rpm`, `curl ifconfig.me`).

Rated 2026-10-14 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/ec2-skills/launching-ec2-instance-with-best-practices/SKILL.md
Branch: main
Updated: 2026-09-19

setting-up-ec2-instance-profiles — Configures EC2 instances to securely call AWS services by creating and attaching IAM roles via instance profiles, eliminating hardcoded credentials.
agents-deploy — Use when deploying your agent to AWS, or when a deploy has failed.
agents-harden — Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle.
agents-pay — Use when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments.
aws-ai-ml — Selects, deploys, and customizes AI models on Amazon SageMaker.
aws-billing-and-cost-management — Analyze AWS costs, find savings, manage budgets, evaluate Savings Plans and Reserved Instances, right-size EC2/Lambda/RDS/EBS with Compute Optimizer.