managing-amazon-kinesis-data-streams

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, data, kinesis, streaming, troubleshooting.

What it does

Operates Amazon Kinesis Data Streams (KDS). Covers streaming tables and Amazon S3 delivery - serverless, fully managed delivery from a KDS stream to Apache Iceberg tables on S3 Tables or to general-purpose S3 buckets. Includes channel setup, IAM, schemas, output key templates, CloudWatch metrics and alarms, DLQ handling, quotas, and troubleshooting. For all other KDS topics and questions, search AWS documentation and blogs instead. Triggers: Kinesis Data Streams, KDS, streaming tables, stream to S3, stream to Iceberg, stream to S3 Tables, KDS delivery, KDS channel, CreateChannel, data channel, data freshness, dead-letter queue, KDS lakehouse, serverless Kinesis delivery, Firehose alternative for KDS, zero-ops Kinesis to S3. DO NOT USE for Kinesis Data Firehose, Kinesis Video Streams, or Managed Service for Apache Flink — use dedicated skills or search documentation instead.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill managing-amazon-kinesis-data-streams

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/analytics-skills/managing-amazon-kinesis-data-streams ~/.claude/skills/managing-amazon-kinesis-data-streams

Safety box score

Grade C, moderate risk: 28 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill operates Amazon Kinesis Data Streams delivery channels and the supporting AWS resources around them. The main risks are broad cloud-side changes: creating and deleting channels, buckets, schemas, and log groups, plus the possibility of delivery gaps because channels have no backfill and some changes require recreate/delete.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	The skill includes runnable AWS CLI commands and a Python GSR serializer example, such as `aws kinesis create-channel` and `session.client("kinesis").put_record(...)`, so an agent can execute real commands/code against AWS.
Network access	2 (moderate)	Its commands contact remote AWS services (`kinesis`, `s3`, `s3tables`, `glue`, `logs`, `lakeformation`) and can transmit stream payloads, logs, and metadata off-machine to AWS.
Filesystem reach	1 (low)	It writes local helper files with `cat > s3-dest.json`, `stream-config.json`, `s3-tables-dest.json`, and `logging.json`, but only in the working directory.
Secrets & credentials	0 (none)	The files do not read, reveal, or request secret values, keychains, or token files; they only assume the user already has AWS access configured.
Privilege & persistence	0 (none)	No sudo, service installation, shell/profile editing, scheduled tasks, or OS-level setting changes appear in the skill files.
Instruction hijack surface	0 (none)	There is no hidden text or instruction to ignore safeguards, follow fetched instructions, or otherwise subvert the agent's rules.
Irreversible actions	3 (high)	It provisions and deletes live AWS delivery infrastructure with `create-channel`, `update-channel`, and `delete-channel`; these are impactful cloud actions and deletion can disrupt delivery.
Transparency	0 (none)	All files are plain markdown with visible code blocks; there are no binaries, obfuscated blobs, or unreviewable installers.

Before installing

Read the `create-channel` and `delete-channel` examples first; they create and remove live AWS delivery resources.
Test in a throwaway or nonproduction AWS account because the skill can create buckets, schemas, log groups, and channels.
Confirm your stream is `ON_DEMAND` and all destinations are in the same Region before running it.
Check whether you are okay with the skill writing local files like `s3-dest.json` and `stream-config.json` in the working directory.

Rated 2026-10-19 by an automated review of 4 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/analytics-skills/managing-amazon-kinesis-data-streams/SKILL.md
Branch: main
Updated: 2026-09-19

managing-amazon-msk — Operates Amazon MSK Provisioned clusters (Standard and Express brokers).
creating-data-lake-table — Create managed Iceberg tables using Amazon S3 Tables (s3tables API namespace) with automatic compaction and snapshot management.
amazon-ses — Guides Amazon SES onboarding for domain-based email sending.
aws-cleanrooms — Troubleshoots and debugs AWS Clean Rooms collaboration issues related to IAM roles, S3 bucket policies, KMS keys, Lake Formation permissions.
aws-network-monitoring — Installs, configures, and troubleshoots Network Flow Monitor agents on EC2 instances to monitor network path health.
debugging-lambda-timeouts — Debugs AWS Lambda function timeout failures by systematically analyzing function configuration, CloudWatch logs and metrics, VPC/networking, cold starts.