managing-amazon-msk

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, kafka, performance, streaming, troubleshooting.

What it does

Operates Amazon MSK Provisioned clusters (Standard and Express brokers). Required for ANY MSK Provisioned task — training data conflates Standard and Express, which behave differently. Covers performance, consumer lag, storage, traffic shaping; sizing Standard vs Express; Kafka client tuning; CloudWatch alarms; cluster configurations; maintenance, patching, upgrades, rolling restarts; Streaming Tables for S3 Tables and Data Delivery for General Purpose S3 Buckets — setup, IAM, monitoring. Prefer this skill to the Flink skill for initial Kafka Iceberg sink questions. Triggers: MSK Provisioned (Express/Standard), Kafka, `kafka.*` or `express.*` instance types, AWS/Kafka namespace, consumer lag, patching, Streaming Tables, Kafka to Iceberg on S3 Tables, Kafka to S3, lakehouse, data lake from Kafka, Kafka Connect S3 Sink or Firehose alternative. DO NOT USE for MSK Connect or Replicator — search documentation instead. Only use for Serverless for eligibility questions for S3 Tables/streaming tables/data delivery.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill managing-amazon-msk

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/analytics-skills/managing-amazon-msk ~/.claude/skills/managing-amazon-msk

Safety box score

Grade D, elevated risk: 51 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is an AWS control-plane operator for Amazon MSK Provisioned/Express clusters. It can create, update, and delete topics, channels, cluster configs, and storage, so the main risk is destructive cloud-side changes and service-impacting rollouts rather than local machine impact. One required helper script could not be inspected here, and one reference depends on live AWS docs at runtime.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It explicitly says to "Execute commands using available tools from the AWS MCP server" and to "fall back to the AWS CLI or shell," and it mandates running `python3 scripts/msk_sizing.py` for sizing questions.
Network access	2 (moderate)	The skill drives AWS APIs and may use the live AWS Pricing API, so it sends operational data and configs off-machine; e.g. `scripts/msk_sizing.py` uses the "live AWS Pricing API" when credentials are available.
Filesystem reach	1 (low)	It mostly works in the user's working directory and local skill files, with examples like `fileb://custom-domain-config.txt`; there is no indication of broad home-directory or system-file modification.
Secrets & credentials	2 (moderate)	It configures and associates secret-backed auth, including SCRAM `secretArn` handling and client auth settings (`security.protocol=SASL_SSL`), but it does not ask the user to paste raw secrets into the prompt.
Privilege & persistence	0 (none)	No sudo, service registration, shell startup edits, or OS-level privilege changes are described.
Instruction hijack surface	1 (low)	`references/zk-to-kraft-migration.md` requires the agent to "read and cite the Amazon MSK migration Developer Guide at response time," creating a dependency on external live content.
Irreversible actions	3 (high)	The skill can directly create, update, and delete live MSK resources; the docs include `aws kafka delete-topic`, `aws kafka delete-channel`, and `aws kafka update-cluster-configuration`, all of which can irreversibly change production systems.
Transparency	2 (moderate)	The mandatory `scripts/msk_sizing.py` could not be read in this review, yet `SKILL.md` says it is required for any sizing question, leaving a core workflow opaque.

Before installing

Read `scripts/msk_sizing.py` or run it in a scratch account first; it is mandatory for sizing answers and was not reviewable here.
Confirm you are comfortable with live destructive actions like `delete-topic` and `delete-channel` before letting the agent use this skill on real clusters.
Check the IAM role the agent will use for MSK, Secrets Manager, KMS, CloudWatch, and Route 53 actions; the skill assumes broad AWS control-plane access.
If you need the ZooKeeper-to-KRaft workflow, verify the current AWS Developer Guide yourself because this skill defers to live external docs.

Rated 2026-10-20 by an automated review of 15 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/analytics-skills/managing-amazon-msk/SKILL.md
Branch: main
Updated: 2026-09-19

debugging-lambda-timeouts — Debugs AWS Lambda function timeout failures by systematically analyzing function configuration, CloudWatch logs and metrics, VPC/networking, cold starts.
managing-amazon-kinesis-data-streams — Operates Amazon Kinesis Data Streams (KDS).
migrate-to-msk — Helps migrate self-managed Apache Kafka workloads to Amazon MSK Express.
troubleshooting-efs — Diagnoses and resolves Amazon EFS issues including mount failures, NFS timeouts, permission errors, throughput problems, and burst credit exhaustion.
troubleshooting-s3-files — Diagnoses and resolves Amazon S3 Files issues including mount failures, permission errors, synchronization problems, and performance issues.
aws-compute — Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU.