migrate-to-msk

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: analysis, aws, kafka, migration, performance.

What it does

Helps migrate self-managed Apache Kafka workloads to Amazon MSK Express. Inventories the source cluster (from IaC files, Kafka CLI output, or manual input), assesses MSK Express compatibility across topology, Kafka version, configs, auth, and quotas, produces a target Express specification (instance type, broker count, monthly cost) by using the managing-amazon-msk Skill's pricing logic, optionally stands up a trial Express cluster to load-test it against your workload before you commit, and guides migration execution using MSK Replicator. Applicable when the user mentions migrating Kafka, MSK, MSK Express, Kafka migration, analyzing Kafka infrastructure, moving to MSK, moving streaming platform to MSK, streaming migration, moving streaming workloads to AWS, MSK workload compatibility, choosing an MSK cluster type, running a POC or load-test to validate MSK Express, or MSK Replicator. Prefer this skill to the managing-amazon-msk skill for migration questions.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill migrate-to-msk

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/analytics-skills/migrate-to-msk ~/.claude/skills/migrate-to-msk

Safety box score

Grade D, elevated risk: 51 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill inventories Kafka clusters, writes migration artifacts, and can optionally run a simulation that creates and tears down AWS infrastructure in the customer’s account. The main risks are remote cloud-side changes, local execution of shipped Python scripts, and sensitive configuration data being written to working-directory artifacts.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It runs bundled Python scripts with `uv run` (`scripts/compatibility.py`, `scripts/simulation_load_test_config.py`) and invokes shell commands for AWS operations, but the scripts are deterministic and not downloaded code.
Network access	3 (high)	The simulation flow sends commands to AWS services (`aws sts`, `aws cloudformation`, `aws ssm`, `aws ec2`) and the sizing flow can use AWS pricing/documentation lookups, so it has broad remote network reach.
Filesystem reach	1 (low)	It writes artifacts only under `migrate-to-msk-skill-artifacts/<cluster_name>/` and can render a local template there; the local filesystem impact is bounded.
Secrets & credentials	1 (low)	The discovery and assessment artifacts can carry broker addresses, auth hints, and other sensitive cluster details, but the skill does not read keychains or require the user to paste passwords.
Privilege & persistence	2 (moderate)	The simulation path uses CloudFormation with `--capabilities CAPABILITY_IAM`, so it can create IAM-capable AWS resources in the customer’s account, though it does not request local sudo or shell-profile changes.
Instruction hijack surface	0 (none)	I found no prompt-injection style instructions to ignore policies, hide behavior, or follow remote instructions; the text is mostly ordinary guardrails and confirmation checks.
Irreversible actions	3 (high)	It can provision, test, and delete AWS infrastructure on the user’s behalf, including `create-stack`, `send-command`, and `delete-stack`, which is a high-blast-radius autonomous action set.
Transparency	1 (low)	One shipped asset, `assets/simulation-stack.yaml`, could not be read in this review (`size or budget`), so part of the deployment surface is opaque.

Before installing

Read `references/simulation.md` if you may use the simulation phase; it can create and later delete AWS resources.
Verify you’re comfortable with the skill writing artifacts under `migrate-to-msk-skill-artifacts/<cluster_name>/`.
Confirm the AWS account and region permissions for CloudFormation, SSM, and EC2 before letting the agent run it.
Inspect `assets/simulation-stack.yaml` separately if the deployment template matters; it was not readable in this review.

Rated 2026-10-19 by an automated review of 7 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/analytics-skills/migrate-to-msk/SKILL.md
Branch: main
Updated: 2026-09-19

amazon-neptune — Provides authoritative guidance on Amazon Neptune Database and Neptune Analytics for graph, knowledge-graph.
aws-transform — Performs code upgrades, migrations, and transformations using the AWS Transform (ATX) CLI.
managing-amazon-msk — Operates Amazon MSK Provisioned clusters (Standard and Express brokers).
aws-storage — Selects, investigates, and compares AWS object, file, and block storage services, and answers cost, performance, configuration, security.
launch-with-aws — Migrates vibe-coded web applications to AWS.
coverage-analysis — Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output.