Skills Explorer Add Skills

processing-s3-uploads-with-step-functions

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: automation, aws, s3, serverless, step-functions.

What it does

Deploy an event-driven workflow that routes S3 uploads to either Lambda or Fargate via Step Functions based on file size. Uses EventBridge to trigger a Step Functions state machine when objects are uploaded to S3. Small files are processed by Lambda, large files by a Fargate task. Includes VPC, ECR repository, ECS cluster, and scoped IAM roles. Trigger keywords: Step Functions, Fargate, Lambda, S3 event, EventBridge, ECS, ECR, file processing, workflow orchestration, serverless.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill processing-s3-uploads-with-step-functions

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/serverless-skills/processing-s3-uploads-with-step-functions ~/.claude/skills/processing-s3-uploads-with-step-functions

Safety box score

Grade C, moderate risk: 39 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill deploys a fairly large AWS serverless pipeline: it creates IAM roles, a VPC-backed Fargate workflow, Lambda, Step Functions, EventBridge, S3, and an ECR image, then uploads a test object to trigger it. The main risks are broad account-level changes, public internet exposure for the Fargate task, and use of the installer’s existing AWS credentials to authenticate to ECR and create resources.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)It executes build and packaging steps, including `docker build` and `python3 -c ... zipfile...`, and the Dockerfile runs `pip install --no-cache-dir --require-hashes -r /tmp/requirements.txt`.
Network access2 (moderate)It talks to AWS services throughout and publishes a container image with `aws ecr get-login-password ... | docker login ...`; the Fargate task is also configured with `
Filesystem reach1 (low)It writes and deletes temporary files under `/tmp` (for example `/tmp/lambda_function.zip` and the downloaded S3 object), but does not edit user dotfiles or system paths.
Secrets & credentials2 (moderate)It depends on the installer’s existing AWS CLI credentials and turns them into an ECR login token with `aws ecr get-login-password --region {region} | docker login ...`.
Privilege & persistence0 (none)There is no sudo use, no global software installation, and no service or shell-setting changes.
Instruction hijack surface0 (none)The skill does not instruct the agent to ignore safeguards, hide actions, or follow remote instructions; it instead asks for confirmation and abort options.
Irreversible actions3 (high)It inherently creates and activates cloud infrastructure and then triggers it (`aws iam create-role`, `aws ecs create-cluster`, `aws stepfunctions create-state-machine`, `aws s3 cp ...`), so the blast radius is high even though it is the skill’s purpose.
Transparency0 (none)All shipped files are plain text and readable; the Docker image uses a pinned base image digest and hash-pinned Python dependencies.

Before installing

Rated 2026-10-19 by an automated review of 12 files from the skill's repository.

Source

Repository
aws/agent-toolkit-for-aws (all skills from this repository)
Path
skills/specialized-skills/serverless-skills/processing-s3-uploads-with-step-functions/SKILL.md
Branch
main
Updated
2026-09-19