Skills Explorer Add Skills

rds-oss

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: database, deployment, mysql, postgresql, rds.

What it does

Advises on Amazon RDS open-source engines (MySQL, MariaDB, PostgreSQL) for instance creation, upgrade planning, commitment pricing, proxy evaluation, and Blue/Green deployments. Handles any RDS MySQL, MariaDB, or PostgreSQL question, including create a production-ready RDS MySQL instance, provision an RDS PostgreSQL database, run the RDS upgrade advisor for my RDS MySQL instance, what are my upgrade options, upgrade RDS MariaDB from 10.6 to the latest version, should I buy reserved instances or a savings plan for db.r7g.2xlarge RDS MySQL, change a VARCHAR to INT column on RDS MySQL 8.0 with Blue/Green, and does RDS Proxy help when PgBouncer already runs in transaction mode. Covers instance creation with production best practices, describe-db-instances and describe-db-engine-versions upgrade-target workflow, live prechecks via SSM or direct connection, RI versus DSP commitment pricing, RDS Proxy versus PgBouncer, and Blue/Green lifecycle with binlog replay compatibility.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill rds-oss

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/database-skills/rds-oss ~/.claude/skills/rds-oss

Safety box score

Grade C, moderate risk: 37 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is an RDS operations advisor that reads live AWS metadata, pricing, and database state, and it can also provision a new RDS instance or Blue/Green deployment. The main risks are live network/API access, SSM-based remote command execution for prechecks, and handling Secrets Manager credentials; destructive or irreversible actions are mostly gated, but cleanup commands and resource creation are still exposed.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)It can drive command execution through AWS CLI and SSM templates, including `aws ssm send-command` that runs `mysql`/`psql` on a host, but it does not bundle arbitrary local code execution or installers.
Network access2 (moderate)The skill repeatedly calls live AWS services (`describe-db-instances`, `describe_reserved_db_instances_offerings`, `describe_savings_plans_offering_rates`, `send-command`), so account metadata and pricing data leave the machine to AWS.
Filesystem reach0 (none)There is no local file editing, deletion, or dotfile/system-path access; the only deletion commands shown are for AWS resources like snapshots, not the local filesystem.
Secrets & credentials2 (moderate)The precheck templates explicitly retrieve credentials from Secrets Manager and place them in shell variables, e.g. `aws secretsmanager get-secret-value` and `export PGPASSWORD=...`, so the skill handles secrets even though it warns against plaintext passwords.
Privilege & persistence0 (none)It does not request sudo, install system packages globally, register services, or modify shell/OS settings; any elevated access is cloud IAM rather than local machine privilege.
Instruction hijack surface1 (low)It includes strong agent directives such as `If the user says "production" or "production-ready", apply ALL of the above without asking`, although the Blue/Green switchover path still correctly requires explicit confirmation.
Irreversible actions2 (moderate)The skill can provision billable AWS resources (`aws rds create-db-instance`, `aws rds create-blue-green-deployment`) and exposes cleanup/deletion commands like `aws rds delete-db-snapshot`, but major destructive actions are still advisory-gated.
Transparency0 (none)All shipped files are plain text, including the Python helper script; there are no binaries, hidden blobs, or runtime-downloaded installers.

Before installing

Rated 2026-10-19 by an automated review of 19 files from the skill's repository.

Source

Repository
aws/agent-toolkit-for-aws (all skills from this repository)
Path
skills/specialized-skills/database-skills/rds-oss/SKILL.md
Branch
main
Updated
2026-09-19