recovery-controller-setup
An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: automation, aws, failover, resilience, routing.
What it does
Configures AWS Application Recovery Controller (ARC) for operational resilience: routing controls with safety rules for cross-Region failover, and zonal shift / zonal autoshift for AZ-impairment recovery. Applies when setting up failover routing, configuring safety rules, enabling zonal shift, or configuring zonal autoshift with practice runs. Also applies when shifting traffic out of a specific Availability Zone (AZ) for an ALB/NLB or other resource. For a broader "an AZ is impaired, what is my response across services" question, see aws-resilience-lifecycle. Does not apply to Resilience Hub setup or FIS experiments.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add aws/agent-toolkit-for-aws --skill recovery-controller-setupOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/resilience-skills/recovery-controller-setup ~/.claude/skills/recovery-controller-setupSafety box score
Grade C, moderate risk: 28 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill configures AWS ARC for live traffic control: cross-Region routing controls with safety rules, plus manual and automatic zonal shift for AZ impairments. The main risk is operational blast radius, because it can directly move production traffic and enable AWS-managed autoshift after practice runs; it also requires AWS CLI/MCP access to remote AWS endpoints.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It directs the agent to run AWS CLI commands such as `aws route53-recovery-control-config create-routing-control` and `aws arc-zonal-shift start-zonal-shift`, so it executes shell commands, though only for AWS operations. |
| Network access | 2 (moderate) | Those commands call AWS control-plane and data-plane endpoints, including `--endpoint-url {cluster_endpoint}` for `route53-recovery-cluster`, so the skill sends requests over the network to AWS. |
| Filesystem reach | 1 (low) | The only explicit local filesystem access is reading the skill's own reference files from dot-directories like `.kiro/skills/recovery-controller-setup/` or `~/.claude/skills/recovery-controller-setup/` when installed locally. |
| Secrets & credentials | 0 (none) | It does not ask for passwords, API keys, tokens, `.env` files, keychains, or browser sessions; it only recommends short-lived IAM credentials. |
| Privilege & persistence | 0 (none) | There is no sudo, service installation, global package install, or OS/shell configuration change required. |
| Instruction hijack surface | 0 (none) | There is no fetched or hidden instruction stream to follow, and the prompt-override text only narrows scope; it does not instruct the agent to ignore safety checks or hide actions. |
| Irreversible actions | 3 (high) | It can change production traffic by creating routing controls and running `update-routing-control-states`, and it can enable AWS-managed zonal autoshift that automatically moves traffic during AZ impairment. |
| Transparency | 0 (none) | All content is plain markdown with readable commands and references; there are no binaries, encoded payloads, or unreviewable installers. |
Before installing
- Read `references/arc-procedures.md` and confirm you want a skill that can move production traffic across Regions or AZs.
- Check `references/security-considerations.md` for the exact IAM actions it needs, and use short-lived role credentials instead of long-lived user keys.
- If installed locally, verify the skill files under `~/.claude/skills/recovery-controller-setup/` or `.kiro/skills/recovery-controller-setup/` are the expected version before letting it run.
Rated 2026-10-20 by an automated review of 3 files from the skill's repository.
Source
- Repository
- aws/agent-toolkit-for-aws (all skills from this repository)
- Path
- skills/specialized-skills/resilience-skills/recovery-controller-setup/SKILL.md
- Branch
- main
- Updated
- 2026-09-19
Related skills
- arc-region-switch — Answers questions about Amazon Application Recovery Controller (ARC) Region switch including architecture, plans, execution blocks, workflows, triggers.
- principle-make-operations-idempotent — Apply when designing commands, lifecycle steps, or processing loops that run amid crashes, restarts, and retries.
- aws-resilience-lifecycle — Guides the end-to-end AWS resilience lifecycle integrating Resilience Hub v2, Fault Injection Service, and Application Recovery Controller.
- aws-step-functions — Authors and edits AWS Step Functions state machines: writes Amazon States Language (ASL) in JSONata, and chooses and structures state types (Task, Choice, Map.
- connecting-vpcs-with-peering — Establishes VPC peering connections between two VPCs for direct private network connectivity.
- directconnect — Configures AWS Direct Connect: choosing a connection model (dedicated, hosted, or a link aggregation group) and completing the cross connect; creating private.