resilience-hub-multi-account

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: architecture, aws, multi-account, resilience, security.

What it does

Configures AWS Resilience Hub v2 for multi-account resilience management across an AWS Organization. Covers the per-service cross-account permission model, cross-account IAM roles, and centralized assessment from a single account. Applies when the user wants to set up org-wide resilience or assess workloads that span multiple AWS accounts.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill resilience-hub-multi-account

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/resilience-skills/resilience-hub-multi-account ~/.claude/skills/resilience-hub-multi-account

Safety box score

Grade C, moderate risk: 42 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill configures AWS IAM roles and Resilience Hub multi-account service registrations, so it can create and grant cross-account access in both a central account and member accounts. The main risks are IAM permission changes, AWS API actions sent over the network, and handling of the shared-secret `externalId` used in cross-account trust.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It directs the agent to run live AWS CLI/API operations such as `aws iam create-role`, `aws iam put-role-policy`, and `aws resiliencehubv2 create-service`, which execute mutating commands against AWS.
Network access	2 (moderate)	The skill sends configuration and verification requests to AWS services via the AWS CLI or MCP `call_aws` tool, including IAM and Resilience Hub API calls.
Filesystem reach	0 (none)	The files themselves do not read, write, or delete local files outside the skill bundle; references to shell history and `file://` are guidance, not direct file access.
Secrets & credentials	2 (moderate)	It treats `externalId` as a shared secret, recommends storing it in Secrets Manager/SSM, and warns about avoiding plaintext exposure in logs and shell history.
Privilege & persistence	2 (moderate)	It creates and modifies IAM roles and policies in central and member accounts, changing authorization boundaries even though it does not require sudo or OS-level privilege.
Instruction hijack surface	0 (none)	I did not find instructions to ignore higher-priority policy, follow remote content, or hide behavior; the text is operational guidance rather than prompt injection.
Irreversible actions	2 (moderate)	The skill performs AWS resource creation and configuration (`create-role`, `put-role-policy`, `create-service`) and verification steps without requiring a separate deployment workflow, but it is not broadly destructive.
Transparency	0 (none)	The skill content is plain, readable Markdown; there are no binaries, encoded blobs, or runtime-downloaded installers.

Before installing

Read `references/multi-account-procedure.md` and confirm you want it to create IAM roles in both central and member accounts.
Decide whether you will use a real `externalId` from Secrets Manager/SSM before running any command.
Check which AWS account(s) the skill will target and whether you are comfortable granting `sts:AssumeRole` across them.
Run the dependency check in a sandbox account first, then inspect the exact `create-role` and `create-service` payloads before execution.

Rated 2026-10-20 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/resilience-skills/resilience-hub-multi-account/SKILL.md
Branch: main
Updated: 2026-09-19

agents-harden — Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle.
aws-networking — Routes AWS networking requests to the correct service skill for implementation.
aws-security — Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries.
audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
entry-point-analyzer — Analyzes smart contract codebases to identify state-changing entry points for security auditing.
guidelines-advisor — Smart contract development advisor based on Trail of Bits' best practices.