signing-in-to-aws

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: authentication, aws, cli, cloud, setup.

What it does

Gets AWS credentials for CLI/SDK access via `aws login`. Activates when a developer needs to authenticate to AWS for local development, when an AWS operation fails due to missing or expired credentials, or when someone asks about setting up AWS access. Triggers: "set up AWS", "configure AWS", "aws login", "get credentials", "authenticate", "session expired", "token expired", "no credentials", "AccessDeniedException" with no configured credentials.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill signing-in-to-aws

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-core/skills/signing-in-to-aws ~/.claude/skills/signing-in-to-aws

Safety box score

Grade C, moderate risk: 35 of 100 risk points, rated 2026-10-14. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill runs AWS CLI sign-in commands in the user's local shell to obtain short-lived credentials for local development. The main risks are that it contacts AWS, inspects local AWS config and SSO cache under `~/.aws/`, and handles existing credentials while switching profiles.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It explicitly requires command execution in the local shell: `aws --version`, `aws sts get-caller-identity`, `aws configure list`, and `aws login`.
Network access	2 (moderate)	Its core flow sends authentication traffic to AWS services via `aws login` and `aws sts get-caller-identity`, with an additional remote cross-device option (`aws login --remote`).
Filesystem reach	2 (moderate)	It references local home-directory AWS files and caches, including `~/.aws/config` and `~/.aws/sso/cache/`, so it reads credential-related state outside the project.
Secrets & credentials	2 (moderate)	It inspects credential state and token caches (`aws configure list`, `~/.aws/sso/cache/`) and discusses access keys, so it touches authentication secrets even though it does not ask for raw secret input.
Privilege & persistence	0 (none)	There is no sudo, global install, service registration, or OS-level configuration in the skill.
Instruction hijack surface	0 (none)	The file contains workflow guidance and confirmation prompts, but no hidden text, remote prompt-following, or instructions to ignore safeguards.
Irreversible actions	2 (moderate)	It can authenticate the user and switch credentials by running `aws login`, but it asks for confirmation first and does not deploy, pay, delete, or publish anything.
Transparency	0 (none)	The skill is plain markdown with readable commands and no binaries, encoded blobs, or generated installers.

Before installing

Read `SKILL.md` and confirm you want it to run AWS CLI commands in your local shell.
Check whether your AWS profiles live under `~/.aws/config` and whether you are comfortable with the skill inspecting them.
If you use AWS SSO, make sure you are okay with the skill looking at `~/.aws/sso/cache/` during troubleshooting.

Rated 2026-10-14 by an automated review of 1 file from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-core/skills/signing-in-to-aws/SKILL.md
Branch: main
Collection: aws-core
Updated: 2026-09-19

claude-switch-models-setup — Set up and maintain multiple isolated Claude Code CLI profiles so students and power users can run different LLM providers (Kimi K3, Kimi K2.7 highspeed.
codex-1m-context-window-setup — Configures and verifies an expanded, model-aware context window for OpenAI Codex CLI and Codex Desktop by safely updating the shared base config.
aws-storage — Selects, investigates, and compares AWS object, file, and block storage services, and answers cost, performance, configuration, security.
agents-get-started — Use when a developer wants to create a new agent project or get started with AgentCore.
setup-security-agent — Configure AWS Security Agent for the current workspace — provision or reuse an agent space, IAM service role, and S3 bucket.
amazon-ses — Guides Amazon SES onboarding for domain-based email sending.