timestream-influxdb

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: cloud, database, influxdb, migration, timeseries.

What it does

Retrieves authoritative guidance on Amazon Timestream for InfluxDB (managed InfluxDB 2, InfluxDB 2 Read Replica Clusters, InfluxDB 3 Core and Enterprise). Applicable to any InfluxDB-on-AWS request including engine selection, provisioning (Marketplace + AmazonTimestreamInfluxDBFullAccess/ConsoleFullAccess IAM), schema design (tags vs fields, cardinality, HTTP/sensor/metric data modeling), migration from LiveAnalytics, Processing Engine plugins, connectivity (port 8086 V2, port 8181 V3, VPC-only by default), and write/query errors.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill timestream-influxdb

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/database-skills/timestream-influxdb ~/.claude/skills/timestream-influxdb

Safety box score

Grade D, elevated risk: 58 of 100 risk points, rated 2026-10-15. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill provisions and operates Amazon Timestream for InfluxDB and related AWS resources, including clusters/instances, S3 buckets, CloudWatch alarms, VPC endpoints, and Secrets Manager tokens. The main risks are broad cloud-side mutation, credential handling, and a few local side effects such as writing `~/.influxdb_token` and editing `/etc/hosts` in the documented workflow.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It ships runnable code (`scripts/input_validator.py`, `scripts/get_token.sh`, `scripts/health_check.sh`) and many shell command examples, including `aws` and `curl` calls that execute actions on the machine and against AWS services.
Network access	2 (moderate)	The skill talks to AWS APIs and database endpoints, including `aws secretsmanager get-secret-value`, `aws cloudwatch list-metrics`, and `curl https://<endpoint>:8181/api/v3/query_sql`, so data and credentials leave the machine over the network.
Filesystem reach	2 (moderate)	It writes outside the project tree, notably `scripts/get_token.sh` writing `~/.influxdb_token` and `references/getting-started.md` instructing a `/etc/hosts` edit for port-forwarding.
Secrets & credentials	2 (moderate)	It explicitly retrieves and stores auth tokens from Secrets Manager, exports them as `INFLUX_TOKEN`/`V3_TOKEN`, and warns against shell-history exposure, so it handles real credentials.
Privilege & persistence	2 (moderate)	The workflow includes temporary broad IAM activation (`AmazonTimestreamInfluxDBFullAccess` and `AmazonTimestreamConsoleFullAccess`) plus AWS-side policy and network changes such as VPC endpoints and bucket policies.
Instruction hijack surface	1 (low)	It heavily constrains the agent with imperative external-source loading and narration rules like `MUST load and follow` and `Do not report creation complete... while the cluster remains CREATING`, but it does not contain obvious hostile prompt-injection payloads or hidden text.
Irreversible actions	3 (high)	This skill can create and reconfigure cloud resources (`create-db-cluster`, S3 buckets, alarms, VPC endpoints) and its migration guidance includes deleting the old cluster after validation, which gives it high operational blast radius.
Transparency	0 (none)	All shipped files are plain text and readable; there are no binaries, packed payloads, or runtime-downloaded installers in the reviewed skill.

Before installing

Read `scripts/get_token.sh` and `scripts/health_check.sh` to confirm you want tokens written to `~/.influxdb_token` and used from the environment.
Verify your AWS role can create/update Timestream, S3, CloudWatch, SNS, and VPC resources, and that any temporary full-access policy will be removed immediately after activation.
Test the provisioning and migration paths in a non-production AWS account first, especially `create-db-cluster`, log delivery, and any delete-after-validation step.
Confirm that editing `/etc/hosts` and storing secrets in Secrets Manager fits your local security policy.

Rated 2026-10-15 by an automated review of 15 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/database-skills/timestream-influxdb/SKILL.md
Branch: main
Updated: 2026-09-19

amazon-keyspaces — Provides authoritative compatibility checks, pricing estimates, connection troubleshooting, pre-warming guidance.
aws-database — Routes any task involving AWS databases — choosing, comparing, recommending, getting started with.
connecting-to-data-source — Create and troubleshoot AWS Glue connections to JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS), Redshift, Snowflake, and BigQuery.
ingesting-into-data-lake — Import data into the AWS data lake from S3 files, local uploads, JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS, Aurora), Amazon Redshift.
managed-db-services — Configure DigitalOcean Managed MySQL, MongoDB, Valkey, Kafka, and OpenSearch for App Platform.
amazon-aurora-mysql — Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query).