troubleshooting-s3-files

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, performance, storage, sync, troubleshooting.

What it does

Diagnoses and resolves Amazon S3 Files issues including mount failures, permission errors, synchronization problems, and performance issues. Use when the user has an S3 file system that is not mounting, returning access denied, not syncing changes to S3, showing files in lost+found, or performing slower than expected.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill troubleshooting-s3-files

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/storage-skills/troubleshooting-s3-files ~/.claude/skills/troubleshooting-s3-files

Safety box score

Grade C, moderate risk: 44 of 100 risk points, rated 2026-10-12. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill uses AWS CLI and shell commands to diagnose S3 Files problems and, in some cases, change AWS networking and storage settings. The main risks are cloud-side changes like opening security group port 2049 or modifying VPC DNS attributes, plus root-level package/config edits and log collection that can expose S3 key names.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It explicitly runs shell and CLI commands such as `aws s3files ...`, `nc -zv ...`, `getfattr ...`, and `sudo yum -y install amazon-efs-utils`.
Network access	2 (moderate)	It can query and change AWS network reachability, including `aws ec2 authorize-security-group-ingress ...` and `aws ec2 modify-vpc-attribute ...`.
Filesystem reach	2 (moderate)	It reads and writes system paths like `/etc/amazon/efs/s3files-utils.conf`, `/var/log/amazon/efs/`, and `/tmp/s3files-logs.tar.gz`.
Secrets & credentials	1 (low)	It requires valid AWS credentials to work and explicitly warns that collected logs can contain S3 key names.
Privilege & persistence	2 (moderate)	It uses `sudo` for package installation and system config/log collection, which requires elevated local privileges.
Instruction hijack surface	0 (none)	The skill does not tell the agent to ignore instructions, follow remote content, hide actions, or otherwise change prompting behavior.
Irreversible actions	2 (moderate)	It recommends operational changes such as opening firewall rules, modifying VPC attributes, and in one case to "delete/recreate" a file system if IAM is wrong.
Transparency	0 (none)	All shipped content is plain markdown; there are no binaries, generated blobs, or hidden runtime downloads in the skill files.

Before installing

Read the `sudo yum`, `/etc/amazon/efs/s3files-utils.conf`, and `sudo tar` steps first; they require root and touch host-wide paths.
Try the skill in a scratch AWS account or non-production VPC before allowing it to change security groups or VPC attributes.
Check that any log bundle you collect is treated as sensitive because it can include S3 key names.
Verify the IAM principal used by `aws` is tightly scoped before letting the skill troubleshoot or modify resources.

Rated 2026-10-12 by an automated review of 1 file from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/storage-skills/troubleshooting-s3-files/SKILL.md
Branch: main
Updated: 2026-09-19

troubleshooting-efs — Diagnoses and resolves Amazon EFS issues including mount failures, NFS timeouts, permission errors, throughput problems, and burst credit exhaustion.
aws-storage — Selects, investigates, and compares AWS object, file, and block storage services, and answers cost, performance, configuration, security.
debugging-lambda-timeouts — Debugs AWS Lambda function timeout failures by systematically analyzing function configuration, CloudWatch logs and metrics, VPC/networking, cold starts.
managing-amazon-msk — Operates Amazon MSK Provisioned clusters (Standard and Express brokers).
aws-compute — Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU.
aws-observability — Builds, configures, debugs, and optimizes AWS observability with CloudWatch (Log Insights, Metrics, Alarms, Dashboards, EMF), X-Ray, CloudTrail.