Setting the skill. One moment.
AWS Agents For Devsecops
AWS Core
Core Skills · AWS…
End User Computing Skills
Messaging And Streaming Skills
Migration And Modernization Skills
Networking And Content Delivery Skills
Quantum Computing Skills
Security And Identity Skills
Web And Mobile Development
130 skills · 758 min
Core Skills
Skill 42 of 130
Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK.
4 minutes · 903 words · 5 sections
Install
npx skills add aws/agent-toolkit-for-aws --skill aws-serverlessnpx skills add aws/agent-toolkit-for-aws/plugin marketplace add aws/agent-toolkit-for-awsThe first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.
Domain expertise for building serverless applications on AWS: Lambda, API Gateway, Step Functions, EventBridge, event source mappings, concurrency, cold starts, deployment, and troubleshooting.
Works best with the AWS MCP server (opens in a new tab) — run CLI commands, query CloudWatch, validate configs directly. All guidance also works with standard AWS CLI access.
These cover capabilities and procedures the general references below do not. Several are specialized features or step-by-step tested procedures you would otherwise miss. Route to the matching skill before falling back to the references.
| Use this skill | When the workload involves |
|---|---|
| aws-lambda-microvms | Strong tenant isolation, sandboxed/untrusted code execution (AI agent code sandboxes, REPLs, notebooks, CI runners), long-lived sessions, suspend/resume with preserved state, port-listening servers (gRPC, WebSocket, custom TCP), Firecracker microVMs, snapshot-resumable compute, up to 8-hour lifetimes |
| aws-lambda-durable-functions | Durable execution, checkpoint-and-replay, long-running multi-step workflows written as plain code (TS/Python/Java), automatic state persistence, saga pattern in code, human-in-the-loop callbacks, executions up to 1 year, context.step/context.wait/context.invoke, withDurableExecution, durable-execution-sdk |
| aws-lambda-managed-instances | Lambda Managed Instances (LMI), capacity providers, EC2-backed Lambda, steady high-volume traffic (50M+ req/mo) wanting Savings Plans / Reserved Instance pricing, PerExecutionEnvironmentMaxConcurrency, CapacityProviderConfig, multi-concurrent execution environments |
Route here when the user wants to coordinate multiple steps, services, or functions. Triggers include “orchestration”, “workflow”, “state machine”, “multi-step coordination”, “coordinate Lambda functions”, “durable execution”, “pipeline with retries”, or intent to build saga/compensation, human-in-the-loop approval, fan-out, or long-running async coordination.
When starting a new orchestration or multi-step workflow, you MUST surface the choice between AWS Step Functions and AWS Lambda Durable Functions before implementing — do not silently pick one. Route on the signals below. When the request names only a generic pattern (saga/compensation, human-in-the-loop, fan-out, or “workflow orchestration”) with no technology, present both options and the one-line tradeoff, then let the user decide. Do not lead with the tradeoff caveats when the signals already point to one service.
| Use this skill | When the workload involves |
|---|---|
| aws-step-functions | Orchestration whose primary work is calling AWS services directly; coordinating non-Lambda compute (ECS/Fargate, Glue, SageMaker, Batch) through native managed integrations; a visual, auditable workflow definition required for compliance, cross-team operational observability, or as a shared contract between teams that do not share a codebase (ASL is the specification, not application code); authoring or editing state machines and Amazon States Language (ASL) — state types, JSONata data transformation, Retry/Catch error handling, .sync/waitForTaskToken service integrations, Distributed Map, TestState unit testing, JSONPath-to-JSONata migration |
| aws-lambda-durable-functions | Code-first orchestration in-process when already building on Lambda (context.step/context.wait/context.invoke, withDurableExecution); many fine-grained steps per execution where cumulative Step Functions Standard state-transition cost may be significant — compare Step Functions pricing (Standard vs Express) against Lambda invocation cost at the expected volume before choosing; orchestration steps written in a general-purpose language within the same application codebase (share modules, data types, and test suites with application code); teams applying standard software-engineering practices (unit tests, code review, type checking) to orchestration logic without learning a declarative workflow language |
Tradeoff (use when either fits): Durable Functions keeps orchestration in your Lambda codebase; Step Functions externalizes it into a managed, visual state machine with built-in service integrations.
Security: Both services persist workflow state and payloads — Step Functions records full input/output in execution history (viewable in the console and, if logging is enabled, CloudWatch Logs). As a baseline, enable execution logging (CloudTrail) and CloudWatch alarms on execution failures, and use least-privilege per-workflow execution roles. Do not pass secrets, tokens, or PII through workflow state; reference them by Secrets Manager/ARN pointer, and apply a customer-managed KMS key to encrypt state when the data is sensitive.
| Use this skill | For the task |
|---|---|
| connecting-lambda-to-api-gateway | Wire an existing Lambda to a new REST/HTTP API: proxy integration, permissions, CORS, throttling, access logging, deployment |
| connecting-lambda-to-dynamodb | Connect Lambda to DynamoDB: IAM execution role, read/write permissions, stream event source mapping |
| creating-api-gateway-stage | Create an API Gateway stage with CloudWatch logging, X-Ray tracing, throttling, WAF association, and authorization |
| deploying-custom-domain-rest-api | Deploy a Regional REST API with custom domain: ACM cert, Lambda backend, request authorizer, base path mapping, Route 53 DNS |
| debugging-lambda-timeouts | Systematically diagnose a timing-out Lambda: config, CloudWatch logs/metrics, VPC, cold starts, memory, downstream calls |
| processing-s3-uploads-with-step-functions | Deploy an event-driven workflow: S3 upload → EventBridge → Step Functions → Lambda (small files) or Fargate (large files), with VPC/ECR/ECS/IAM |
| User need | Read |
|---|---|
| Building a new serverless app — pattern selection | architecture.md (opens in a new tab) |
| Lambda config, cold starts, SnapStart, memory, VPC, layers, Function URLs | lambda.md (opens in a new tab) |
| Concurrency (reserved, provisioned, ESM controls) | concurrency.md (opens in a new tab) |
| Event sources (SQS, DynamoDB Streams, SNS, Kinesis), filtering, batch failures | event-sources.md |
Note: Reference files contain specific runtime versions, quotas, and feature matrices that change. When precision matters (production, runtime choice, quotas), confirm against current AWS documentation. The references focus on values and gotchas that are easy to get wrong — not on basics.
Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK. Covers cold starts, CORS debugging, event source mappings, troubleshooting, concurrency, SnapStart, Powertools, function URLs, EventBridge Scheduler, Lambda layers, and production readiness. Triggers on mentions of Lambda, API Gateway, Step Functions, SAM templates, CDK serverless stacks, DynamoDB stream triggers, SQS event sources, cold starts, timeouts, 502/504 errors, throttling, concurrency, CORS, Powertools, or any event-driven architecture on AWS, even without the word "serverless." Does not apply to EC2, ECS/Fargate containers, or Amplify hosting.
The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.
skills/core-skills/aws-serverless/SKILL.mdmain, last pushed 24 September 2026.SKILL.md, not by matching a directory convention. 19 distinct layouts observed: plugins/aws-agents-for-devsecops/skills/*/SKILL.md, plugins/aws-agents/skills/*/SKILL.md, plugins/aws-core/skills/*/SKILL.md, skills/core-skills/*/SKILL.md, skills/specialized-skills/analytics-skills/*/SKILL.md, skills/specialized-skills/database-skills/*/SKILL.md, skills/specialized-skills/ec2-skills/*/SKILL.md, skills/specialized-skills/end-user-computing-skills/*/SKILL.md, skills/specialized-skills/messaging-and-streaming-skills/*/SKILL.md, skills/specialized-skills/migration-and-modernization-skills/*/SKILL.md, skills/specialized-skills/networking-and-content-delivery-skills/*/SKILL.md, skills/specialized-skills/operations-skills/*/SKILL.md, skills/specialized-skills/quantum-computing-skills/*/SKILL.md, skills/specialized-skills/resilience-skills/*/SKILL.md.| Step Functions, EventBridge rules/pipes/scheduler | orchestration.md (opens in a new tab) |
| API Gateway quotas, authorizers, WebSocket | api-gateway.md (opens in a new tab) |
| SAM/CDK resource types and fast iteration | deployment.md (opens in a new tab) |
| Production readiness, observability, anti-patterns | production.md (opens in a new tab) |
| Debugging an error (exact string → cause → fix) | troubleshooting.md (opens in a new tab) |
| Powertools handler template | powertools-handler.py (opens in a new tab) |
skills/specialized-skills/security-and-identity-skills/*/SKILL.mdskills/specialized-skills/serverless-skills/*/SKILL.mdskills/specialized-skills/storage-skills/*/SKILL.mdskills/specialized-skills/system-table-skills/*/SKILL.mdskills/specialized-skills/web-and-mobile-development/*/SKILL.mdh1 and no skipped levels:.claude-plugin/marketplace.json by Amazon Web Services, declaring 4 plugins. It is read for editorial metadata only — never as the skill index, which is always the repository tree./aws/agent-toolkit-for-aws.md, and each skill at its own .md URL.10 files · 67 KB
Everything this skill ships beside its prose. All of it is set here, as subchapters of skill 42.
Documentation the agent loads on demand, rather than up front.
Templates, schemas and fixtures the skill draws on.