Resilience Hub Getting Started

Sets up AWS Resilience Hub v2 from scratch: creates resilience policies with SLO targets, registers systems and user journeys, onboards services with input sources, and runs a…

2 minutes · 386 words · 9 sections

Getting Started with AWS Resilience Hub v2

Overview

Domain expertise for first-time Resilience Hub v2 setup: policies, systems, user journeys, services, input sources, and failure mode assessments.

The AWS MCP server is recommended for executing this skill’s AWS API calls, but it is not required — all operations also work with the AWS CLI directly.

Guardrail — where this skill’s own files live (MCP vs local install)

Before reading a reference file, determine how this skill was loaded:

Loaded via the AWS MCP retrieve_skill tool: the skill’s reference files are not on the local filesystem. Fetch each one through retrieve_skill with the file parameter (e.g. file="references/setup-procedure.md") — do NOT file_read these paths locally or search the filesystem for them.
Installed locally (e.g. .kiro/skills/resilience-hub-getting-started/ or ~/.claude/skills/resilience-hub-getting-started/): read reference files from the local skill directory using the relative paths shown here.

This applies only to the skill’s own reference files; always read and write user or session data in the working directory, never through retrieve_skill.

Set up Resilience Hub v2

To configure Resilience Hub v2 from scratch, follow the procedure exactly. See references/setup-procedure.md (opens in a new tab).

Troubleshooting

Assessment stuck in IN_PROGRESS

Poll with aws resiliencehubv2 list-failure-mode-assessments. If stuck >30 min, check the errorCode field — common causes are INVALID_PERMISSIONS or CMK_ACCESS_DENIED on cross-account roles.

Achievability shows NOT_ACHIEVABLE

Your architecture cannot meet the policy targets. Fix infrastructure before running FIS experiments — testing won’t help if the architecture is fundamentally insufficient.

No resources discovered

Verify input sources are correct: CFN stack ARN exists, Terraform state file is accessible, EKS cluster is in the specified regions, or resource tags match actual resources.

Security Considerations

Least privilege: scope the invoker role to read-only discovery of only the resource types in your input sources; attach the AWS managed AWSResilienceHubAsssessmentExecutionPolicy (AWS spells it with three s’s) or a tighter custom policy.
Encryption at rest / in transit: recommend S3 buckets for Terraform state and assessment reports use server-side encryption (SSE-KMS) and a bucket policy enforcing TLS via aws:SecureTransport.
Condition keys (confused-deputy): add an aws:SourceAccount (and ideally aws:SourceArn scoped to the specific Resilience Hub service ARN) condition to the invoker role’s trust policy so only your account’s Resilience Hub can assume it.
Limit assessment exposure: restrict who can call start-failure-mode-assessment (it reads infrastructure state) and who can read assessment findings and reports — these can contain sensitive architecture detail.
Further reading: see Security in AWS Resilience Hub (opens in a new tab) and IAM Best Practices (opens in a new tab) (including cross-service confused-deputy prevention).

Appendix 98.1

1 file · 15 KB

Everything this skill ships beside its prose. All of it is set here, as a subchapter of chapter 98.

ReferencesMarkdown · 1 file

Documentation the agent loads on demand, rather than up front.

98.1Setup ProcedureThis SOP guides you through first-time Resilience Hub v2 setup: creating a resilience policy with SLO targets…15 KB

Install this repository

$ npx skills add aws/agent-toolkit-for-aws

» /plugin marketplace add aws/agent-toolkit-for-aws

Skills install per repository, not per chapter — the CLI has no documented per-skill form, so we do not print one.

About this skill

Trigger

Sets up AWS Resilience Hub v2 from scratch: creates resilience policies with SLO targets, registers systems and user journeys, onboards services with input sources, and runs a first failure mode assessment. Applies when the user wants to get started with Resilience Hub v2, create a policy, onboard a service, or run an assessment — including creating one concrete policy with specific availability/RTO/RPO targets and a DR approach for a single service (even a tier-1 one). Does not apply to FIS experiments or ARC routing controls.

The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.

Colophon for this issue

Colophon

How this issue was made

Source: github.com/aws/agent-toolkit-for-aws, branch main, last pushed 10 August 2026.
Licence: Apache-2.0 — the text of every chapter is reproduced unmodified, frontmatter included, under the upstream licence.
Discovery: 120 chapters found by walking the repository tree for SKILL.md, not by matching a directory convention. 17 distinct layouts observed: plugins/aws-agents-for-devsecops/skills/*/SKILL.md, plugins/aws-agents/skills/*/SKILL.md, plugins/aws-core/skills/*/SKILL.md, skills/core-skills/*/SKILL.md, skills/specialized-skills/analytics-skills/*/SKILL.md, skills/specialized-skills/database-skills/*/SKILL.md, skills/specialized-skills/ec2-skills/*/SKILL.md, skills/specialized-skills/messaging-and-streaming-skills/*/SKILL.md, skills/specialized-skills/migration-and-modernization-skills/*/SKILL.md, skills/specialized-skills/networking-and-content-delivery-skills/*/SKILL.md, skills/specialized-skills/operations-skills/*/SKILL.md, skills/specialized-skills/resilience-skills/*/SKILL.md, skills/specialized-skills/security-and-identity-skills/*/SKILL.md, skills/specialized-skills/serverless-skills/*/SKILL.md.