> **resilience-hub-getting-started** — chapter 98 of 120 in [aws/agent-toolkit-for-aws](https://skillsdocs.com/aws/agent-toolkit-for-aws).
>
> Book (all chapters, one file): https://skillsdocs.com/aws/agent-toolkit-for-aws.md
> Machine manifest: https://skillsdocs.com/aws/agent-toolkit-for-aws/.well-known/agent-skills/index.json
> Install the book: `npx skills add aws/agent-toolkit-for-aws`
> Upstream: https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/specialized-skills/resilience-skills/resilience-hub-getting-started/SKILL.md @ `main`
> Raw bytes, no header: https://raw.githubusercontent.com/aws/agent-toolkit-for-aws/main/skills/specialized-skills/resilience-skills/resilience-hub-getting-started/SKILL.md
> Base for relative paths: https://raw.githubusercontent.com/aws/agent-toolkit-for-aws/main/skills/specialized-skills/resilience-skills/resilience-hub-getting-started/
> Licence: Apache-2.0 — https://spdx.org/licenses/Apache-2.0.html
>
> Bundled files (1), referenced from this skill's directory:
>   - `references/setup-procedure.md` — https://raw.githubusercontent.com/aws/agent-toolkit-for-aws/main/skills/specialized-skills/resilience-skills/resilience-hub-getting-started/references/setup-procedure.md
>
> Content © its authors, served unmodified. Takedown: https://github.com/kyleledbetter/skillsdocs/issues/new?labels=takedown&title=Takedown+request

<!-- Verbatim upstream SKILL.md follows, YAML frontmatter included. -->

---
name: resilience-hub-getting-started
description: >
  Sets up AWS Resilience Hub v2 from scratch: creates resilience policies with SLO targets,
  registers systems and user journeys, onboards services with input sources, and runs a
  first failure mode assessment. Applies when the user wants to get started with Resilience Hub v2,
  create a policy, onboard a service, or run an assessment — including creating one concrete
  policy with specific availability/RTO/RPO targets and a DR approach for a single service
  (even a tier-1 one). Does not apply to FIS experiments or ARC routing controls.
version: 1
---

# Getting Started with AWS Resilience Hub v2

## Overview

Domain expertise for first-time Resilience Hub v2 setup: policies, systems, user journeys,
services, input sources, and failure mode assessments.

> The AWS MCP server is recommended for executing this skill's AWS API calls, but it is not required — all operations also work with the AWS CLI directly.

## Guardrail — where this skill's own files live (MCP vs local install)

Before reading a reference file, determine how this skill was loaded:

- **Loaded via the AWS MCP `retrieve_skill` tool:** the skill's reference files are not on the local filesystem. Fetch each one through `retrieve_skill` with the `file` parameter (e.g. `file="references/setup-procedure.md"`) — do NOT `file_read` these paths locally or search the filesystem for them.
- **Installed locally** (e.g. `.kiro/skills/resilience-hub-getting-started/` or `~/.claude/skills/resilience-hub-getting-started/`): read reference files from the local skill directory using the relative paths shown here.

This applies only to the skill's own reference files; always read and write user or session data in the working directory, never through `retrieve_skill`.

## Set up Resilience Hub v2

To configure Resilience Hub v2 from scratch, follow the procedure exactly.
See [references/setup-procedure.md](references/setup-procedure.md).

## Troubleshooting

### Assessment stuck in IN_PROGRESS

Poll with `aws resiliencehubv2 list-failure-mode-assessments`. If stuck >30 min, check
the `errorCode` field — common causes are INVALID_PERMISSIONS or CMK_ACCESS_DENIED on
cross-account roles.

### Achievability shows NOT_ACHIEVABLE

Your architecture cannot meet the policy targets. Fix infrastructure before running
FIS experiments — testing won't help if the architecture is fundamentally insufficient.

### No resources discovered

Verify input sources are correct: CFN stack ARN exists, Terraform state file is accessible,
EKS cluster is in the specified regions, or resource tags match actual resources.

## Security Considerations

- **Least privilege:** scope the invoker role to read-only discovery of only the resource types in your input sources; attach the AWS managed `AWSResilienceHubAsssessmentExecutionPolicy` (AWS spells it with three s's) or a tighter custom policy.
- **Encryption at rest / in transit:** recommend S3 buckets for Terraform state and assessment reports use server-side encryption (SSE-KMS) and a bucket policy enforcing TLS via `aws:SecureTransport`.
- **Condition keys (confused-deputy):** add an `aws:SourceAccount` (and ideally `aws:SourceArn` scoped to the specific Resilience Hub service ARN) condition to the invoker role's trust policy so only your account's Resilience Hub can assume it.
- **Limit assessment exposure:** restrict who can call `start-failure-mode-assessment` (it reads infrastructure state) and who can read assessment findings and reports — these can contain sensitive architecture detail.
- **Further reading:** see [Security in AWS Resilience Hub](https://docs.aws.amazon.com/resilience-hub/latest/userguide/security.html) and [IAM Best Practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) (including cross-service confused-deputy prevention).