aws-cdk Skill (AWS) for Claude: Write, Deploy and Troubleshoot CDK Stacks

Makes Claude write, deploy and fix AWS infrastructure with CDK in TypeScript or Python, using AWS's own safe-deploy rules.

Installs: 9.8K; on skills.sh
Stars: 3.4K; on GitHub
Files: 10; besides SKILL.md
Updated: Oct 2026; last repo commit

This skill is from AWS's own agent-toolkit-for-aws repo, not a community add-on. It leads with five warnings: cross-stack reference deadlocks, construct ID changes that replace resources, a stuck UPDATE_ROLLBACK_FAILED stack, hotswap and express mode that must never be used in production, and S3 buckets that survive a destroy.

It then gives a table of nine everyday tasks (bootstrap, new TypeScript or Python project, deploy, drift, import, safe refactor) and a table of 17 common errors with fixes. Eleven files in the folder, SKILL.md plus 10 references, hold the detail. The skill runs the cdk and aws CLIs, so it needs AWS credentials and the CDK installed.

It does not cover raw CloudFormation YAML, SAM, Terraform, Pulumi or CI/CD beyond CDK Pipelines.

Good for

Developers building AWS infrastructure with the CDK
Engineers stuck on a failed cdk deploy or a CloudFormation error
Teams refactoring stacks without replacing live resources
Platform teams adding drift and cdk-nag checks to CI

Install aws-cdk

Claude Code

Copy this prompt.

Install the aws-cdk skill in Claude Code. Run this command:

/plugin install aws-core@claude-plugins-official

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Pick one route. After the Codex plugin command, run /plugins in Codex and install aws-core. The aws-core plugin installs 25 skill folders (counted in the repo tree for plugins/aws-core/skills), a hook that runs secret-safety.py before Bash and AWS tool calls, and an AWS MCP server config. The skills-only routes install just this skill. The skill runs the cdk and aws CLIs on your machine, so there is no Claude app upload tab.

From the project README. Source.

What's in the skill

When it loads

Authors, deploys, and troubleshoots AWS infrastructure using CDK with TypeScript or Python. Covers best practices, stack architecture, and construct patterns. Applies when writing CDK constructs, bootstrapping environments, running cdk deploy/synth/diff, fixing CDK or CloudFormation errors, planning stack structure, importing existing resources, resolving drift, or refactoring stacks without resource replacement.

Sections in SKILL.md

Overview
Critical Warnings
Common Workflows
Fast Deployments — Hotswap vs Express (dev only)
Troubleshooting
Construct Patterns
Additional Resources
Security Considerations

Key facts

Author: Amazon Web Services (the vendor's own repo, per the aws-core plugin.json)
License: Apache-2.0 (README badge and plugin.json)
Installs on skills.sh: 9,755 (Nov 2, 2026)
GitHub stars: 3,366 for the whole aws/agent-toolkit-for-aws repo (Nov 2, 2026)
Last repo commit: Oct 30, 2026
What it includes: 11 files including SKILL.md: 10 reference files (no scripts)
Needs: The CDK CLI and AWS credentials on your machine
Part of: The aws-core plugin (version 1.2.0) in aws/agent-toolkit-for-aws. The plugin folder has 25 skill folders, a hook and an MCP config
Works in: Claude Code, Codex, Cursor, Devin, Kiro and fx, per the README. Plugins exist for Claude Code, Codex, Cursor and Devin

What it includes

Five rules on deadlocks, replacement, rollback, dev-only deploys and S3
Covers the cross-stack deadly embrace, construct ID changes that replace resources, UPDATE_ROLLBACK_FAILED, hotswap and express mode, and non-empty S3 buckets.
Critical warnings
cdk bootstrap, and cdk init for TypeScript or Python
Runs code · Bootstrap and new projects
cdk synth --strict, then cdk diff, then cdk deploy
SKILL.md says always diff before you deploy to production.
Runs code · Deploy flow
hotswap, cdk watch and --express, for development only
SKILL.md says you MUST NOT use hotswap or express mode in production.
Runs code · Fast dev deploys
Compliance checks and cdk drift (--fail in CI)
Runs code · cdk-nag and drift
cdk import, or deploy with --import-existing-resources
Runs code · Import resources
cdk refactor --unstable=refactor, with no property changes in the same deploy
Runs code · Refactor safely
17 errors with causes and fixes, from DeployFailed to drift on dev stacks
Runs code · Troubleshooting table
Prefer L2, use L1 with escape hatches when a property is missing
Construct patterns
Six rules, such as OIDC for CI and termination protection on stateful stacks
Security considerations

From the official docs

Permissions

High risk

Claude runs CDK commands that can create, change and delete real AWS resources. Use a sandbox account, and have it show cdk diff before every deploy.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It can change and delete real AWS resources
The references use cdk deploy, cdk destroy (bootstrap-and-project-setup.md), cdk destroy --express (fast-deployments.md) and cdk rollback --force (troubleshooting-deployment.md). Use a sandbox account and ask Claude to show cdk diff before any deploy. github.com
Hotswap and express deploys skip safety checks
SKILL.md says --hotswap creates drift on purpose and --express disables automatic rollback. It says you MUST NOT use them in production. github.com
Renaming a construct can replace stateful resources
SKILL.md warns that changing a construct ID replaces the resource and can lose data. Check cdk diff for replacements before you deploy. github.com
The plugin route adds an AWS MCP server and a hook
aws-core's .mcp.json starts mcp-proxy-for-aws-cli 1.7.0 through uvx against https://aws-mcp.us-east-1.api.aws/mcp with a --skip-auth flag. Its hook runs secret-safety.py before Bash and AWS tool calls, and the script denies direct Secrets Manager value fetches. The script has a 5 second timeout, and its own comment says a hang would let the call through. Use the skills-only commands if you want just this skill. github.com
References install packages and delete build folders
They show npm install, pip install -r requirements.txt and rm -rf cdk.out. Run these inside your project, not in a shared folder. github.com

Technical details

Turning on read-only	SKILL.md has no read-only mode.
Talks to	aws-mcp.us-east-1.api.aws, if you use the plugin route
Sign-in and keys	SKILL.md relies on your AWS credentials and mentions OIDC for CI/CD instead of static keys.
Scopes	Runs the cdk and aws CLIs with your AWS credentials References show cdk bootstrap, deploy, destroy and rollback commands References install packages with npm and pip

Questions

What does the aws-cdk skill do?

It makes Claude write, deploy and troubleshoot AWS infrastructure with the CDK in TypeScript or Python. It adds AWS's rules for safe deploys, a list of common errors with fixes, and guidance on drift, imports and refactoring.

Is this skill made by AWS?

Yes. It sits in the vendor's own repo, aws/agent-toolkit-for-aws. The plugin.json for the aws-core plugin that bundles it names Amazon Web Services as author.

How do I install aws-cdk?

Use the install box at the top of this page. The README's Claude Code route installs the whole aws-core plugin, which holds 25 skill folders. The box also has skills-only commands that install just this skill.

What does the aws-core plugin add besides the skill?

A hook that runs a Python script before Bash and AWS tool calls and blocks direct fetching of Secrets Manager secret values, plus an AWS MCP server config that runs through uvx. The plugin folder also holds the other skills. Read its README before installing.

Does it deploy things for me?

It tells Claude to use cdk deploy, cdk destroy, cdk bootstrap and other CLI commands, which change real AWS resources. SKILL.md says to run cdk diff before every production deploy, so ask Claude to show the diff first.

Is it safe to install?

The skill folder holds markdown files and no scripts. The risk comes from what Claude runs for you: CDK commands that create and delete AWS resources, and some references with rm -rf, npm install and cdk rollback --force. Use a sandbox account and read each command before it runs.

Is hotswap or express mode safe for production?

No. SKILL.md says you MUST NOT use either in production. Hotswap creates drift on purpose, and express mode reports success before resources stabilize and turns off automatic rollback.

Does it cover Terraform or raw CloudFormation?

No. SKILL.md lists raw CloudFormation YAML or JSON, SAM, Terraform, Pulumi and CI/CD beyond CDK Pipelines as out of scope.

Information

updated Nov 2, 2026

Repository: aws/agent-toolkit-for-aws
Folder: skills/core-skills/aws-cdk

aws/agent-toolkit-for-aws skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 10

skills/core-skills/aws-cdk/SKILL.md · github.com
README.md · github.com
plugins/aws-core/.claude-plugin/plugin.json · github.com
plugins/aws-core/com.anthropic.claude-code/hooks/hooks.json · github.com
plugins/aws-core/com.anthropic.claude-code/hooks/secret-safety.py · github.com
plugins/aws-core/.mcp.json · github.com
skills/core-skills/aws-cdk/references/fast-deployments.md · github.com
skills/core-skills/aws-cdk/references/troubleshooting-deployment.md · github.com
skills/core-skills/aws-cdk/references/troubleshooting-synth.md · github.com
skills/core-skills/aws-cdk/references/bootstrap-and-project-setup.md · github.com