aws-cloudformation Skill from AWS: Author, Validate and Troubleshoot CloudFormation

• Sets up the CloudFormation Language Server in an editor or AI client

  Points to a guide for completion, diagnostics, hover docs and refactoring. It tells the agent to follow AWS Toolkit or standalone install docs.

  Runs code · Configure template intelligence

• Reads embedded Description, Metadata and comments to explain intent

  A read-only use. If a template has little context, the agent infers purpose from its resources and structure.

  Try: “What does this CloudFormation template do and why?”

  Read · Understand or document a template

• Applies secure defaults, a best-practices checklist and a property lookup

  Defaults include blocking public S3 access, encryption, Retain policies on stateful resources, no hard-coded names and no plain-text secrets. It also records design context in Metadata and adds an AWSAgentToolkit marker.

  Write · Author or modify a template

• Local validator, then cfn-guard, then account-aware pre-deployment checks

  Each layer is reported separately. Pre-deployment validation uses CloudFormation change sets in your account. Tool installs need your approval.

  Runs code · Validate before deploy

• Uses create-stack or update-stack with Express mode for fast dev feedback

  Not for production flows needing resources ready at once. SKILL.md says Express is not CDK hotswap and that aws cloudformation deploy does not support it.

  Delete · Deploy with Express mode

• Classifies failures and rollback cascades from events and CloudTrail

  Uses describe-events, not the legacy describe-stack-events.

  Network · Troubleshoot a failed stack

• Six must-follow checks before editing exports, conditions, security groups and more

  Cross-stack references, conditional resource coupling, security group blast radius, DeletionPolicy, parameter propagation and template size limits, each detailed in template-safety-guidance.md.

  Read · Safety procedures

Watch out for

• It can change and delete live AWS stacks

  Procedures cover create-stack, update-stack, change sets and delete-stack, and say to get your explicit approval first. Validation creates change sets in your account, and the CREATE type leaves a stack in REVIEW_IN_PROGRESS until cleaned up. github.com

• Express mode turns rollback off by default

  SKILL.md says rollback is disabled by default in Express mode and resources keep stabilizing after the command returns. Do not use it for production flows. github.com

• The plugin adds an AWS MCP server with your AWS access

  aws-core's .mcp.json runs uvx mcp-proxy-for-aws-cli==1.7.0 against https://aws-mcp.us-east-1.api.aws/mcp. The plugin README says it gives authenticated access to 300+ AWS services through call_aws and runs sandboxed Python through run_script. github.com

• The plugin adds two hooks that read tool calls

  hooks.json runs secret-safety.py before every Bash call and before AWS and MCP tool calls. The script reads the call as JSON on stdin and returns a deny when it sees a direct Secrets Manager secret fetch; otherwise it exits without output. github.com

• It installs checking tools only with your approval

  cfn-lint, cfn-guard and the AWS CLI are installed after the agent asks you; the references say never to run install commands without approval. github.com

• It adds an attribution marker to templates

  On any template it creates or edits, SKILL.md says to add Metadata.AWSToolsMetrics.AWSAgentToolkit with the value aws-cloudformation@3. Remove it if you do not want it in your template. github.com