aws-containers Skill (AWS) for Claude: Run Containers on EKS, ECS, Fargate and ECR

Gives Claude AWS's own guides for running containers on EKS, ECS, Fargate, ECR and Elastic Beanstalk.

Installs: 9.8K; on skills.sh
Stars: 3.4K; on GitHub
Files: 17; besides SKILL.md
Updated: Oct 2026; last repo commit

This skill is from AWS's own agent-toolkit-for-aws repo. SKILL.md is a short router: it sends Claude to one of four service guides (EKS, ECS, ECR or Elastic Beanstalk) and tells it to read the reference file before answering instead of relying on memory. The folder has 18 files including SKILL.md, with 17 references.

One reference covers ECS Action Logs. SKILL.md tells Claude to read it when an ECS deployment rolls back or a task fails to place, and to decide whether to recommend turning the logs on. SKILL.md also notes that AWS App Runner is sunset as of April 30, 2026 and points to ECS Express Mode.

The skill lists allowed-tools: Read and works best with the AWS MCP Server. AWS CLI access also works.

Good for

Teams deploying containers on ECS or Fargate
Kubernetes users running EKS, Karpenter or the AWS Load Balancer Controller
Engineers debugging ECS deployment rollbacks and task placement
Anyone setting up an ECR repository with lifecycle policies

Install aws-containers

Claude Code

Copy this prompt.

Install the aws-containers skill in Claude Code. Run this command:

/plugin install aws-core@claude-plugins-official

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Pick one route. The aws-core plugin installs 25 skill folders (counted in the repo tree for plugins/aws-core/skills), a hook that runs secret-safety.py before Bash and AWS tool calls, and an AWS MCP server config. The skills-only routes and the Claude app upload install just this skill. The README says you need uv and local AWS credentials for API calls and scripts. After the Codex plugin command, run /plugins in Codex and install aws-core.

From the project README. Source.

What's in the skill

When it loads

Builds and deploys containerized workloads on Elastic Kubernetes Service (EKS), Elastic Container Service (ECS), Fargate, and ECR (Elastic Container Registry). Covers general EKS knowledge, Karpenter, AWS Load Balancer Controller and leveraging various open source Kubernetes projects with EKS. Covers general ECS knowledge, task definitions, Fargate services, ECS Exec, ECS Express Mode and ECS Managed Instances. Covers general Elastic Beanstalk knowledge, Elastic Beanstalk configuration and platforms supported by Elastic Beanstalk. Covers general ECR knowledge, ECR repository setup and lifecycle policies. Includes recommending, enabling, and reading Amazon ECS Action Logs to troubleshoot control-plane failures (deployment rollback/circuit-breaker, task placement, scaling, task replacement). Applies when deploying, debugging, or optimizing containers on AWS. Should be used instead of relying on internal knowledge for these services.

Sections in SKILL.md

Overview
Guardrail — where this skill's own files live (MCP vs local install)
Services
Elastic Kubernetes Service (EKS)
Elastic Container Service (ECS)
Elastic Container Registry (ECR)
Elastic Beanstalk
AWS App Runner
Routing

Key facts

Author: Amazon Web Services (the vendor's own repo, per the aws-core plugin.json)
License: Apache-2.0 (README badge and plugin.json)
Installs on skills.sh: 9,762 (Nov 2, 2026)
GitHub stars: 3,366 for the whole repo (Nov 2, 2026)
Last repo commit: Oct 30, 2026
What it includes: 18 files including SKILL.md: 17 reference files (no scripts)
Needs: AWS CLI access, ideally with the AWS MCP Server
Part of: The aws-core plugin (version 1.2.0) in aws/agent-toolkit-for-aws. The plugin folder has 25 skill folders, a hook and an MCP config
Works in: Claude Code, Codex, Cursor, Devin, Kiro and fx, per the README. Plugins exist for Claude Code, Codex, Cursor and Devin

What it includes

Kubernetes on AWS: control plane, networking, compute, Auto Mode, capabilities
Seven files: an index plus auto mode, capabilities, control plane, load balancer controller, compute and networking.
EKS guide
Task definitions, Fargate services, ECS Exec, Express Mode, managed instances
Five files: an index plus workloads, gateway, GPU sharing and managing compute.
ECS guide
Repository setup, image push and scanning, lifecycle policies
The ECR reference shows creating a repository, docker build, tag and push, image scans and lifecycle rules.
Runs code · ECR guide
Beanstalk basics, configuration and supported platforms
Three references: an index, configuration and platforms.
Elastic Beanstalk guide
Read the action-logs reference when a deployment rolls back or tasks will not place
The reference shows commands such as aws logs create-log-group and create-delivery to turn Action Logs on.
Runs code · ECS Action Logs
A routing table sends each service to its reference file
Load the right reference
Reads references locally, or through retrieve_skill when loaded from the AWS MCP Server
SKILL.md says that when the skill is loaded through the AWS MCP retrieve_skill tool, the agent fetches each reference with that tool instead of reading local files.
MCP or local files

From the official docs

Permissions

Medium risk

The skill is a set of guides, but they show AWS commands that create real resources. Use a sandbox account and read each command before it runs.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

The references show commands that create AWS resources
They include eksctl create podidentityassociation and helm install (eks-load-balancer-controller.md), aws iam create-policy, aws eks create-nodegroup (eks-managing-compute.md) and docker push (ecr.md). Use a sandbox account and read each command before Claude runs it. github.com
The plugin route adds a hook and an MCP server
aws-core's .mcp.json starts mcp-proxy-for-aws-cli 1.7.0 through uvx against https://aws-mcp.us-east-1.api.aws/mcp with a --skip-auth flag. Its hook runs secret-safety.py before Bash and AWS tool calls, and the script denies direct Secrets Manager value fetches. The script has a 5 second timeout, and its own comment says a hang would let the call through. Use the skills-only routes if you want just this skill. github.com
Turning on ECS Action Logs changes your logging setup
The action-logs reference shows creating a log group, a delivery source and destination, and a resource policy. Check the account and region first. github.com
It downloads a policy file and shows image-expiry rules
eks-load-balancer-controller.md runs curl to fetch iam_policy.json from raw.githubusercontent.com (kubernetes-sigs/aws-load-balancer-controller) before creating the IAM policy. ecr.md shows lifecycle rules that expire images. Check the downloaded policy and the expiry rules before you apply them. github.com

Technical details

Turning on read-only	SKILL.md has no read-only mode.
Talks to	raw.githubusercontent.com (eks-load-balancer-controller.md downloads iam_policy.json with curl). aws-mcp.us-east-1.api.aws, if you use the plugin route
Scopes	Frontmatter lists allowed-tools: Read References show aws, eksctl, helm and docker commands that create IAM policies, node groups, log delivery and images

Questions

What does the aws-containers skill do?

It gives Claude AWS-written guides for EKS, ECS, Fargate, ECR and Elastic Beanstalk. SKILL.md tells Claude to read the matching reference before it answers, instead of relying on what it remembers.

Is this skill made by AWS?

Yes. It sits in the vendor's own repo, aws/agent-toolkit-for-aws, and the plugin that bundles it names Amazon Web Services as author.

How do I install aws-containers?

Use the install box at the top of this page. The README's Claude Code route installs the whole aws-core plugin (25 skill folders). The box also has skills-only routes and a Claude app upload for just this skill.

Does it need the AWS MCP Server?

No, but SKILL.md says it works best with it. The MCP Server lets Claude run CLI commands, query CloudWatch and check configs. SKILL.md says all the guidance also works with standard AWS CLI access.

What does the aws-core plugin add besides the skill?

A hook that runs a Python script before Bash and AWS tool calls and blocks direct fetching of Secrets Manager secret values, plus an AWS MCP server config that runs through uvx. The plugin folder also holds the other skills.

Can it change my cluster or registry?

The frontmatter lists allowed-tools: Read, but its references show commands that create resources: eksctl create, helm install, aws iam create-policy, aws logs put-resource-policy and docker push. Claude can run them if you let it, so read each command first.

Does it cover AWS App Runner?

Only to say it is sunset as of April 30, 2026, with no new customers or features. SKILL.md tells existing customers to move to ECS Express Mode.

Is it safe to install?

The folder holds markdown files and bundles no scripts. The risk comes from the AWS commands in the references, which can create IAM policies, install controllers and push images. Use a sandbox account and review commands before they run.

Information

updated Nov 2, 2026

Repository: aws/agent-toolkit-for-aws
Folder: skills/core-skills/aws-containers

aws/agent-toolkit-for-aws skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 10

skills/core-skills/aws-containers/SKILL.md · github.com
README.md · github.com
plugins/aws-core/.claude-plugin/plugin.json · github.com
plugins/aws-core/com.anthropic.claude-code/hooks/hooks.json · github.com
plugins/aws-core/com.anthropic.claude-code/hooks/secret-safety.py · github.com
plugins/aws-core/.mcp.json · github.com
skills/core-skills/aws-containers/references/ecr.md · github.com
skills/core-skills/aws-containers/references/eks-load-balancer-controller.md · github.com
skills/core-skills/aws-containers/references/action-logs.md · github.com
skills/core-skills/aws-containers/references/eks-managing-compute.md · github.com