aws-observability Skill for Claude: What It Does and How to Install It

Makes Claude work with AWS monitoring: CloudWatch logs, metrics, alarms, dashboards and traces, plus CloudWatch Omni queries and alerts.

Installs: 10.3K; on skills.sh
Stars: 3.4K; on GitHub
Files: 53; besides SKILL.md
Updated: Oct 2026; last repo commit

This is AWS's own guide for observability work. It first decides whether you mean classic CloudWatch or CloudWatch Omni, then loads the matching reference files for queries, alarms, alerts, dashboards, tracing, service health, root-cause analysis and agent evaluation.

It covers services that already report data. SKILL.md routes first-time setup (creating an Omni Space, access grants, Application Signals onboarding) to a different skill, setting-up-cloudwatch-observability, and tells Claude to decline requests that are not about AWS observability.

It can run AWS CLI commands and bundled Python scripts with your AWS credentials. Some of them create or delete real resources, so read the safety notes below.

Good for

Engineers debugging a service on AWS from logs and traces
SREs writing alarms, dashboards and Log Insights queries
Teams scoring AI agent quality from CloudWatch Omni traces
Developers placing live breakpoints on running services

Install aws-observability

Claude Code

Copy this prompt.

Install the aws-observability skill in Claude Code. Run this command:

/plugin install aws-core@claude-plugins-official

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Pick one route. The aws-core plugin installs 25 skills (counted from plugins/aws-core/skills in the repo tree), an AWS MCP server entry in .mcp.json, and a PreToolUse hook that runs secret-safety.py. The skills routes install skill files only. SKILL.md uses the AWS CLI and AWS credentials, and its scripts need Python with boto3. It works best with the AWS MCP server but says all guidance also works with standard AWS CLI access. For Codex the README then says to launch Codex, run /plugins and install aws-core.

From the project README. Source.

What's in the skill

When it loads

Investigates root causes on the Omni context graph (service dependencies) and Intelligence insights; builds, configures, debugs, tunes AWS observability - operator-symptom questions, detecting Omni vs classic CloudWatch. CloudWatch on a reporting service: fleet health views, Log Insights, metric/composite/anomaly alarms, custom metrics/EMF, dashboards, X-Ray/ADOT tracing, canaries, CloudTrail, Dynamic Instrumentation (live breakpoints), and Application Signals service map. CloudWatch Omni on an existing Space: SQL over logs/traces, PromQL, Omni dashboards, alerts and Slack notifications, programmatic/IaC access (API/SDK/CLI/CFN), driving Omni from a coding agent or skills, AI agent quality from traces - on-demand and online evaluation of live traffic, incl. setting it up, readback, evaluators. For first-time setup - creating an Omni Space, granting access, ingestion, or ADOT instrumentation for Application Signals or Omni - use setting-up-cloudwatch-observability. Not for app logging or threat detection.

Sections in SKILL.md

Overview
Scope guard — is this an observability request?
Step 0 — CloudWatch or CloudWatch Omni?
Step 0.5 — Service-health investigation (routing)
Must-state checklists — the output contract
Routing — CloudWatch (references/cloudwatch/)
Routing — CloudWatch Omni (references/cloudwatch-omni/)
Files
references/cloudwatch/
references/cloudwatch-omni/

Key facts

Author: Amazon Web Services (vendor's own repo)
License: Apache-2.0 (repo README badge; SKILL.md states none)
Installs on skills.sh: 10,330 (Nov 2, 2026)
GitHub stars: 3,366 for the whole aws/agent-toolkit-for-aws repo (Nov 2, 2026)
Last repo commit: Oct 30, 2026
What it includes: 54 files including SKILL.md: 25 reference files, 2 asset templates and 26 Python scripts (one is a test)
Needs: The AWS CLI and AWS credentials for live queries. The scripts need Python with boto3. SKILL.md says it works best with the AWS MCP server
Part of: The aws-core plugin in aws/agent-toolkit-for-aws: 25 skills counted from the plugin folder, an AWS MCP server entry and a PreToolUse hook
Works in: Claude Code, Codex, Cursor, Devin, Kiro and fx, per the README

What it includes

Declines requests that are not AWS observability
Tells Claude to say a request is out of scope in one sentence and to name what the skill covers.
Read · Scope guard
Probes with aws cloudwatchomni list-domains and list-spaces
Decides which product you mean from your wording. If unclear it checks the target Region for an Omni Space. It must never run an upgrade or installer on your machine itself.
Try: “Which of my Lambda functions are throttled? Check CloudWatch.”
Runs code · Step 0: CloudWatch or Omni?
Routes symptom questions to the right reference
Handles questions such as "is my service healthy" or "what does it depend on" by starting from telemetry and, for causes, reading resource configuration.
Read · Step 0.5: service health
Required facts for alerts, evaluation, traces and dashboards
Four tasks carry a checklist in the reference file that the answer has to include.
Read · Must-state checklists
Log Insights, alarms, metrics and EMF, tracing, dashboards
Also canaries, CloudTrail auditing, troubleshooting and failure investigation. 13 reference files in references/cloudwatch, 3 of them under dynamic-instrumentation/.
Read · CloudWatch references
alarm-template.ts and otel-config.yaml
A CDK Lambda monitoring template with alarms and a dashboard, and an ADOT collector config for X-Ray traces and EMF metrics.
Write · Asset templates
Live breakpoints and snapshots via di_instrumentation.py and di_snapshots.py
Creates and deletes breakpoints on a running service and reads captured snapshots. SKILL.md says to confirm with you before any create or delete.
Delete · Dynamic Instrumentation
SQL over logs and traces, PromQL for metrics, named views
Query references for CloudWatch Omni data, including slowest and failed spans.
Network · Omni queries and views
Author and save dashboards and alerts through the API
Covers the create, update and delete APIs for Omni dashboards and alerts.
Write · Omni dashboards and alerts
Insights, observations, dependencies, blast radius, health verdicts
Root-cause and dependency questions using ListInsights, ListObservations and GetContextGraph.
Network · Omni Intelligence and context graph
evaluate_traces.py and capture_dataset_from_traces.py
Scores agent traces with AgentCore evaluators and can build an evaluation dataset from traces. Both run with your AWS credentials.
Runs code · Agent evaluation
Omni API, SDK, CLI, CloudFormation and CDK
Explains the public Omni API and how access grants authorize a caller.
Read · Programmatic access
Routes first-time setup to setting-up-cloudwatch-observability
Setup of Omni or Application Signals is out of scope for this skill.
Read · Hand-off to setup

From the official docs

Permissions

Medium risk

Claude runs AWS CLI commands and bundled Python scripts with your AWS credentials, and some of them create or delete real resources. Use a role limited to what you need and approve each write.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

Live breakpoints modify running services
The Dynamic Instrumentation reference says it modifies live services and captures live data, including arguments and locals that may hold secrets or personal data. Confirm each create and delete, and delete breakpoints when done. github.com
Breakpoints can keep running
A BREAKPOINT expires after ttl_hours (24h by default) but a PROBE never expires on its own. Remove them when the investigation ends, and delete snapshot files written with --out. github.com
Evaluation scores are saved to CloudWatch Logs
By default evaluate_traces.py writes each score, including the judge's explanation, to a results log group, creating it with 30-day retention if missing. Pass --no-writeback to persist nothing. github.com
The dataset script writes a real resource
capture_dataset_from_traces.py refuses to write without --i-have-confirmed, which only asserts that you confirmed. Check it is added only after you agree. github.com
The plugin route adds an AWS MCP server and a hook
aws-core's .mcp.json starts mcp-proxy-for-aws-cli 1.7.0 through uvx against https://aws-mcp.us-east-1.api.aws/mcp with a --skip-auth flag. Its PreToolUse hook runs secret-safety.py before Bash and AWS tool calls, with a 5 second timeout. The skills-only routes add neither. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	No read-only mode. Use version control.
Talks to	AWS APIs through the AWS CLI and boto3 (CloudWatch, CloudWatch Omni, CloudWatch Logs, Application Signals, AgentCore). aws-mcp.us-east-1.api.aws if you use the plugin route
Sign-in and keys	SKILL.md does not store credentials. The scripts use your AWS profile and Region from the environment (AWS_PROFILE, AWS_REGION, AWS_DEFAULT_REGION) or flags.
Scopes	Claude runs aws CLI commands such as aws cloudwatchomni list-domains and list-spaces with your credentials Bundled boto3 scripts create and delete Dynamic Instrumentation breakpoints on live services evaluate_traces.py writes scores to CloudWatch Logs and can create a results log group capture_dataset_from_traces.py creates or extends an AgentCore evaluation dataset

Questions

What does the aws-observability skill do?

It teaches Claude how to work with AWS monitoring on services that already report data. Claude uses it for CloudWatch logs, metrics, alarms, dashboards and traces, and for CloudWatch Omni queries, alerts and agent evaluation.

How do I install aws-observability?

Use the install box at the top of this page. It lists the aws-core plugin and two skills-only commands.

Is this skill from AWS?

Yes. It is in AWS's own repo, aws/agent-toolkit-for-aws, and the README says the plugins are on the official Anthropic marketplace.

What is CloudWatch Omni?

SKILL.md describes it as a separate product that shares the CloudWatch name. It reads OpenTelemetry logs, traces and metrics through a Space, with SQL and PromQL queries, alerts and a context graph. Classic CloudWatch uses log groups, alarms and Log Insights.

Does it set up CloudWatch or Omni for me?

No. SKILL.md says it covers using both products and never setting them up. First-time setup goes to the setting-up-cloudwatch-observability skill, which is in the repo's specialized-skills folder and not in the aws-core plugin.

Does it need AWS credentials?

For live queries, yes. SKILL.md has Claude run the AWS CLI, and the bundled Python scripts use boto3 with the credentials and Region you have set. Knowledge questions are answered from its reference files without probing your account.

Does it work in the Claude app?

The install box has no Claude app upload for it, because the skill runs the AWS CLI and Python scripts on your computer. Use Claude Code or Codex. The README also names Cursor, Devin, Kiro and fx.

Is it safe?

It acts with your AWS credentials, so give it a role limited to what you need. It can run bundled scripts that create and delete live breakpoints, write evaluation results to CloudWatch Logs and create datasets. SKILL.md says to confirm with you before creating or deleting breakpoints, and the dataset script refuses to write without a confirmation flag.

Information

updated Nov 2, 2026

Repository: aws/agent-toolkit-for-aws
Folder: skills/core-skills/aws-observability

aws/agent-toolkit-for-aws skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 7

aws-observability SKILL.md · github.com
agent-toolkit-for-aws README · github.com
aws-core .mcp.json · github.com
aws-core hooks.json · github.com
dynamic-instrumentation.md · github.com
evaluate_traces.py · github.com
capture_dataset_from_traces.py · github.com