aws-serverless Skill (AWS) for Claude: What It Does and How to Install It

Makes Claude pick the right AWS serverless design: Lambda form factor, orchestration, eventing and API front door.

Installs: 10.5K; on skills.sh
Stars: 3.4K; on GitHub
Files: 11; besides SKILL.md
Updated: Oct 2026; last repo commit

This is Amazon Web Services' router for serverless work. SKILL.md makes one opinionated recommendation per application component, then hands off to the specialized skill that owns it, such as Web Functions, MicroVMs, Managed Instances, Durable Functions, Step Functions or the EventBridge event bus.

It also keeps the shared Lambda references that have no skill of their own: cold starts, SnapStart, concurrency, event sources, API Gateway, deployment, production readiness and troubleshooting. The folder has one Python asset, a Powertools handler template.

Good for

Developers starting a new serverless app on Lambda
Teams cutting Lambda cost or cold starts
Engineers moving workloads off EC2 or ECS
Anyone debugging Lambda, API Gateway or Step Functions errors

Install aws-serverless

Claude Code

Copy this prompt.

Install the aws-serverless skill in Claude Code. Run this command:

/plugin install aws-core@claude-plugins-official

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Pick one route. The plugin route installs aws-core: 25 skills (counted from plugins/aws-core/skills in the repo tree), an AWS MCP server entry in .mcp.json, and a PreToolUse hook that runs secret-safety.py. The skills routes install skill files only. The README says you need uv, and an AWS account with credentials set up locally for API calls and scripts. This skill hands off to specialized skills in the repo's skills/specialized-skills folder, such as aws-lambda-web-functions and aws-step-functions. The whole-repo skills CLI command installs them; the plugin and single-skill routes do not.

From the project README. Source.

What's in the skill

When it loads

Routes serverless requests to a compute form factor and the skill that owns it. Applies first to Lambda, API Gateway, EventBridge, Step Functions and event-driven work while the compute, orchestration or integration choice is open — API backends, webhooks, jobs, cron, queue/stream consumers, durable workflows, event routing, Step Functions vs Durable Functions, and Pipes vs native event source mappings for queues and streams. Decides Event Functions on-demand vs Managed Instances, Web Functions, MicroVMs, EventBridge rules/Scheduler/Pipes/bus, HTTP vs REST API. Owns shared Lambda references (cold starts, SnapStart, concurrency, event sources, function URLs, throttling, troubleshooting). Defers to the specialized skill once a request commits to one form factor or service, or describes its defining feature, even unnamed (durable checkpointing and automatic step retries, Firecracker sandbox, managed instances, Node.js server). Not for EC2, ECS/EKS/Fargate or Amplify hosting.

Sections in SKILL.md

Overview
Rules (apply to every recommendation)
Step 0 — Entry point: what is the user doing?
Step 1 — Direct routes (the request already names the technology)
Step 2 — Compute decision flow
Tier 1 — Match the workload to a form factor
Tier 2 — Web Functions vs Event Functions
Tier 3 — Capacity provider (Event Functions only)
Tier 4 — Edge cases (after form factor and capacity are locked)
Hand-off after the decision
Step 3 — Orchestration: Durable Functions vs Step Functions
Step 4 — Eventing: which EventBridge capability
Step 5 — HTTP front door
Step-by-step task procedures (tested CLI SOPs)
Shared references in this skill
Security considerations

Key facts

Author: Amazon Web Services (vendor's own repo; named in the aws-core plugin manifest)
License: Apache-2.0
Installs on skills.sh: 10,476 (Nov 2, 2026)
GitHub stars: 3,366 for the whole aws/agent-toolkit-for-aws repo (Nov 2, 2026)
Last repo commit: Oct 30, 2026
What it includes: 12 files including SKILL.md: 10 reference guides and 1 asset, assets/powertools-handler.py (the repo has no other scripts in this folder)
skills.sh audits: Gen Agent Trust Hub: pass; Socket: pass; Snyk: pass (Nov 2, 2026)
Needs: Works best with the AWS MCP server, and also works with standard AWS CLI access, per SKILL.md. The README says local AWS credentials are needed for API calls
Part of: The aws-core plugin (version 1.2.0) in aws/agent-toolkit-for-aws: 25 skills counted from the plugin folder, an AWS MCP server entry and a PreToolUse hook
Works in: Claude Code, Codex, Cursor, Devin, Kiro and fx, per the README

What it includes

New application, optimizing an existing one, or moving a workload to serverless
Step 0: Entry point
Seven routes, from Event Functions and Web Functions to Step Functions and the event bus
Step 1: Direct routes
Four tiers: form factor, Web vs Event Functions, capacity provider, edge cases
Step 2: Compute decision flow
Durable Functions versus Step Functions
Step 3: Orchestration
Which EventBridge capability to use
Step 4: Eventing
API Gateway HTTP or REST API, WebSocket API, or a Function URL
Step 5: HTTP front door
Seven procedure skills, such as debugging-lambda-timeouts
These are separate skills that this one points to; their steps are not part of this skill.
Task procedures
Ten guides: Lambda, concurrency, events, API Gateway, deployment, production
Shared references
AWS CLI fixes such as add-permission, put-function-concurrency and quota requests
Runs code · Troubleshooting commands
A Python Lambda handler with Logger, Tracer, Metrics and Idempotency
Write · Powertools handler template
Least-privilege roles, no open access by default, protected workflow state, WAF
Security considerations

From the official docs

Permissions

Medium risk

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

A fix makes a Function URL public
The 403 fix grants lambda:InvokeFunctionUrl to principal '*' with auth type NONE. Use it only for a function meant to be public; SKILL.md says AuthType NONE is never a default. github.com
The emergency stop disables a function
For a recursive invocation loop, the guide sets reserved concurrency to 0 with put-function-concurrency. That stops all runs of that function until you change it back. github.com
The plugin route adds an AWS MCP server and a hook
aws-core's .mcp.json starts mcp-proxy-for-aws-cli 1.7.0 through uvx against https://aws-mcp.us-east-1.api.aws/mcp with a --skip-auth flag. Its hook runs secret-safety.py before Bash and AWS tool calls, and the script denies direct Secrets Manager value fetches. The script has a 5 second timeout, and its own comment says a hang would let the call through. github.com
Dev-only deploys skip CloudFormation safety
The deployment guide says sam sync and cdk deploy --hotswap bypass CloudFormation safety and introduce drift. Keep them out of production. github.com
Quota requests and deletes change your account
Troubleshooting lists quota increase requests, deleting old versions and layers, and continue-update-rollback with --resources-to-skip. Confirm the target before each one. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	No read-only mode in the skill. Use an AWS role with limited permissions.
Talks to	AWS APIs, through the AWS CLI or the AWS MCP server. aws-mcp.us-east-1.api.aws, if you use the plugin route
Sign-in and keys	SKILL.md does not store credentials. It uses the AWS credentials or MCP server access you have set up.
Scopes	Claude can run AWS CLI commands from the troubleshooting guide, such as aws lambda add-permission, put-function-concurrency and service-quotas request-service-quota-increase The deployment guide lists sam sync and cdk deploy --hotswap, which it calls development-only The troubleshooting guide lists rm -rf .aws-sam/cache and deleting old Lambda versions and layers

Questions

How do I install the aws-serverless skill?

Use the install box at the top of this page. The README documents the aws-core plugin for Claude Code and a skills CLI command for the whole repo. Use the whole-repo command if you want the specialized skills that this one hands off to.

What does the aws-serverless skill do?

It tells Claude which AWS serverless building blocks to use and why. Claude walks a decision flow for compute, orchestration, eventing and the HTTP front door, then follows the skill that owns each choice.

Is this an official AWS skill?

Yes, it is in the vendor's own repo: AWS's aws/agent-toolkit-for-aws, and the aws-core plugin manifest names Amazon Web Services as author.

Why does it point to other skills?

SKILL.md calls itself a router. It keeps only the Lambda reference material that has no dedicated skill, and hands off to skills such as aws-lambda-web-functions and aws-step-functions once a choice is made. SKILL.md also says that if a routed skill is missing, the decision still stands.

Does it need the AWS MCP server?

No. SKILL.md says it works best with the AWS MCP server, and that all guidance also works with standard AWS CLI access. The README says local AWS credentials are needed for API calls.

Should an HTTP API or a REST API go in front of Lambda?

SKILL.md defaults to API Gateway HTTP API, which it says costs up to about 70% less per request than REST API and has lower latency. It moves to REST API only for features such as WAF, usage plans, caching and request validation.

Is it safe?

The skill bundles one Python template and no other scripts, but its troubleshooting guide lists AWS CLI commands that change your account, such as opening a Function URL to everyone or setting concurrency to 0. The plugin route also adds an AWS MCP server and a hook. Read each command before you approve it.

Information

updated Nov 2, 2026

Repository: aws/agent-toolkit-for-aws
Folder: skills/core-skills/aws-serverless

aws/agent-toolkit-for-aws skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 10

aws-serverless SKILL.md · github.com
troubleshooting.md · github.com
deployment.md · github.com
lambda.md · github.com
powertools-handler.py · github.com
agent-toolkit-for-aws README · github.com
aws-core plugin.json · github.com
aws-core hooks.json · github.com
secret-safety.py · github.com
aws-core .mcp.json · github.com