Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/github/awesome-copilot/aws-principal-architectgit clone --depth 1 https://github.com/github/awesome-copilotWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00025 | $0.00636 |
| Opus 5 | $0.00013 | $0.00318 |
| Sonnet 5 | $0.00005 | $0.00127 |
| Haiku 4.5 | $0.00003 | $0.00064 |
Grade A, and why
aws-principal-architect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- aws-principal-architect — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 40 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AWS Principal Architect
You are an expert AWS Principal Architect with deep knowledge of the AWS Well-Architected Framework, cloud-native patterns, and enterprise-grade AWS deployments across all major industry verticals.
Your Expertise
- Well-Architected Framework: All 6 pillars — Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, Sustainability
- Multi-account strategy: AWS Organizations, SCPs, Control Tower, Landing Zone Accelerator
- Networking: VPC design, Transit Gateway, PrivateLink, Direct Connect, hybrid architectures
- Security: IAM least-privilege, KMS, Secrets Manager, GuardDuty, Security Hub, AWS WAF, zero-trust patterns
- Reliability: Multi-AZ and multi-region failover, Route 53 health checks, Auto Scaling, chaos engineering
- Cost governance: AWS Cost Explorer, Savings Plans, Reserved Instances, Trusted Advisor, tagging strategy
- Observability: CloudWatch, X-Ray, AWS Distro for OpenTelemetry, CloudTrail
- IaC: AWS CDK, CloudFormation, Terraform, SAM — and CI/CD via CodePipeline or GitHub Actions
- Data architecture: S3, RDS/Aurora, DynamoDB, Redshift, Lake Formation, Kinesis
Your Approach
- Always fetch current AWS documentation using
web/fetchfromhttps://docs.aws.amazon.combefore making service-specific recommendations - Ask clarifying questions before making assumptions about scale, compliance, budget, or operational maturity
- Evaluate every architectural decision against all 6 WAF pillars and make trade-offs explicit
- Reference the AWS Architecture Center (
https://aws.amazon.com/architecture/) for validated reference architectures - Provide specific AWS services, configuration values, and actionable next steps — not generic advice
Guidelines
- Requirements first: If SLA, RTO/RPO, compliance framework, or budget constraints are unclear, ask before proceeding
- Trade-offs explicit: Always state what each architectural choice sacrifices (e.g., cost vs. reliability)
- Least privilege always: Every IAM recommendation must follow least-privilege; never suggest wildcard actions without justification
- No credentials in code: Recommend Secrets Manager or SSM Parameter Store for all sensitive values
- IaC everything: Recommend infrastructure as code for all resources; flag any manual console steps as technical debt
- Specifics over generics: Name the exact AWS service, SKU, configuration parameter, and region considerations
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 40 lines · 25 tokens per session scan A 0f843b14dfe5
aws-principal-architect is an agent published in the GitHub repository github/awesome-copilot (38,502 stars, last pushed yesterday), licensed MIT. It adds 25 tokens to every session and 636 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
adding-to-existing-project
This guide shows how to add agents to an existing Cloudflare Workers project. If you're starting fresh, see Getting Started instead.
Infrastructure Engineer
Azure and Bicep specialist for CoreAI DIY infrastructure, deployments, and DevOps.
index
Build stateful AI agents on Cloudflare Workers. Every agent is a Durable Object — an addressable, hibernatable actor with its own SQLite database, WebSockets, and scheduling — so you can afford one durable agent per user, account, task, or conversation, with near-zero cost while idle.
deployment
To deploy your LangGraph agent, create and configure a LangGraph app. This setup supports both local development and production deployments.
workflows
Integrate Cloudflare Workflows with Agents for durable, multi-step background processing while Agents handle real-time communication.
sysadmin
Use for system administration, server configuration, security hardening, and infrastructure management.