Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ericrisco/rsc-harness/aws-essentialsnpx skills add ericrisco/rsc-harness --skill aws-essentialsgit clone --depth 1 https://github.com/ericrisco/rsc-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ericrisco/rsc-harness/aws-essentials)<a href="https://agentmods.dev/skills/ericrisco/rsc-harness/aws-essentials"><img src="https://agentmods.dev/badge/skills/ericrisco/rsc-harness/aws-essentials.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00089 | $0.02933 |
| Opus 5 | $0.00044 | $0.01466 |
| Sonnet 5 | $0.00018 | $0.00587 |
| Haiku 4.5 | $0.00009 | $0.00293 |
Grade A, and why
aws-essentials scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 207 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AWS essentials — the core surface a small product needs, secured from the first command
Stand up the foundational AWS services a one-app product actually uses — IAM, S3, ECS Fargate, RDS, CloudFront — with the security defaults that prevent the incidents (public buckets, god-mode app roles, long-lived keys, unencrypted databases). Pick the right tier for small (one app, modest traffic, two engineers), provision it correctly, and wire it without foot-guns.
account hardening → IAM (roles + scoped policies) → S3 (private) / RDS (encrypted) / ECS Fargate → CloudFront (OAC) → infra exists, wired, least-privilege
Service decision table
| Need | Use | Use instead if |
|---|---|---|
| Object/file storage (uploads, assets, backups) | S3 (private bucket) | — |
| Relational data (users, orders, anything with joins) | RDS (Postgres/MySQL) | key-value / serverless access pattern → dynamodb skill |
| Long-running container/API | ECS Fargate | steady ~70%+ CPU 24/7 → EC2 launch type with Savings Plans/Spot; GPU or >120 GB RAM → EC2 |
| Static site / SPA + public assets | S3 + CloudFront | edge functions / global KV → ../cloudflare/SKILL.md |
| Tiny app, no real AWS need yet | be honest → ../vercel/SKILL.md or ../deployment/SKILL.md |
you genuinely need AWS primitives → stay here |
Fargate cold start is ~30–60 s; for spiky/variable small-product load its operational simplicity (no host patching, per-second billing, strong task isolation) wins. EC2 launch type only earns its host-management cost at sustained high utilization. (ECS Managed Instances, Sept 2025, is a newer hybrid — out of scope for a first setup.)
Account zero-day hardening checklist
Do this once, before anything else. Each line has a reason; skip none.
- Enable MFA on the root user — prefer a passkey / security key (phishing-resistant). Root with no MFA is the single highest-blast-radius account.
- Stop using root for daily work — root is for the handful of root-only tasks (close account, change support plan). Everything else uses an IAM identity.
- Create an admin identity via IAM Identity Center (or an assumable admin role). Humans log in to a role with temporary creds, not a static user.
- Delete any root access keys — root should have zero access keys. If one exists, it is a liability with no upside.
- No long-lived IAM-user access keys for apps or CI — apps use task roles, CI uses OIDC (see
../deployment/SKILL.md). - Set your home region and create resources there consistently (one exception below: ACM certs for CloudFront must be in
us-east-1). - Create a billing/cost budget alarm — a misconfigured resource should page you, not surprise you on the invoice.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 207 lines · 89 tokens per session scan A c468c4dfe14a
aws-essentials is a skill published in the GitHub repository ericrisco/rsc-harness (60 stars, last pushed 2d ago), licensed MIT. It adds 89 tokens to every session and 2,933 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
auditing-aws-s3-bucket-permissions
Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.
rds
AWS RDS relational database service for managed databases. Use when provisioning databases, configuring backups, managing replicas, troubleshooting connectivity, or optimizing performance.
moai-platform-database-cloud
Cloud database platform specialist covering Neon (serverless PostgreSQL), Supabase (PostgreSQL 16 with real-time), and Firebase Firestore (NoSQL with offline sync). Use when choosing or setting up cloud databases.
cis-aws-foundations-2.21
Ensure AWS resource policies do not allow unrestricted access using "Principal": "".
enumerating-cloud-with-cloudfox
Map AWS and Azure attack paths and find exploitable misconfigurations with CloudFox.
cis-aws-compute-5.7
Ensure you are using an IAM policy to manage access to buckets in Lightsail.