Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/jpantsjoha/ai-native-developer-experience/aws-expertnpx skills add jpantsjoha/ai-native-developer-experience --skill aws-expertgit clone --depth 1 https://github.com/jpantsjoha/ai-native-developer-experienceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jpantsjoha/ai-native-developer-experience/aws-expert)<a href="https://agentmods.dev/skills/jpantsjoha/ai-native-developer-experience/aws-expert"><img src="https://agentmods.dev/badge/skills/jpantsjoha/ai-native-developer-experience/aws-expert.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.00976 |
| Opus 5 | $0.00026 | $0.00488 |
| Sonnet 5 | $0.00010 | $0.00195 |
| Haiku 4.5 | $0.00005 | $0.00098 |
Grade A, and why
aws-expert scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AWS Expert
The Well-Architected pillars are the floor, not the ceiling. On AWS, IAM and cost are where agent workloads blow up first.
This skill enforces the discipline that makes AWS workloads production-safe: identity, data boundaries, cost controls, and regional residency. It is not an AWS feature tour — it is a checklist of the things that cause incidents and compliance failures when skipped.
When to use
- Designing any AWS infrastructure (new or modified)
- Before deploying agents or LLM workloads to AWS (Bedrock, AgentCore, Strands)
- When reviewing a CloudFormation/CDK/Terraform plan for an AWS workload
- When a system spans multiple accounts, touches regulated data, or crosses regions
Procedure
-
Identity and IAM — verify least-privilege for every role and human principal:
- No wildcard
Action: "*"withResource: "*"on any role. Managed policies scoped to the specific function. - Roles over IAM users; IRSA for EKS, instance profiles for EC2. No long-lived access keys in workloads.
- SCPs at the OU level deny sensitive services by default; permission boundaries on delegated admin.
- CloudTrail enabled on all management and data-plane events, shipped to a log-archive account.
- No wildcard
-
Data boundaries — for every data store in the design:
- What data classification does it hold (public / internal / confidential / regulated)?
- S3 Block Public Access at account level; bucket policies explicit; KMS CMK where required.
- Cross-account sharing only via explicit resource policy with external ID.
- Tenant boundaries enforced at the data layer, not just the application layer.
-
Data residency — for each resource:
- Region allow-list enforced by SCP, not convention.
- For Bedrock / LLM calls: regional endpoints; check cross-region inference profiles where residency matters.
-
Cost controls — for every LLM, compute, or storage resource:
- AWS Budgets alerts at 50%, 75%, 90%, 100%.
- Bedrock invocation quotas/caps and rate limits set; unbounded agent loops are unbounded spend.
- Autoscaling maximums set; Savings Plans / Spot evaluated where appropriate.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 75 lines · 52 tokens per session scan A 82b4b848a556
aws-expert is a skill published in the GitHub repository jpantsjoha/ai-native-developer-experience (11 stars, last pushed 29d ago), licensed Apache-2.0. It adds 52 tokens to every session and 976 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
runbook
Generate and update feature release runbooks from existing docs and codebase. Use when: creating operational runbook, release handbook, deployment checklist, pre-release preparation. Not for: incident response (v2), code review (use codex-code-review), architecture design (use architecture).
aws-serverless
Provides AWS serverless architecture patterns for Lambda, API Gateway, DynamoDB, SQS, and SAM/CDK. Use when working with AWS serverless files (serverless.yml, CDK stacks) or when the user mentions Lambda, API Gateway, serverless, or AWS SAM.
mlops-engineer
Provides MLOps patterns for ML CI/CD pipelines, model registries, monitoring, and data drift detection. Use when setting up ML infrastructure or when the user mentions MLOps, model deployment, ML pipeline, or model monitoring.
hybrid-cloud-architect
Designs hybrid cloud architectures connecting on-premises infrastructure with public cloud services. Use when designing systems spanning on-prem and cloud, or when the user mentions hybrid cloud or multi-environment architecture.
openbkn-deploy
Deploy or upgrade OpenBKN on a customer-authorized Linux server through the repository's deploy scripts, with preflight checks, explicit confirmation, secret handling, and post-deployment verification.
cloud-run-puppeteer
Deploys Puppeteer browser automation on Google Cloud Run with Docker. Use when running headless browser tasks on Cloud Run, or when the user mentions Cloud Run, Puppeteer, headless Chrome, or serverless browser automation.