Codex skills for AWS
These skills have Codex work on AWS from evidence: Lambda tuning from REPORT log lines, cost cuts from Cost Explorer down to the usage type, and IAM policies scoped to exact actions and ARNs and checked with Access Analyzer. ECS on Fargate, S3, DynamoDB, SQS and SNS, RDS, CloudFront and CDK each follow their own rules, and cost work deletes or buys nothing without approval.
Start with these 3
- AWS Lambda Faster cold starts, no reprocessed batches Codex tunes Lambda functions from REPORT log numbers rather than guesses: init duration, billed duration and max memory drive packaging, memory and architecture choices. It keeps handlers thin with clients created at init, gives every trigger a defined retry and dead-letter path, and uses reserved or event-source concurrency to keep downstream databases alive.
- AWS CDK Infrastructure code that never replaces your database Codex structures CDK apps with stateful and stateless stacks apart, explicit environments and typed per-stage config. It treats logical ID changes as a data-loss risk, reads every cdk diff for replacements and IAM widening before a deploy, and writes assertion tests plus cdk-nag checks for the properties that matter instead of snapshot tests nobody reads.
- AWS IAM Policies Least privilege you can prove, not promise Codex maps every API call a workload makes to its exact action, ARN and condition keys, then writes one scoped statement per resource type. It locks GitHub OIDC trust to a repo and environment, scopes iam:PassRole, reasons through SCPs and boundaries when debugging AccessDenied, and checks the result with a bundled offline lint script plus Access Analyzer validation.
19 more AWS skills
-
AWS S3
Private buckets, direct uploads, bounded storage bills -
AWS ECS Fargate
Container deploys that roll themselves back -
AWS Cost Optimization
Every saving traced to a line on the bill -
AWS Step Functions
Workflows where every failure has somewhere to go -
AWS CloudFront
High hit ratios without stale deploys -
AWS API Gateway
Pick the right API type, then lock every route -
AWS SAM
Local invokes, reviewed change sets, canary releases -
AWS CloudWatch
Logs Insights, honest alarms, smaller bills -
AWS EventBridge
Event routing with tested patterns and no lost events -
AWS RDS and Aurora
Failovers, upgrades and restores you have rehearsed -
AWS SQS and SNS
Queues that never lose or double-charge -
DynamoDB Single-Table Design
Every access pattern is one Query, checked by script -
File Uploads
Size-capped, sniffed, scanned before anyone sees it -
Secrets Management
No plaintext keys, rotation you have rehearsed -
Infrastructure Drift
Catch console changes before the next apply does -
SST v3 Apps
TypeScript infrastructure with links, not hardcoded ARNs -
Cloud Security Posture
Rank by exposure, fix the top ten -
File Upload Security
Uploads that never run, render or overflow -
WAF Rules
Count first, block later, except narrowly
General skills with AWS guidance
Not built around AWS, but they include steps or tools for it. Not part of the install-all command.
-
GitHub Actions Security
Read-only tokens, SHA pins, no injected titles -
SQLite in Production
WAL, short writes and backups that restore -
Serverless Postgres
Pooled at runtime, direct for migrations, branched per PR -
Connection Pooling
Fit every pool inside max_connections -
Document AI and OCR
Route each page, keep confidences, review the doubtful -
Backup and Disaster Recovery
A backup counts once it has been restored -
Google Cloud Run
Private by default, scaled on purpose -
Cloud FinOps
Give every cloud dollar an owner and a trend -
SSRF Prevention
Check the IP you connect to, not the URL -
Log Forensics
Every conclusion backed by a log line -
Cryptography Usage
Right primitive, right library, nothing homemade -
SOC 2 Controls
Controls systems enforce, evidence that pulls itself
Every AWS skill in one command
Installs these 22 into ~/.agents/skills/. Add --project after -- to install into the current repository instead.
The installer is a 104-line POSIX shell script. It fetches the skills you name from codexskills.dev and unpacks each into its own folder in your skills directory. No sudo, no telemetry, and every skill page shows the full SKILL.md first. Read install.sh
curl -fsSL codexskills.dev/install.sh | sh -s -- aws-lambda aws-cdk aws-iam-policies aws-s3 aws-ecs-fargate aws-cost-optimization aws-step-functions aws-cloudfront aws-api-gateway aws-sam aws-cloudwatch aws-eventbridge aws-rds-aurora aws-sqs-sns dynamodb-single-table file-uploads secrets-management infrastructure-drift sst-apps cloud-security-posture file-upload-security waf-rules AWS FAQ
Can Codex write least-privilege IAM policies?
AWS IAM Policies maps each API call the workload makes to its exact action, ARN and condition keys, scopes iam:PassRole, and locks GitHub Actions OIDC trust to a repository and environment. It runs a bundled offline lint script and IAM Access Analyzer validation, and allows wildcard verbs such as dynamodb:Get* for reads only, never for writes.
Will Codex delete AWS resources to cut costs?
AWS Cost Optimization ranks findings such as unattached EBS volumes, idle IPv4 addresses, NAT gateway traffic and unlimited log retention by monthly dollars and risk. Deletions and Savings Plans or Reserved Instance purchases require your explicit confirmation after you have seen the list and estimate, and commitments are reviewed only after waste is removed.
Is there a Codex skill for Lambda cold starts?
AWS Lambda reads init duration, billed duration and max memory from REPORT log lines before changing packaging, memory or architecture. It covers Node.js, Python, Java and Go, suggests arm64 and SnapStart or provisioned concurrency where they fit, and sets up ReportBatchItemFailures so an SQS-triggered function does not reprocess a whole batch.
How do I install all 22 AWS skills at once?
Pass every name to the installer in one command: curl -fsSL https://codexskills.dev/install.sh | sh -s -- aws-lambda aws-cdk aws-iam-policies aws-s3 aws-ecs-fargate aws-cost-optimization aws-step-functions aws-cloudfront aws-api-gateway aws-sam aws-cloudwatch aws-eventbridge aws-rds-aurora aws-sqs-sns dynamodb-single-table file-uploads secrets-management infrastructure-drift sst-apps cloud-security-posture file-upload-security waf-rules. Add --project right after -- to put them in the current repository's .agents/skills/ so your team gets them too.
Which AWS skill should I try first?
AWS Lambda is the closest fit for most AWS work. Mention it with $aws-lambda in a prompt to load it on purpose; after that, Codex picks it up on its own whenever a task matches.