[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-amazon-ec2-image-builder":3,"mdc-7sh0uq-key":38,"related-org-aws-amazon-ec2-image-builder":704,"related-repo-aws-amazon-ec2-image-builder":876},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":27,"repoUrl":28,"updatedAt":29,"license":30,"forks":31,"topics":32,"repo":33,"sourceUrl":36,"mdContent":37},"amazon-ec2-image-builder","automate custom image builds with EC2","Creates and automates custom image builds with EC2 Image Builder - Linux, Windows, and macOS AMIs, and container images to ECR. Covers the build IAM role, Amazon-managed and custom components, image recipes, infrastructure and distribution configuration (launch templates, SSM parameters, other Regions), one-off builds, recurring scheduled pipelines for golden AMI automation and OS patching, custom image workflows, and diagnosing failed builds. Applies when creating, automating, or scheduling AMI or container image builds with Image Builder, or when debugging a failed build. Not for launching instances from existing AMIs, AMI lifecycle\u002Fretirement, or general EC2 fleet management.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"aws","AWS (Amazon)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws.png",[12,16,19,22,25],{"name":13,"slug":14,"type":15},"Containers","containers","tag",{"name":17,"slug":18,"type":15},"Automation","automation",{"name":20,"slug":21,"type":15},"Deployment","deployment",{"name":23,"slug":24,"type":15},"Infrastructure","infrastructure",{"name":26,"slug":8,"type":15},"AWS",1822,"https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws","2026-08-27T13:31:48.787525",null,157,[],{"repoUrl":28,"stars":27,"forks":31,"topics":34,"description":35},[],"Official, AWS-supported MCP servers, skills, and plugins to help AI agents build on AWS","https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws\u002Ftree\u002FHEAD\u002Fskills\u002Fspecialized-skills\u002Fec2-skills\u002Famazon-ec2-image-builder","---\nname: amazon-ec2-image-builder\ndescription: Creates and automates custom image builds with EC2 Image Builder - Linux, Windows, and macOS AMIs, and container images to ECR. Covers the build IAM role, Amazon-managed and custom components, image recipes, infrastructure and distribution configuration (launch templates, SSM parameters, other Regions), one-off builds, recurring scheduled pipelines for golden AMI automation and OS patching, custom image workflows, and diagnosing failed builds. Applies when creating, automating, or scheduling AMI or container image builds with Image Builder, or when debugging a failed build. Not for launching instances from existing AMIs, AMI lifecycle\u002Fretirement, or general EC2 fleet management.\nversion: 1\n---\n\n# Amazon EC2 Image Builder\n\n## Overview\n\nDomain expertise for building custom AMIs and container images with EC2 Image Builder — from the build IAM role through recipes, pipelines, distribution, and troubleshooting.\n\n**Works best with** the [AWS MCP server](https:\u002F\u002Fdocs.aws.amazon.com\u002Faws-mcp\u002F) — recommended for sandboxed execution and audit logging. All guidance also works with standard AWS CLI access.\n\n## Guardrail — where this skill's own files live (MCP vs local install)\n\nThis skill can be loaded two ways, and they resolve the skill's own bundled\nfiles from different places. Determine how the skill was loaded before reading\na reference or running a script:\n\n- **Loaded through the AWS MCP `retrieve_skill` tool:** The skill is not\n  installed on the local filesystem. You MUST fetch each reference or script\n  via `retrieve_skill` with the `file` parameter (e.g.\n  `file=\"references\u002Fcreating-images.md\"`), and use the returned content.\n  Do NOT `file_read` these paths locally — they do not exist on disk.\n- **Installed locally** (e.g. `.kiro\u002Fskills\u002Famazon-ec2-image-builder\u002F` or\n  `~\u002F.claude\u002Fskills\u002Famazon-ec2-image-builder\u002F`): Read files from the local\n  skill directory using relative paths.\n\nThis distinction applies only to the skill's own packaged files. User data and\nsession artifacts are always read from and written to the user's working\ndirectory. Never fetch or write user data through `retrieve_skill`.\n\n## First decision: one-off image or recurring pipeline\n\nAsk this before creating anything — it changes what you build.\n\n| The user wants | Do this |\n|---|---|\n| One custom AMI, once | Follow [creating-images.md](references\u002Fcreating-images.md) through step 7a: `create-image` with a recipe and infrastructure configuration — no pipeline needed. |\n| A golden AMI that stays current (scheduled rebuilds that pick up base-image updates and patches) | An image pipeline: follow [creating-images.md](references\u002Fcreating-images.md) — the schedule is part of the create-image-pipeline call (step 7b). |\n\n## Related skills — route there instead\n\n| Use this skill | When the request is about |\n|---|---|\n| **launching-ec2-instance-with-best-practices** | Launching instances from an AMI the user already has |\n| **setting-up-ec2-instance-profiles** | Instance profiles in general (not the build IAM role this skill creates) |\n| **aws-compute** | AMI sharing, retiring, and lifecycle management; general EC2 fleet questions |\n\n**Not covered here:** AMI lifecycle\u002Fretirement (route via the table above) and VM\u002FISO image import and export (follow the AWS documentation directly).\n\n## Routing (references in this skill)\n\nRead the matching reference before answering. The exact commands, failure fixes, and platform requirements live in the references — answering Image Builder questions from general knowledge is how agents get the details subtly wrong.\n\n| User need | Read |\n|---|---|\n| Create an image or pipeline end to end: role, components, recipe, infrastructure, schedules, patching, scanning, chaining | [creating-images.md](references\u002Fcreating-images.md) |\n| Get the output AMI where it's needed: launch templates, SSM parameters (the service-linked role writes only under `\u002Fimagebuilder\u002F`), other Regions | [distribution-options.md](references\u002Fdistribution-options.md) |\n| A build failed, hangs, or an Image Builder API call errors | [troubleshooting.md](references\u002Ftroubleshooting.md) |\n| Windows (exit-3010 reboots), macOS (Mac Dedicated Hosts required), container images to ECR (extra build-role policy) | [other-image-types.md](references\u002Fother-image-types.md) |\n| Custom image workflows (advanced — always require an execution role) | [custom-workflows.md](references\u002Fcustom-workflows.md) |\n\nReference files carry specific ARNs, Amazon-managed resource names, and service defaults — when precision matters, confirm against the AWS documentation.\n\n## Guardrails (every workflow)\n\n- Quote CLI filter values that contain spaces: `--filters \"name=name,values=Amazon Linux 2023 x86\"`. Unquoted spaces are a CLI parse error.\n- Use the exact ARN each create call returns — never construct ARNs by hand.\n- For a \"latest\" base image use an Amazon-managed image ARN with the `x.x.x` wildcard, or an `ssm:` parameter reference where no managed image exists. Never list versions and sort them as strings — the list is not semver-ordered.\n- Keep architecture consistent across the base image, every component's binaries, and the infrastructure instance types. Image Builder performs no create-time validation of this; a mismatch only fails mid-build when the component runs.\n- For component failures, the root cause lives in CloudWatch log group `\u002Faws\u002Fimagebuilder\u002F\u003Cimage-name>` (on by default; also in the S3 logs if configured) — never in the API state. See [troubleshooting.md](references\u002Ftroubleshooting.md).\n- To reboot mid-build, exit the step with code `194` (Linux) or `3010` (Windows). The build re-runs that same step after the reboot — not the next step — so guard it with a marker file. A plain reboot command fails the step.\n- If a resource the user describes isn't visible to `get-image`\u002F`get-image-pipeline`, say you can't find it and check the Region and credentials in use — then keep troubleshooting from the user's description; a failed lookup is not proof the resource doesn't exist.\n- Distribution handles launch templates and SSM publishing natively (`launchTemplateConfigurations`, `ssmParameterConfigurations`) — never add Lambda glue or manual launch-template versions for AMI propagation.\n- Default to: Amazon Linux 2023 base, IMDSv2 required (`instanceMetadataOptions httpTokens=required`), and at least two instance types in the infrastructure configuration. S3 build logging is opt-in — CloudWatch logging is on regardless.\n- Check Amazon-managed components (`aws imagebuilder list-components --owner Amazon`) before writing component YAML. Common needs (AWS CLI, OS updates, CloudWatch agent, STIG hardening) are already covered.\n\n## Security considerations\n\nThe defaults above are the security posture: IMDSv2 required on build instances, no inbound security-group rules, least-privilege build IAM role (two managed policies for AMI builds plus only the scoped grants a workflow needs), no secrets in components or logs, and log buckets with Block Public Access. Build logs capture full command output that can carry sensitive material; CloudWatch Logs encrypts them at rest by default, and associating a customer-managed KMS key with each `\u002Faws\u002Fimagebuilder\u002F...` log group (`aws logs associate-kms-key`) is recommended. For auditing and operational visibility, enable CloudTrail in the account so Image Builder API calls are recorded, and configure EventBridge rules or CloudWatch alarms on build failures (source `aws.imagebuilder`, detail-type `EC2 Image Builder Image State Change`) so misconfigurations and unauthorized changes surface promptly. Per-build notifications are covered by the SNS topic option (creating-images.md step 6) — prefer a customer-managed key on that topic too. Deviations from these should be explicit user decisions. Reference: [EC2 Image Builder security best practices](https:\u002F\u002Fdocs.aws.amazon.com\u002Fimagebuilder\u002Flatest\u002Fuserguide\u002Fsecurity-best-practices.html).\n",{"data":39,"body":41},{"name":4,"description":6,"version":40},1,{"type":42,"children":43},"root",[44,52,59,65,87,93,98,179,191,197,202,278,284,354,364,370,375,488,493,499,653,659],{"type":45,"tag":46,"props":47,"children":48},"element","h1",{"id":4},[49],{"type":50,"value":51},"text","Amazon EC2 Image Builder",{"type":45,"tag":53,"props":54,"children":56},"h2",{"id":55},"overview",[57],{"type":50,"value":58},"Overview",{"type":45,"tag":60,"props":61,"children":62},"p",{},[63],{"type":50,"value":64},"Domain expertise for building custom AMIs and container images with EC2 Image Builder — from the build IAM role through recipes, pipelines, distribution, and troubleshooting.",{"type":45,"tag":60,"props":66,"children":67},{},[68,74,76,85],{"type":45,"tag":69,"props":70,"children":71},"strong",{},[72],{"type":50,"value":73},"Works best with",{"type":50,"value":75}," the ",{"type":45,"tag":77,"props":78,"children":82},"a",{"href":79,"rel":80},"https:\u002F\u002Fdocs.aws.amazon.com\u002Faws-mcp\u002F",[81],"nofollow",[83],{"type":50,"value":84},"AWS MCP server",{"type":50,"value":86}," — recommended for sandboxed execution and audit logging. All guidance also works with standard AWS CLI access.",{"type":45,"tag":53,"props":88,"children":90},{"id":89},"guardrail-where-this-skills-own-files-live-mcp-vs-local-install",[91],{"type":50,"value":92},"Guardrail — where this skill's own files live (MCP vs local install)",{"type":45,"tag":60,"props":94,"children":95},{},[96],{"type":50,"value":97},"This skill can be loaded two ways, and they resolve the skill's own bundled\nfiles from different places. Determine how the skill was loaded before reading\na reference or running a script:",{"type":45,"tag":99,"props":100,"children":101},"ul",{},[102,153],{"type":45,"tag":103,"props":104,"children":105},"li",{},[106,120,122,127,129,135,137,143,145,151],{"type":45,"tag":69,"props":107,"children":108},{},[109,111,118],{"type":50,"value":110},"Loaded through the AWS MCP ",{"type":45,"tag":112,"props":113,"children":115},"code",{"className":114},[],[116],{"type":50,"value":117},"retrieve_skill",{"type":50,"value":119}," tool:",{"type":50,"value":121}," The skill is not\ninstalled on the local filesystem. You MUST fetch each reference or script\nvia ",{"type":45,"tag":112,"props":123,"children":125},{"className":124},[],[126],{"type":50,"value":117},{"type":50,"value":128}," with the ",{"type":45,"tag":112,"props":130,"children":132},{"className":131},[],[133],{"type":50,"value":134},"file",{"type":50,"value":136}," parameter (e.g.\n",{"type":45,"tag":112,"props":138,"children":140},{"className":139},[],[141],{"type":50,"value":142},"file=\"references\u002Fcreating-images.md\"",{"type":50,"value":144},"), and use the returned content.\nDo NOT ",{"type":45,"tag":112,"props":146,"children":148},{"className":147},[],[149],{"type":50,"value":150},"file_read",{"type":50,"value":152}," these paths locally — they do not exist on disk.",{"type":45,"tag":103,"props":154,"children":155},{},[156,161,163,169,171,177],{"type":45,"tag":69,"props":157,"children":158},{},[159],{"type":50,"value":160},"Installed locally",{"type":50,"value":162}," (e.g. ",{"type":45,"tag":112,"props":164,"children":166},{"className":165},[],[167],{"type":50,"value":168},".kiro\u002Fskills\u002Famazon-ec2-image-builder\u002F",{"type":50,"value":170}," or\n",{"type":45,"tag":112,"props":172,"children":174},{"className":173},[],[175],{"type":50,"value":176},"~\u002F.claude\u002Fskills\u002Famazon-ec2-image-builder\u002F",{"type":50,"value":178},"): Read files from the local\nskill directory using relative paths.",{"type":45,"tag":60,"props":180,"children":181},{},[182,184,189],{"type":50,"value":183},"This distinction applies only to the skill's own packaged files. User data and\nsession artifacts are always read from and written to the user's working\ndirectory. Never fetch or write user data through ",{"type":45,"tag":112,"props":185,"children":187},{"className":186},[],[188],{"type":50,"value":117},{"type":50,"value":190},".",{"type":45,"tag":53,"props":192,"children":194},{"id":193},"first-decision-one-off-image-or-recurring-pipeline",[195],{"type":50,"value":196},"First decision: one-off image or recurring pipeline",{"type":45,"tag":60,"props":198,"children":199},{},[200],{"type":50,"value":201},"Ask this before creating anything — it changes what you build.",{"type":45,"tag":203,"props":204,"children":205},"table",{},[206,225],{"type":45,"tag":207,"props":208,"children":209},"thead",{},[210],{"type":45,"tag":211,"props":212,"children":213},"tr",{},[214,220],{"type":45,"tag":215,"props":216,"children":217},"th",{},[218],{"type":50,"value":219},"The user wants",{"type":45,"tag":215,"props":221,"children":222},{},[223],{"type":50,"value":224},"Do this",{"type":45,"tag":226,"props":227,"children":228},"tbody",{},[229,259],{"type":45,"tag":211,"props":230,"children":231},{},[232,238],{"type":45,"tag":233,"props":234,"children":235},"td",{},[236],{"type":50,"value":237},"One custom AMI, once",{"type":45,"tag":233,"props":239,"children":240},{},[241,243,249,251,257],{"type":50,"value":242},"Follow ",{"type":45,"tag":77,"props":244,"children":246},{"href":245},"references\u002Fcreating-images.md",[247],{"type":50,"value":248},"creating-images.md",{"type":50,"value":250}," through step 7a: ",{"type":45,"tag":112,"props":252,"children":254},{"className":253},[],[255],{"type":50,"value":256},"create-image",{"type":50,"value":258}," with a recipe and infrastructure configuration — no pipeline needed.",{"type":45,"tag":211,"props":260,"children":261},{},[262,267],{"type":45,"tag":233,"props":263,"children":264},{},[265],{"type":50,"value":266},"A golden AMI that stays current (scheduled rebuilds that pick up base-image updates and patches)",{"type":45,"tag":233,"props":268,"children":269},{},[270,272,276],{"type":50,"value":271},"An image pipeline: follow ",{"type":45,"tag":77,"props":273,"children":274},{"href":245},[275],{"type":50,"value":248},{"type":50,"value":277}," — the schedule is part of the create-image-pipeline call (step 7b).",{"type":45,"tag":53,"props":279,"children":281},{"id":280},"related-skills-route-there-instead",[282],{"type":50,"value":283},"Related skills — route there instead",{"type":45,"tag":203,"props":285,"children":286},{},[287,303],{"type":45,"tag":207,"props":288,"children":289},{},[290],{"type":45,"tag":211,"props":291,"children":292},{},[293,298],{"type":45,"tag":215,"props":294,"children":295},{},[296],{"type":50,"value":297},"Use this skill",{"type":45,"tag":215,"props":299,"children":300},{},[301],{"type":50,"value":302},"When the request is about",{"type":45,"tag":226,"props":304,"children":305},{},[306,322,338],{"type":45,"tag":211,"props":307,"children":308},{},[309,317],{"type":45,"tag":233,"props":310,"children":311},{},[312],{"type":45,"tag":69,"props":313,"children":314},{},[315],{"type":50,"value":316},"launching-ec2-instance-with-best-practices",{"type":45,"tag":233,"props":318,"children":319},{},[320],{"type":50,"value":321},"Launching instances from an AMI the user already has",{"type":45,"tag":211,"props":323,"children":324},{},[325,333],{"type":45,"tag":233,"props":326,"children":327},{},[328],{"type":45,"tag":69,"props":329,"children":330},{},[331],{"type":50,"value":332},"setting-up-ec2-instance-profiles",{"type":45,"tag":233,"props":334,"children":335},{},[336],{"type":50,"value":337},"Instance profiles in general (not the build IAM role this skill creates)",{"type":45,"tag":211,"props":339,"children":340},{},[341,349],{"type":45,"tag":233,"props":342,"children":343},{},[344],{"type":45,"tag":69,"props":345,"children":346},{},[347],{"type":50,"value":348},"aws-compute",{"type":45,"tag":233,"props":350,"children":351},{},[352],{"type":50,"value":353},"AMI sharing, retiring, and lifecycle management; general EC2 fleet questions",{"type":45,"tag":60,"props":355,"children":356},{},[357,362],{"type":45,"tag":69,"props":358,"children":359},{},[360],{"type":50,"value":361},"Not covered here:",{"type":50,"value":363}," AMI lifecycle\u002Fretirement (route via the table above) and VM\u002FISO image import and export (follow the AWS documentation directly).",{"type":45,"tag":53,"props":365,"children":367},{"id":366},"routing-references-in-this-skill",[368],{"type":50,"value":369},"Routing (references in this skill)",{"type":45,"tag":60,"props":371,"children":372},{},[373],{"type":50,"value":374},"Read the matching reference before answering. The exact commands, failure fixes, and platform requirements live in the references — answering Image Builder questions from general knowledge is how agents get the details subtly wrong.",{"type":45,"tag":203,"props":376,"children":377},{},[378,394],{"type":45,"tag":207,"props":379,"children":380},{},[381],{"type":45,"tag":211,"props":382,"children":383},{},[384,389],{"type":45,"tag":215,"props":385,"children":386},{},[387],{"type":50,"value":388},"User need",{"type":45,"tag":215,"props":390,"children":391},{},[392],{"type":50,"value":393},"Read",{"type":45,"tag":226,"props":395,"children":396},{},[397,412,437,454,471],{"type":45,"tag":211,"props":398,"children":399},{},[400,405],{"type":45,"tag":233,"props":401,"children":402},{},[403],{"type":50,"value":404},"Create an image or pipeline end to end: role, components, recipe, infrastructure, schedules, patching, scanning, chaining",{"type":45,"tag":233,"props":406,"children":407},{},[408],{"type":45,"tag":77,"props":409,"children":410},{"href":245},[411],{"type":50,"value":248},{"type":45,"tag":211,"props":413,"children":414},{},[415,428],{"type":45,"tag":233,"props":416,"children":417},{},[418,420,426],{"type":50,"value":419},"Get the output AMI where it's needed: launch templates, SSM parameters (the service-linked role writes only under ",{"type":45,"tag":112,"props":421,"children":423},{"className":422},[],[424],{"type":50,"value":425},"\u002Fimagebuilder\u002F",{"type":50,"value":427},"), other Regions",{"type":45,"tag":233,"props":429,"children":430},{},[431],{"type":45,"tag":77,"props":432,"children":434},{"href":433},"references\u002Fdistribution-options.md",[435],{"type":50,"value":436},"distribution-options.md",{"type":45,"tag":211,"props":438,"children":439},{},[440,445],{"type":45,"tag":233,"props":441,"children":442},{},[443],{"type":50,"value":444},"A build failed, hangs, or an Image Builder API call errors",{"type":45,"tag":233,"props":446,"children":447},{},[448],{"type":45,"tag":77,"props":449,"children":451},{"href":450},"references\u002Ftroubleshooting.md",[452],{"type":50,"value":453},"troubleshooting.md",{"type":45,"tag":211,"props":455,"children":456},{},[457,462],{"type":45,"tag":233,"props":458,"children":459},{},[460],{"type":50,"value":461},"Windows (exit-3010 reboots), macOS (Mac Dedicated Hosts required), container images to ECR (extra build-role policy)",{"type":45,"tag":233,"props":463,"children":464},{},[465],{"type":45,"tag":77,"props":466,"children":468},{"href":467},"references\u002Fother-image-types.md",[469],{"type":50,"value":470},"other-image-types.md",{"type":45,"tag":211,"props":472,"children":473},{},[474,479],{"type":45,"tag":233,"props":475,"children":476},{},[477],{"type":50,"value":478},"Custom image workflows (advanced — always require an execution role)",{"type":45,"tag":233,"props":480,"children":481},{},[482],{"type":45,"tag":77,"props":483,"children":485},{"href":484},"references\u002Fcustom-workflows.md",[486],{"type":50,"value":487},"custom-workflows.md",{"type":45,"tag":60,"props":489,"children":490},{},[491],{"type":50,"value":492},"Reference files carry specific ARNs, Amazon-managed resource names, and service defaults — when precision matters, confirm against the AWS documentation.",{"type":45,"tag":53,"props":494,"children":496},{"id":495},"guardrails-every-workflow",[497],{"type":50,"value":498},"Guardrails (every workflow)",{"type":45,"tag":99,"props":500,"children":501},{},[502,515,520,541,546,564,585,606,627,640],{"type":45,"tag":103,"props":503,"children":504},{},[505,507,513],{"type":50,"value":506},"Quote CLI filter values that contain spaces: ",{"type":45,"tag":112,"props":508,"children":510},{"className":509},[],[511],{"type":50,"value":512},"--filters \"name=name,values=Amazon Linux 2023 x86\"",{"type":50,"value":514},". Unquoted spaces are a CLI parse error.",{"type":45,"tag":103,"props":516,"children":517},{},[518],{"type":50,"value":519},"Use the exact ARN each create call returns — never construct ARNs by hand.",{"type":45,"tag":103,"props":521,"children":522},{},[523,525,531,533,539],{"type":50,"value":524},"For a \"latest\" base image use an Amazon-managed image ARN with the ",{"type":45,"tag":112,"props":526,"children":528},{"className":527},[],[529],{"type":50,"value":530},"x.x.x",{"type":50,"value":532}," wildcard, or an ",{"type":45,"tag":112,"props":534,"children":536},{"className":535},[],[537],{"type":50,"value":538},"ssm:",{"type":50,"value":540}," parameter reference where no managed image exists. Never list versions and sort them as strings — the list is not semver-ordered.",{"type":45,"tag":103,"props":542,"children":543},{},[544],{"type":50,"value":545},"Keep architecture consistent across the base image, every component's binaries, and the infrastructure instance types. Image Builder performs no create-time validation of this; a mismatch only fails mid-build when the component runs.",{"type":45,"tag":103,"props":547,"children":548},{},[549,551,557,559,563],{"type":50,"value":550},"For component failures, the root cause lives in CloudWatch log group ",{"type":45,"tag":112,"props":552,"children":554},{"className":553},[],[555],{"type":50,"value":556},"\u002Faws\u002Fimagebuilder\u002F\u003Cimage-name>",{"type":50,"value":558}," (on by default; also in the S3 logs if configured) — never in the API state. See ",{"type":45,"tag":77,"props":560,"children":561},{"href":450},[562],{"type":50,"value":453},{"type":50,"value":190},{"type":45,"tag":103,"props":565,"children":566},{},[567,569,575,577,583],{"type":50,"value":568},"To reboot mid-build, exit the step with code ",{"type":45,"tag":112,"props":570,"children":572},{"className":571},[],[573],{"type":50,"value":574},"194",{"type":50,"value":576}," (Linux) or ",{"type":45,"tag":112,"props":578,"children":580},{"className":579},[],[581],{"type":50,"value":582},"3010",{"type":50,"value":584}," (Windows). The build re-runs that same step after the reboot — not the next step — so guard it with a marker file. A plain reboot command fails the step.",{"type":45,"tag":103,"props":586,"children":587},{},[588,590,596,598,604],{"type":50,"value":589},"If a resource the user describes isn't visible to ",{"type":45,"tag":112,"props":591,"children":593},{"className":592},[],[594],{"type":50,"value":595},"get-image",{"type":50,"value":597},"\u002F",{"type":45,"tag":112,"props":599,"children":601},{"className":600},[],[602],{"type":50,"value":603},"get-image-pipeline",{"type":50,"value":605},", say you can't find it and check the Region and credentials in use — then keep troubleshooting from the user's description; a failed lookup is not proof the resource doesn't exist.",{"type":45,"tag":103,"props":607,"children":608},{},[609,611,617,619,625],{"type":50,"value":610},"Distribution handles launch templates and SSM publishing natively (",{"type":45,"tag":112,"props":612,"children":614},{"className":613},[],[615],{"type":50,"value":616},"launchTemplateConfigurations",{"type":50,"value":618},", ",{"type":45,"tag":112,"props":620,"children":622},{"className":621},[],[623],{"type":50,"value":624},"ssmParameterConfigurations",{"type":50,"value":626},") — never add Lambda glue or manual launch-template versions for AMI propagation.",{"type":45,"tag":103,"props":628,"children":629},{},[630,632,638],{"type":50,"value":631},"Default to: Amazon Linux 2023 base, IMDSv2 required (",{"type":45,"tag":112,"props":633,"children":635},{"className":634},[],[636],{"type":50,"value":637},"instanceMetadataOptions httpTokens=required",{"type":50,"value":639},"), and at least two instance types in the infrastructure configuration. S3 build logging is opt-in — CloudWatch logging is on regardless.",{"type":45,"tag":103,"props":641,"children":642},{},[643,645,651],{"type":50,"value":644},"Check Amazon-managed components (",{"type":45,"tag":112,"props":646,"children":648},{"className":647},[],[649],{"type":50,"value":650},"aws imagebuilder list-components --owner Amazon",{"type":50,"value":652},") before writing component YAML. Common needs (AWS CLI, OS updates, CloudWatch agent, STIG hardening) are already covered.",{"type":45,"tag":53,"props":654,"children":656},{"id":655},"security-considerations",[657],{"type":50,"value":658},"Security considerations",{"type":45,"tag":60,"props":660,"children":661},{},[662,664,670,672,678,680,686,688,694,696,703],{"type":50,"value":663},"The defaults above are the security posture: IMDSv2 required on build instances, no inbound security-group rules, least-privilege build IAM role (two managed policies for AMI builds plus only the scoped grants a workflow needs), no secrets in components or logs, and log buckets with Block Public Access. Build logs capture full command output that can carry sensitive material; CloudWatch Logs encrypts them at rest by default, and associating a customer-managed KMS key with each ",{"type":45,"tag":112,"props":665,"children":667},{"className":666},[],[668],{"type":50,"value":669},"\u002Faws\u002Fimagebuilder\u002F...",{"type":50,"value":671}," log group (",{"type":45,"tag":112,"props":673,"children":675},{"className":674},[],[676],{"type":50,"value":677},"aws logs associate-kms-key",{"type":50,"value":679},") is recommended. For auditing and operational visibility, enable CloudTrail in the account so Image Builder API calls are recorded, and configure EventBridge rules or CloudWatch alarms on build failures (source ",{"type":45,"tag":112,"props":681,"children":683},{"className":682},[],[684],{"type":50,"value":685},"aws.imagebuilder",{"type":50,"value":687},", detail-type ",{"type":45,"tag":112,"props":689,"children":691},{"className":690},[],[692],{"type":50,"value":693},"EC2 Image Builder Image State Change",{"type":50,"value":695},") so misconfigurations and unauthorized changes surface promptly. Per-build notifications are covered by the SNS topic option (creating-images.md step 6) — prefer a customer-managed key on that topic too. Deviations from these should be explicit user decisions. Reference: ",{"type":45,"tag":77,"props":697,"children":700},{"href":698,"rel":699},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fimagebuilder\u002Flatest\u002Fuserguide\u002Fsecurity-best-practices.html",[81],[701],{"type":50,"value":702},"EC2 Image Builder security best practices",{"type":50,"value":190},{"items":705,"total":875},[706,721,736,751,764,774,789,805,819,836,849,861],{"slug":707,"name":707,"fn":708,"description":709,"org":710,"tags":711,"stars":27,"repoUrl":28,"updatedAt":720},"agents-build","add capabilities to existing agent projects","Use to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments, or resource removal. Triggers: \"add memory\", \"remember across sessions\", \"call agent from app\", \"invoke agent from code\", \"agent auth\", \"streaming\", \"VPC\", \"VPC connectivity\", \"can't reach from VPC\", \"multi-agent\", \"A2A\", \"A2A auth\", \"orchestrator not delegating\", \"specialist not called\", \"migrate Bedrock Agent\", \"migration issue\", \"change model\", \"browser tool\", \"code interpreter\", \"delete agent\", \"tear down\", \"agentcore remove\", \"cross-account memory\", \"add payments capability to my agent\", \"wire payments plugin\", \"integrate x402 payments with the agent I'm building\", \"add MPP payments\", \"Machine Payments Protocol\". External APIs via Gateway: use agents-connect. New project: use agents-get-started. CLI\u002Fdev-server errors: use agents-debug. Runtime x402\u002FMPP payments: use agents-pay. Migration-specific Strands vs LangGraph routes here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[712,715,716,717],{"name":713,"slug":714,"type":15},"Agents","agents",{"name":17,"slug":18,"type":15},{"name":26,"slug":8,"type":15},{"name":718,"slug":719,"type":15},"Engineering","engineering","2026-08-20T03:27:06.137661",{"slug":722,"name":722,"fn":723,"description":724,"org":725,"tags":726,"stars":27,"repoUrl":28,"updatedAt":735},"agents-connect","connect agents to external services","Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: \"connect to API\", \"add gateway\", \"connect to MCP server\", \"Lambda tools\", \"OpenAPI\", \"gateway target\", \"Cedar policy\", \"restrict tools\", \"policy engine\", \"gateway auth error\", \"store API key\", \"outbound credential\", \"env var API key\", \"API key None after deploy\", \"credential not available after deploy\", \"should this be a gateway target\", \"give my agent tools\", \"add tools to agent\". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[727,728,731,734],{"name":713,"slug":714,"type":15},{"name":729,"slug":730,"type":15},"API Development","api-development",{"name":732,"slug":733,"type":15},"Authentication","authentication",{"name":26,"slug":8,"type":15},"2026-07-16T06:00:38.866147",{"slug":737,"name":737,"fn":738,"description":739,"org":740,"tags":741,"stars":27,"repoUrl":28,"updatedAt":750},"agents-debug","debug agent and environment issues","Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: \"agent not working\", \"wrong answer\", \"agent error\", \"tool call failing\", \"debug agent\", \"check logs\", \"read traces\", \"broken\", \"500 error\", \"424 error\", \"model access denied\", \"command not found\", \"stuck in DELETING\", \"maxVms exceeded\", \"cold start diagnosis\", \"cold start slow\", \"agentcore create error\", \"create failed\", \"exit code 7\", \"connection refused local dev\". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[742,743,744,747],{"name":713,"slug":714,"type":15},{"name":26,"slug":8,"type":15},{"name":745,"slug":746,"type":15},"Debugging","debugging",{"name":748,"slug":749,"type":15},"Observability","observability","2026-07-16T06:00:44.679093",{"slug":752,"name":752,"fn":753,"description":754,"org":755,"tags":756,"stars":27,"repoUrl":28,"updatedAt":763},"agents-deploy","deploy AI agents to AWS","Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK\u002FIAM\u002Fquota error diagnosis, version management, rollback, and canary deployments. Triggers on: \"deploy my agent\", \"agentcore deploy\", \"deploy failed\", \"CDK error\", \"rollback\", \"canary deploy\", \"pin version\", \"redeploy\", \"deploy stuck\". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[757,758,759,762],{"name":713,"slug":714,"type":15},{"name":26,"slug":8,"type":15},{"name":760,"slug":761,"type":15},"CI\u002FCD","ci-cd",{"name":20,"slug":21,"type":15},"2026-07-12T08:42:55.059577",{"slug":765,"name":765,"fn":766,"description":767,"org":768,"tags":769,"stars":27,"repoUrl":28,"updatedAt":773},"agents-get-started","scaffold and deploy new agent projects","Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: \"build an agent\", \"create an agent\", \"get started\", \"new project\", \"agentcore create\", \"which framework\", \"Strands vs LangGraph\", \"hello world agent\", \"first agent\", \"create MCP server\", \"host MCP server\", \"agentcore dev\", \"dev server\", \"what port\", \"local development\". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[770,771,772],{"name":713,"slug":714,"type":15},{"name":26,"slug":8,"type":15},{"name":20,"slug":21,"type":15},"2026-07-12T08:42:51.963247",{"slug":775,"name":775,"fn":776,"description":777,"org":778,"tags":779,"stars":27,"repoUrl":28,"updatedAt":788},"agents-harden","harden agents for production","Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: \"production checklist\", \"harden agent\", \"production ready\", \"secure agent\", \"inbound auth\", \"going live\", \"cold start optimization\", \"session lifecycle\", \"StopRuntimeSession\", \"quota\", \"throttling\", \"maxVms\", \"rate limit\", \"security audit of outbound API calls\", \"gateway target audit for production\", \"restrict who can call\", \"lock down endpoint\", \"only our app can call\". Not for Cedar tool-restriction policies — use agents-connect. Not for quality measurement — use agents-optimize. Not for outbound credential storage or API key wiring — use agents-connect. Not for A2A agent-to-agent auth — use agents-build. Cold start observation and diagnosis (not optimization) routes to agents-debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[780,781,782,785],{"name":713,"slug":714,"type":15},{"name":26,"slug":8,"type":15},{"name":783,"slug":784,"type":15},"Best Practices","best-practices",{"name":786,"slug":787,"type":15},"Security","security","2026-07-16T06:00:42.174705",{"slug":790,"name":790,"fn":791,"description":792,"org":793,"tags":794,"stars":27,"repoUrl":28,"updatedAt":804},"agents-optimize","optimize agent quality and performance","Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI\u002FCD quality gates, observability, or cost optimization. Triggers on: \"evaluate my agent\", \"add evaluator\", \"measure quality\", \"quality gate\", \"run evals\", \"agent too slow\", \"why is it slow\", \"reduce latency\", \"set up observability\", \"CloudWatch dashboard\", \"how much does my agent cost\", \"cost optimization\", \"logs not showing up\", \"logs missing\", \"spans not found\", \"eval failing\", \"eval error\", \"dev traces\", \"local traces\", \"agentcore dev traces\", \"traces to CloudWatch\". Not for debugging errors or crashes — use agents-debug. Slow but correct routes here; broken routes to debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[795,796,797,800,801],{"name":713,"slug":714,"type":15},{"name":26,"slug":8,"type":15},{"name":798,"slug":799,"type":15},"Evals","evals",{"name":748,"slug":749,"type":15},{"name":802,"slug":803,"type":15},"Performance","performance","2026-07-12T08:42:56.488105",{"slug":806,"name":806,"fn":807,"description":808,"org":809,"tags":810,"stars":27,"repoUrl":28,"updatedAt":818},"agents-pay","handle x402 payments for agent tasks","Use when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments, and applying operator-defined spend limits. Covers payment setup, policy, session budgets, and troubleshooting. Triggers on: \"my agent hit a 402 while calling an API\", \"a tool call returned 402 Payment Required\", \"my agent needs to pay for x402-protected content\", \"let the agent pay for content, capped at $5 per session\", \"set a spend limit for the agent\", \"ProcessPayment failed\", or \"why did my agent refuse to pay\". Not for BUILDING payment capability for end users, including wallets and framework middleware; use agents-build and references\u002Fpayments.md. For non-paid APIs via Gateway use agents-connect. For inbound auth use agents-harden. For project scaffolding use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[811,812,813,816],{"name":713,"slug":714,"type":15},{"name":17,"slug":18,"type":15},{"name":814,"slug":815,"type":15},"Payments","payments",{"name":817,"slug":817,"type":15},"x402","2026-08-10T04:16:31.844309",{"slug":820,"name":820,"fn":821,"description":822,"org":823,"tags":824,"stars":27,"repoUrl":28,"updatedAt":835},"amazon-aurora-mysql","manage Amazon Aurora MySQL clusters","Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or MySQL upgrade planning. Aurora MySQL uses full (VPC-based) configuration — express configuration is PostgreSQL-only. For Aurora PostgreSQL, use amazon-aurora-postgresql instead. Contains safety guardrails and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[825,826,829,832],{"name":26,"slug":8,"type":15},{"name":827,"slug":828,"type":15},"Database","database",{"name":830,"slug":831,"type":15},"MySQL","mysql",{"name":833,"slug":834,"type":15},"Serverless","serverless","2026-07-12T08:43:13.27939",{"slug":837,"name":837,"fn":838,"description":839,"org":840,"tags":841,"stars":27,"repoUrl":28,"updatedAt":848},"amazon-aurora-postgresql","configure Amazon Aurora PostgreSQL clusters","Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or PostgreSQL upgrade planning. For Aurora MySQL, use amazon-aurora-mysql instead. Contains safety guardrails, express-first routing, and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[842,843,844,847],{"name":26,"slug":8,"type":15},{"name":827,"slug":828,"type":15},{"name":845,"slug":846,"type":15},"PostgreSQL","postgresql",{"name":833,"slug":834,"type":15},"2026-07-16T06:00:34.789624",{"slug":850,"name":850,"fn":851,"description":852,"org":853,"tags":854,"stars":27,"repoUrl":28,"updatedAt":860},"amazon-bedrock","build generative AI apps with Amazon Bedrock","Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore (including the Harness managed agent loop). Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, migrating\u002Fporting\u002Fconverting a Bedrock Agent (including inline agents) to an AgentCore Harness, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching, quota health checks and throttling diagnosis, cost attribution, migrating between Claude model generations, chunking strategies, API selection (Converse vs InvokeModel), and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Coinbase CDP, Stripe Privy, 402 Payment Required, paid endpoint). NOT for custom model training, Rekognition, or Comprehend.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[855,856,857],{"name":713,"slug":714,"type":15},{"name":26,"slug":8,"type":15},{"name":858,"slug":859,"type":15},"LLM","llm","2026-08-07T04:38:13.03499",{"slug":862,"name":862,"fn":863,"description":864,"org":865,"tags":866,"stars":27,"repoUrl":28,"updatedAt":874},"amazon-braket","run quantum computing workflows on AWS","Runs quantum computing workflows on AWS through Amazon Braket — discovering devices (QPUs and simulators) and their availability, building gate-model circuits and analog Hamiltonian programs, submitting quantum tasks, program sets and hybrid jobs, looking up prices, and capping spend with spending limits. Applies to any request about quantum computing, quantum hardware, quantum simulation, AHS, OpenQASM, or running a quantum algorithm on AWS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[867,868,871],{"name":26,"slug":8,"type":15},{"name":869,"slug":870,"type":15},"Quantum Computing","quantum-computing",{"name":872,"slug":873,"type":15},"Simulation","simulation","2026-08-27T13:04:17.249442",142,{"items":877,"total":927},[878,885,892,899,906,912,919],{"slug":707,"name":707,"fn":708,"description":709,"org":879,"tags":880,"stars":27,"repoUrl":28,"updatedAt":720},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[881,882,883,884],{"name":713,"slug":714,"type":15},{"name":17,"slug":18,"type":15},{"name":26,"slug":8,"type":15},{"name":718,"slug":719,"type":15},{"slug":722,"name":722,"fn":723,"description":724,"org":886,"tags":887,"stars":27,"repoUrl":28,"updatedAt":735},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[888,889,890,891],{"name":713,"slug":714,"type":15},{"name":729,"slug":730,"type":15},{"name":732,"slug":733,"type":15},{"name":26,"slug":8,"type":15},{"slug":737,"name":737,"fn":738,"description":739,"org":893,"tags":894,"stars":27,"repoUrl":28,"updatedAt":750},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[895,896,897,898],{"name":713,"slug":714,"type":15},{"name":26,"slug":8,"type":15},{"name":745,"slug":746,"type":15},{"name":748,"slug":749,"type":15},{"slug":752,"name":752,"fn":753,"description":754,"org":900,"tags":901,"stars":27,"repoUrl":28,"updatedAt":763},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[902,903,904,905],{"name":713,"slug":714,"type":15},{"name":26,"slug":8,"type":15},{"name":760,"slug":761,"type":15},{"name":20,"slug":21,"type":15},{"slug":765,"name":765,"fn":766,"description":767,"org":907,"tags":908,"stars":27,"repoUrl":28,"updatedAt":773},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[909,910,911],{"name":713,"slug":714,"type":15},{"name":26,"slug":8,"type":15},{"name":20,"slug":21,"type":15},{"slug":775,"name":775,"fn":776,"description":777,"org":913,"tags":914,"stars":27,"repoUrl":28,"updatedAt":788},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[915,916,917,918],{"name":713,"slug":714,"type":15},{"name":26,"slug":8,"type":15},{"name":783,"slug":784,"type":15},{"name":786,"slug":787,"type":15},{"slug":790,"name":790,"fn":791,"description":792,"org":920,"tags":921,"stars":27,"repoUrl":28,"updatedAt":804},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[922,923,924,925,926],{"name":713,"slug":714,"type":15},{"name":26,"slug":8,"type":15},{"name":798,"slug":799,"type":15},{"name":748,"slug":749,"type":15},{"name":802,"slug":803,"type":15},123]