[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-aws-messaging-and-streaming":3,"mdc-nuqulv-key":35,"related-org-aws-aws-messaging-and-streaming":1129,"related-repo-aws-aws-messaging-and-streaming":1302},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":30,"sourceUrl":33,"mdContent":34},"aws-messaging-and-streaming","configure AWS messaging and streaming services","Guides general use of AWS messaging and streaming services. Covers Amazon SQS, Amazon SNS, Amazon EventBridge, Amazon MQ, Amazon Kinesis Data Streams, Amazon Data Firehose, Amazon Managed Service for Apache Flink, and Amazon Managed Streaming for Apache Kafka (MSK).  Use when reasoning about messaging and streaming patterns.  In general, use specific skills or documentation searches for detailed service-specific questions. Do NOT use for MSK or Managed Service for Apache Flink questions, prefer specific skills.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"aws","AWS (Amazon)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Data Engineering","data-engineering","tag",{"name":17,"slug":18,"type":15},"Data Pipeline","data-pipeline",{"name":20,"slug":21,"type":15},"Messaging","messaging",{"name":23,"slug":8,"type":15},"AWS",1822,"https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws","2026-08-01T05:42:04.399347",null,157,[],{"repoUrl":25,"stars":24,"forks":28,"topics":31,"description":32},[],"Official, AWS-supported MCP servers, skills, and plugins to help AI agents build on AWS","https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws\u002Ftree\u002FHEAD\u002Fskills\u002Fcore-skills\u002Faws-messaging-and-streaming","---\nname: aws-messaging-and-streaming\ndescription: >-\n  Guides general use of AWS messaging and streaming services. Covers Amazon SQS, Amazon\n  SNS, Amazon EventBridge, Amazon MQ, Amazon Kinesis Data Streams, Amazon Data Firehose,\n  Amazon Managed Service for Apache Flink, and Amazon Managed Streaming for Apache\n  Kafka (MSK).  Use when reasoning about messaging and streaming patterns.  In general,\n  use specific skills or documentation searches for detailed service-specific questions.\n  Do NOT use for MSK or Managed Service for Apache Flink questions, prefer specific\n  skills.\nversion: 2\n---\n\n# AWS Messaging & Streaming Services\n\nWhen answering AWS messaging and streaming questions, verify specific numbers, versions, limits, and behavioral details from service-specific skills or official AWS documentation. When uncertain, search skills or docs rather than guessing. Fabricated configuration options or incorrect version numbers are worse than admitting uncertainty.\n\nWhen a question asks about recommended configurations (CloudWatch alarm settings, thresholds, missing data treatment), search for the service-specific skills or documentation rather than relying on general best practices.\n\n## Overview\n\nDomain expertise for choosing and using AWS services that move data between producers and consumers.\nThis skill covers two fundamental patterns — **messaging** and **streaming** — and the AWS services that implement each.\nUse this skill to decide which pattern fits a workload, select the right service, and understand how services integrate with each other.\n\nFor specific guidance on individual AWS services, see reference files or service-specific Skills.\n\n## Streaming and Messaging\n\n### What Is Messaging?\n\nMessaging enables **decoupled, asynchronous communication** between components. A producer sends a message; one or more consumers receive and process it. Once processed, the message is typically deleted. Messaging services handle delivery guarantees, retries, and dead-letter routing.\n\n**Key characteristics:**\n\n- Messages are consumed once (point-to-point) or fanned out (pub\u002Fsub), then removed\n- No replay — once acknowledged, a message is gone\n- Designed for command\u002Frequest workloads, task distribution, and event notification\n\n### What Is Streaming?\n\nStreaming enables **ordered, durable, high-throughput continuous data flow**. Producers append records to a log; consumers read from positions in that log. Records persist for a configurable retention period regardless of consumption.\n\n**Key characteristics:**\n\n- Records are retained and replayable within the retention window\n- Strict ordering within a partition\u002Fshard\n- Multiple independent consumers can read the same data at different positions\n- Designed for event sourcing, real-time analytics, change data capture, and continuous processing\n\n### Key Differences\n\n| Dimension | Messaging | Streaming |\n|---|---|---|\n| **Data lifecycle** | Deleted after consumption | Retained for replay (hours to indefinitely) |\n| **Ordering** | Best-effort (Standard) or per-group (FIFO) | Strict per-partition\u002Fshard |\n| **Consumer model** | Competing consumers (work distribution) | Independent readers (fan-out by position) |\n| **Throughput pattern** | Bursty, variable | Sustained, high-volume |\n| **Replay** | Not supported (except DLQ redrive) | Native — seek to any position in retention |\n| **Typical latency** | Milliseconds (push or short-poll) | Milliseconds to low seconds |\n| **Scaling unit** | Concurrency (consumers\u002Fpollers) | Partitions or shards |\n\n### Messaging Use Cases\n\n- Decoupling microservices with request\u002Fresponse or command patterns\n- Distributing work across a pool of competing consumers (task queues)\n- Fan-out notifications where each subscriber acts independently\n- Workloads that are bursty and benefit from queue buffering\n- Migrating existing JMS\u002FAMQP applications (Amazon MQ)\n\n### Streaming Use Cases\n\n- Continuous, high-throughput data ingestion (logs, metrics, clickstreams, IoT telemetry)\n- Event sourcing where consumers need to replay from any point in time\n- Multiple independent consumers processing the same data differently\n- Real-time analytics, windowed aggregations, or complex event processing\n- Change data capture (CDC) pipelines\n\n### Messaging Services\n\nThese services are generally used for messaging workloads.\nSometimes streaming services (Kinesis Data Streams, Managed Streaming for Apache Kafka) are also used for messaging workloads, depending on exact use case and requirements.\n\n| Service | Best For | Key Differentiator |\n|---|---|---|\n| **Amazon SQS** | Task queues, decoupling, buffering | Fully managed, unlimited throughput (Standard), exactly-once (FIFO), fair queues for multi-tenant workloads |\n| **Amazon SNS** | Fan-out, pub\u002Fsub notifications | Push to multiple subscribers (SQS, Lambda, HTTP, email, SMS) |\n| **Amazon EventBridge** | Event routing, cross-account\u002FSaaS integration | Content-based filtering, schema registry, 200+ AWS source integrations |\n| **Amazon MQ** | Lift-and-shift of existing JMS\u002FAMQP\u002FMQTT apps | Protocol compatibility (ActiveMQ, RabbitMQ) for legacy migration |\n\n### Streaming Services\n\nThese services are generally used for streaming workloads.\n\n| Service | Best For | Key Differentiator |\n|---|---|---|\n| **Amazon Kinesis Data Streams** | Real-time ingestion with AWS-native consumers | On-demand Advantage mode (instant scaling, no shard management), 1–365 day retention |\n| **Amazon Data Firehose** | Zero-admin delivery to storage\u002Fanalytics | Auto-scales, buffers, batches, and delivers to destinations |\n| **Amazon Managed Service for Apache Flink** | Complex stream processing (joins, windows, state) | Full Apache Flink runtime — SQL, Java, Python APIs for stateful computation |\n| **Amazon MSK** | Kafka-native workloads, ecosystem compatibility | Apache Kafka API, Express brokers (3x throughput, 20x faster scaling compared to Standard brokers), broad connector ecosystem |\n\n## Common Integration Gotchas\n\n- **SQS system vs. user message attributes:** Attributes like `AWSTraceHeader` (set by X-Ray \u002F EventBridge \u002F Pipes when sending to an SQS DLQ) and `SenderId`, `SentTimestamp` are SQS *system* attributes, NOT user message attributes. They are never returned by default from `ReceiveMessage` — request them explicitly via `AttributeNames=[...]` (or `MessageSystemAttributeNames`), separate from `MessageAttributeNames` which fetches user attributes. This matters for DLQs, where the trace header rides on the system attribute and the user-attributes slot carries the service's failure metadata (e.g. EventBridge's `RULE_ARN`, `ERROR_CODE`).\n\n- **SNS → Firehose → S3 record separator:** For SNS subscriptions using the `firehose` protocol that land in S3, records are already newline-delimited by default (NDJSON). Do NOT turn on Firehose's `AppendDelimiterToRecord` — SNS emits the newline itself, and enabling the processor produces double newlines.\n\n- **EventBridge rule target DLQ + SNS subscription DLQ both need a DLQ queue policy.** Attaching the DLQ alone is not enough — the DLQ silently drops messages until its queue policy allows the service principal. EventBridge: `PutTargets` with `DeadLetterConfig.Arn=\u003CDLQ>`, plus SQS policy `Allow sqs:SendMessage` for `Service: events.amazonaws.com` with `aws:SourceArn` = the rule ARN. SNS: `SetSubscriptionAttributes` `RedrivePolicy={\"deadLetterTargetArn\":\"\u003CDLQ>\"}`, plus SQS policy allowing `Service: sns.amazonaws.com` scoped by the topic ARN.\n\n- **SQS production defaults: long polling + customer-managed encryption.** New queues default to short-poll (`ReceiveMessageWaitTimeSeconds=0`) and SSE-SQS (AWS-owned key). For production, `SetQueueAttributes` with `ReceiveMessageWaitTimeSeconds=20` (long polling) and `KmsMasterKeyId=\u003Ccustomer-managed key id\u002FARN>` rather than leaving `alias\u002Faws\u002Fsqs`.\n\n- **Broker and Kafka credentials belong in Secrets Manager, not connection strings.** Do not hardcode usernames, passwords, or SASL\u002FSCRAM credentials in application config, env vars, JAAS files, or IaC. For Amazon MQ (ActiveMQ\u002FRabbitMQ) store broker users as secrets and fetch at startup; Lambda event source mappings for Amazon MQ require the broker credentials to be supplied as a Secrets Manager secret ARN (`BASIC_AUTH`), not inline. For MSK SASL\u002FSCRAM the secret is not optional: it must be named with the `AmazonMSK_` prefix and encrypted with a **customer-managed** KMS key (secrets created with the default `aws\u002Fsecretsmanager` key cannot be associated with a cluster), then attached via `BatchAssociateScramSecret`. Lambda event source mappings for MSK (SASL\u002FSCRAM or mTLS) and self-managed Kafka also reference a Secrets Manager secret ARN rather than inline credentials. Enable rotation and scope IAM read access (`secretsmanager:GetSecretValue`) to the consuming role only. See AWS Well-Architected [SEC02-BP03 Store and use secrets securely](https:\u002F\u002Fdocs.aws.amazon.com\u002Fwellarchitected\u002Flatest\u002Fsecurity-pillar\u002Fsec_identities_secrets.html).\n\n- **Service-principal resource policies need `aws:SourceArn` \u002F `aws:SourceAccount` conditions.** When a queue or topic policy grants a service principal like `events.amazonaws.com`, `sns.amazonaws.com`, or `s3.amazonaws.com` permission to `sqs:SendMessage` or `sns:Publish`, omitting source conditions opens a confused-deputy hole — any rule, topic, or bucket in any AWS account can drive writes. Scope every such statement with `aws:SourceArn` (the specific rule\u002Ftopic\u002Fbucket\u002Fpipe ARN; use `ArnLike` with `*` when the ARN isn't fully known yet) and `aws:SourceAccount` (your account ID). For S3 event notifications both keys are required because S3 bucket ARNs don't carry the account ID, so `aws:SourceArn` alone doesn't constrain the account. The same pattern applies to role trust policies for IAM roles used by EventBridge rules and EventBridge Pipes (principal `events.amazonaws.com` \u002F `pipes.amazonaws.com`, `aws:SourceArn` = the rule or pipe ARN) — not just the DLQ case called out above. See the IAM User Guide on [The confused deputy problem](https:\u002F\u002Fdocs.aws.amazon.com\u002FIAM\u002Flatest\u002FUserGuide\u002Fconfused-deputy.html).\n",{"data":36,"body":38},{"name":4,"description":6,"version":37},2,{"type":39,"children":40},"root",[41,50,56,61,68,87,92,98,105,117,125,145,151,163,170,193,199,378,384,412,418,446,452,457,568,574,579,687,693],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"aws-messaging-streaming-services",[47],{"type":48,"value":49},"text","AWS Messaging & Streaming Services",{"type":42,"tag":51,"props":52,"children":53},"p",{},[54],{"type":48,"value":55},"When answering AWS messaging and streaming questions, verify specific numbers, versions, limits, and behavioral details from service-specific skills or official AWS documentation. When uncertain, search skills or docs rather than guessing. Fabricated configuration options or incorrect version numbers are worse than admitting uncertainty.",{"type":42,"tag":51,"props":57,"children":58},{},[59],{"type":48,"value":60},"When a question asks about recommended configurations (CloudWatch alarm settings, thresholds, missing data treatment), search for the service-specific skills or documentation rather than relying on general best practices.",{"type":42,"tag":62,"props":63,"children":65},"h2",{"id":64},"overview",[66],{"type":48,"value":67},"Overview",{"type":42,"tag":51,"props":69,"children":70},{},[71,73,78,80,85],{"type":48,"value":72},"Domain expertise for choosing and using AWS services that move data between producers and consumers.\nThis skill covers two fundamental patterns — ",{"type":42,"tag":74,"props":75,"children":76},"strong",{},[77],{"type":48,"value":21},{"type":48,"value":79}," and ",{"type":42,"tag":74,"props":81,"children":82},{},[83],{"type":48,"value":84},"streaming",{"type":48,"value":86}," — and the AWS services that implement each.\nUse this skill to decide which pattern fits a workload, select the right service, and understand how services integrate with each other.",{"type":42,"tag":51,"props":88,"children":89},{},[90],{"type":48,"value":91},"For specific guidance on individual AWS services, see reference files or service-specific Skills.",{"type":42,"tag":62,"props":93,"children":95},{"id":94},"streaming-and-messaging",[96],{"type":48,"value":97},"Streaming and Messaging",{"type":42,"tag":99,"props":100,"children":102},"h3",{"id":101},"what-is-messaging",[103],{"type":48,"value":104},"What Is Messaging?",{"type":42,"tag":51,"props":106,"children":107},{},[108,110,115],{"type":48,"value":109},"Messaging enables ",{"type":42,"tag":74,"props":111,"children":112},{},[113],{"type":48,"value":114},"decoupled, asynchronous communication",{"type":48,"value":116}," between components. A producer sends a message; one or more consumers receive and process it. Once processed, the message is typically deleted. Messaging services handle delivery guarantees, retries, and dead-letter routing.",{"type":42,"tag":51,"props":118,"children":119},{},[120],{"type":42,"tag":74,"props":121,"children":122},{},[123],{"type":48,"value":124},"Key characteristics:",{"type":42,"tag":126,"props":127,"children":128},"ul",{},[129,135,140],{"type":42,"tag":130,"props":131,"children":132},"li",{},[133],{"type":48,"value":134},"Messages are consumed once (point-to-point) or fanned out (pub\u002Fsub), then removed",{"type":42,"tag":130,"props":136,"children":137},{},[138],{"type":48,"value":139},"No replay — once acknowledged, a message is gone",{"type":42,"tag":130,"props":141,"children":142},{},[143],{"type":48,"value":144},"Designed for command\u002Frequest workloads, task distribution, and event notification",{"type":42,"tag":99,"props":146,"children":148},{"id":147},"what-is-streaming",[149],{"type":48,"value":150},"What Is Streaming?",{"type":42,"tag":51,"props":152,"children":153},{},[154,156,161],{"type":48,"value":155},"Streaming enables ",{"type":42,"tag":74,"props":157,"children":158},{},[159],{"type":48,"value":160},"ordered, durable, high-throughput continuous data flow",{"type":48,"value":162},". Producers append records to a log; consumers read from positions in that log. Records persist for a configurable retention period regardless of consumption.",{"type":42,"tag":51,"props":164,"children":165},{},[166],{"type":42,"tag":74,"props":167,"children":168},{},[169],{"type":48,"value":124},{"type":42,"tag":126,"props":171,"children":172},{},[173,178,183,188],{"type":42,"tag":130,"props":174,"children":175},{},[176],{"type":48,"value":177},"Records are retained and replayable within the retention window",{"type":42,"tag":130,"props":179,"children":180},{},[181],{"type":48,"value":182},"Strict ordering within a partition\u002Fshard",{"type":42,"tag":130,"props":184,"children":185},{},[186],{"type":48,"value":187},"Multiple independent consumers can read the same data at different positions",{"type":42,"tag":130,"props":189,"children":190},{},[191],{"type":48,"value":192},"Designed for event sourcing, real-time analytics, change data capture, and continuous processing",{"type":42,"tag":99,"props":194,"children":196},{"id":195},"key-differences",[197],{"type":48,"value":198},"Key Differences",{"type":42,"tag":200,"props":201,"children":202},"table",{},[203,226],{"type":42,"tag":204,"props":205,"children":206},"thead",{},[207],{"type":42,"tag":208,"props":209,"children":210},"tr",{},[211,217,221],{"type":42,"tag":212,"props":213,"children":214},"th",{},[215],{"type":48,"value":216},"Dimension",{"type":42,"tag":212,"props":218,"children":219},{},[220],{"type":48,"value":20},{"type":42,"tag":212,"props":222,"children":223},{},[224],{"type":48,"value":225},"Streaming",{"type":42,"tag":227,"props":228,"children":229},"tbody",{},[230,252,273,294,315,336,357],{"type":42,"tag":208,"props":231,"children":232},{},[233,242,247],{"type":42,"tag":234,"props":235,"children":236},"td",{},[237],{"type":42,"tag":74,"props":238,"children":239},{},[240],{"type":48,"value":241},"Data lifecycle",{"type":42,"tag":234,"props":243,"children":244},{},[245],{"type":48,"value":246},"Deleted after consumption",{"type":42,"tag":234,"props":248,"children":249},{},[250],{"type":48,"value":251},"Retained for replay (hours to indefinitely)",{"type":42,"tag":208,"props":253,"children":254},{},[255,263,268],{"type":42,"tag":234,"props":256,"children":257},{},[258],{"type":42,"tag":74,"props":259,"children":260},{},[261],{"type":48,"value":262},"Ordering",{"type":42,"tag":234,"props":264,"children":265},{},[266],{"type":48,"value":267},"Best-effort (Standard) or per-group (FIFO)",{"type":42,"tag":234,"props":269,"children":270},{},[271],{"type":48,"value":272},"Strict per-partition\u002Fshard",{"type":42,"tag":208,"props":274,"children":275},{},[276,284,289],{"type":42,"tag":234,"props":277,"children":278},{},[279],{"type":42,"tag":74,"props":280,"children":281},{},[282],{"type":48,"value":283},"Consumer model",{"type":42,"tag":234,"props":285,"children":286},{},[287],{"type":48,"value":288},"Competing consumers (work distribution)",{"type":42,"tag":234,"props":290,"children":291},{},[292],{"type":48,"value":293},"Independent readers (fan-out by position)",{"type":42,"tag":208,"props":295,"children":296},{},[297,305,310],{"type":42,"tag":234,"props":298,"children":299},{},[300],{"type":42,"tag":74,"props":301,"children":302},{},[303],{"type":48,"value":304},"Throughput pattern",{"type":42,"tag":234,"props":306,"children":307},{},[308],{"type":48,"value":309},"Bursty, variable",{"type":42,"tag":234,"props":311,"children":312},{},[313],{"type":48,"value":314},"Sustained, high-volume",{"type":42,"tag":208,"props":316,"children":317},{},[318,326,331],{"type":42,"tag":234,"props":319,"children":320},{},[321],{"type":42,"tag":74,"props":322,"children":323},{},[324],{"type":48,"value":325},"Replay",{"type":42,"tag":234,"props":327,"children":328},{},[329],{"type":48,"value":330},"Not supported (except DLQ redrive)",{"type":42,"tag":234,"props":332,"children":333},{},[334],{"type":48,"value":335},"Native — seek to any position in retention",{"type":42,"tag":208,"props":337,"children":338},{},[339,347,352],{"type":42,"tag":234,"props":340,"children":341},{},[342],{"type":42,"tag":74,"props":343,"children":344},{},[345],{"type":48,"value":346},"Typical latency",{"type":42,"tag":234,"props":348,"children":349},{},[350],{"type":48,"value":351},"Milliseconds (push or short-poll)",{"type":42,"tag":234,"props":353,"children":354},{},[355],{"type":48,"value":356},"Milliseconds to low seconds",{"type":42,"tag":208,"props":358,"children":359},{},[360,368,373],{"type":42,"tag":234,"props":361,"children":362},{},[363],{"type":42,"tag":74,"props":364,"children":365},{},[366],{"type":48,"value":367},"Scaling unit",{"type":42,"tag":234,"props":369,"children":370},{},[371],{"type":48,"value":372},"Concurrency (consumers\u002Fpollers)",{"type":42,"tag":234,"props":374,"children":375},{},[376],{"type":48,"value":377},"Partitions or shards",{"type":42,"tag":99,"props":379,"children":381},{"id":380},"messaging-use-cases",[382],{"type":48,"value":383},"Messaging Use Cases",{"type":42,"tag":126,"props":385,"children":386},{},[387,392,397,402,407],{"type":42,"tag":130,"props":388,"children":389},{},[390],{"type":48,"value":391},"Decoupling microservices with request\u002Fresponse or command patterns",{"type":42,"tag":130,"props":393,"children":394},{},[395],{"type":48,"value":396},"Distributing work across a pool of competing consumers (task queues)",{"type":42,"tag":130,"props":398,"children":399},{},[400],{"type":48,"value":401},"Fan-out notifications where each subscriber acts independently",{"type":42,"tag":130,"props":403,"children":404},{},[405],{"type":48,"value":406},"Workloads that are bursty and benefit from queue buffering",{"type":42,"tag":130,"props":408,"children":409},{},[410],{"type":48,"value":411},"Migrating existing JMS\u002FAMQP applications (Amazon MQ)",{"type":42,"tag":99,"props":413,"children":415},{"id":414},"streaming-use-cases",[416],{"type":48,"value":417},"Streaming Use Cases",{"type":42,"tag":126,"props":419,"children":420},{},[421,426,431,436,441],{"type":42,"tag":130,"props":422,"children":423},{},[424],{"type":48,"value":425},"Continuous, high-throughput data ingestion (logs, metrics, clickstreams, IoT telemetry)",{"type":42,"tag":130,"props":427,"children":428},{},[429],{"type":48,"value":430},"Event sourcing where consumers need to replay from any point in time",{"type":42,"tag":130,"props":432,"children":433},{},[434],{"type":48,"value":435},"Multiple independent consumers processing the same data differently",{"type":42,"tag":130,"props":437,"children":438},{},[439],{"type":48,"value":440},"Real-time analytics, windowed aggregations, or complex event processing",{"type":42,"tag":130,"props":442,"children":443},{},[444],{"type":48,"value":445},"Change data capture (CDC) pipelines",{"type":42,"tag":99,"props":447,"children":449},{"id":448},"messaging-services",[450],{"type":48,"value":451},"Messaging Services",{"type":42,"tag":51,"props":453,"children":454},{},[455],{"type":48,"value":456},"These services are generally used for messaging workloads.\nSometimes streaming services (Kinesis Data Streams, Managed Streaming for Apache Kafka) are also used for messaging workloads, depending on exact use case and requirements.",{"type":42,"tag":200,"props":458,"children":459},{},[460,481],{"type":42,"tag":204,"props":461,"children":462},{},[463],{"type":42,"tag":208,"props":464,"children":465},{},[466,471,476],{"type":42,"tag":212,"props":467,"children":468},{},[469],{"type":48,"value":470},"Service",{"type":42,"tag":212,"props":472,"children":473},{},[474],{"type":48,"value":475},"Best For",{"type":42,"tag":212,"props":477,"children":478},{},[479],{"type":48,"value":480},"Key Differentiator",{"type":42,"tag":227,"props":482,"children":483},{},[484,505,526,547],{"type":42,"tag":208,"props":485,"children":486},{},[487,495,500],{"type":42,"tag":234,"props":488,"children":489},{},[490],{"type":42,"tag":74,"props":491,"children":492},{},[493],{"type":48,"value":494},"Amazon SQS",{"type":42,"tag":234,"props":496,"children":497},{},[498],{"type":48,"value":499},"Task queues, decoupling, buffering",{"type":42,"tag":234,"props":501,"children":502},{},[503],{"type":48,"value":504},"Fully managed, unlimited throughput (Standard), exactly-once (FIFO), fair queues for multi-tenant workloads",{"type":42,"tag":208,"props":506,"children":507},{},[508,516,521],{"type":42,"tag":234,"props":509,"children":510},{},[511],{"type":42,"tag":74,"props":512,"children":513},{},[514],{"type":48,"value":515},"Amazon SNS",{"type":42,"tag":234,"props":517,"children":518},{},[519],{"type":48,"value":520},"Fan-out, pub\u002Fsub notifications",{"type":42,"tag":234,"props":522,"children":523},{},[524],{"type":48,"value":525},"Push to multiple subscribers (SQS, Lambda, HTTP, email, SMS)",{"type":42,"tag":208,"props":527,"children":528},{},[529,537,542],{"type":42,"tag":234,"props":530,"children":531},{},[532],{"type":42,"tag":74,"props":533,"children":534},{},[535],{"type":48,"value":536},"Amazon EventBridge",{"type":42,"tag":234,"props":538,"children":539},{},[540],{"type":48,"value":541},"Event routing, cross-account\u002FSaaS integration",{"type":42,"tag":234,"props":543,"children":544},{},[545],{"type":48,"value":546},"Content-based filtering, schema registry, 200+ AWS source integrations",{"type":42,"tag":208,"props":548,"children":549},{},[550,558,563],{"type":42,"tag":234,"props":551,"children":552},{},[553],{"type":42,"tag":74,"props":554,"children":555},{},[556],{"type":48,"value":557},"Amazon MQ",{"type":42,"tag":234,"props":559,"children":560},{},[561],{"type":48,"value":562},"Lift-and-shift of existing JMS\u002FAMQP\u002FMQTT apps",{"type":42,"tag":234,"props":564,"children":565},{},[566],{"type":48,"value":567},"Protocol compatibility (ActiveMQ, RabbitMQ) for legacy migration",{"type":42,"tag":99,"props":569,"children":571},{"id":570},"streaming-services",[572],{"type":48,"value":573},"Streaming Services",{"type":42,"tag":51,"props":575,"children":576},{},[577],{"type":48,"value":578},"These services are generally used for streaming workloads.",{"type":42,"tag":200,"props":580,"children":581},{},[582,600],{"type":42,"tag":204,"props":583,"children":584},{},[585],{"type":42,"tag":208,"props":586,"children":587},{},[588,592,596],{"type":42,"tag":212,"props":589,"children":590},{},[591],{"type":48,"value":470},{"type":42,"tag":212,"props":593,"children":594},{},[595],{"type":48,"value":475},{"type":42,"tag":212,"props":597,"children":598},{},[599],{"type":48,"value":480},{"type":42,"tag":227,"props":601,"children":602},{},[603,624,645,666],{"type":42,"tag":208,"props":604,"children":605},{},[606,614,619],{"type":42,"tag":234,"props":607,"children":608},{},[609],{"type":42,"tag":74,"props":610,"children":611},{},[612],{"type":48,"value":613},"Amazon Kinesis Data Streams",{"type":42,"tag":234,"props":615,"children":616},{},[617],{"type":48,"value":618},"Real-time ingestion with AWS-native consumers",{"type":42,"tag":234,"props":620,"children":621},{},[622],{"type":48,"value":623},"On-demand Advantage mode (instant scaling, no shard management), 1–365 day retention",{"type":42,"tag":208,"props":625,"children":626},{},[627,635,640],{"type":42,"tag":234,"props":628,"children":629},{},[630],{"type":42,"tag":74,"props":631,"children":632},{},[633],{"type":48,"value":634},"Amazon Data Firehose",{"type":42,"tag":234,"props":636,"children":637},{},[638],{"type":48,"value":639},"Zero-admin delivery to storage\u002Fanalytics",{"type":42,"tag":234,"props":641,"children":642},{},[643],{"type":48,"value":644},"Auto-scales, buffers, batches, and delivers to destinations",{"type":42,"tag":208,"props":646,"children":647},{},[648,656,661],{"type":42,"tag":234,"props":649,"children":650},{},[651],{"type":42,"tag":74,"props":652,"children":653},{},[654],{"type":48,"value":655},"Amazon Managed Service for Apache Flink",{"type":42,"tag":234,"props":657,"children":658},{},[659],{"type":48,"value":660},"Complex stream processing (joins, windows, state)",{"type":42,"tag":234,"props":662,"children":663},{},[664],{"type":48,"value":665},"Full Apache Flink runtime — SQL, Java, Python APIs for stateful computation",{"type":42,"tag":208,"props":667,"children":668},{},[669,677,682],{"type":42,"tag":234,"props":670,"children":671},{},[672],{"type":42,"tag":74,"props":673,"children":674},{},[675],{"type":48,"value":676},"Amazon MSK",{"type":42,"tag":234,"props":678,"children":679},{},[680],{"type":48,"value":681},"Kafka-native workloads, ecosystem compatibility",{"type":42,"tag":234,"props":683,"children":684},{},[685],{"type":48,"value":686},"Apache Kafka API, Express brokers (3x throughput, 20x faster scaling compared to Standard brokers), broad connector ecosystem",{"type":42,"tag":62,"props":688,"children":690},{"id":689},"common-integration-gotchas",[691],{"type":48,"value":692},"Common Integration Gotchas",{"type":42,"tag":126,"props":694,"children":695},{},[696,786,812,885,934,1001],{"type":42,"tag":130,"props":697,"children":698},{},[699,704,706,713,715,721,723,729,731,737,739,745,747,753,755,761,763,769,771,777,778,784],{"type":42,"tag":74,"props":700,"children":701},{},[702],{"type":48,"value":703},"SQS system vs. user message attributes:",{"type":48,"value":705}," Attributes like ",{"type":42,"tag":707,"props":708,"children":710},"code",{"className":709},[],[711],{"type":48,"value":712},"AWSTraceHeader",{"type":48,"value":714}," (set by X-Ray \u002F EventBridge \u002F Pipes when sending to an SQS DLQ) and ",{"type":42,"tag":707,"props":716,"children":718},{"className":717},[],[719],{"type":48,"value":720},"SenderId",{"type":48,"value":722},", ",{"type":42,"tag":707,"props":724,"children":726},{"className":725},[],[727],{"type":48,"value":728},"SentTimestamp",{"type":48,"value":730}," are SQS ",{"type":42,"tag":732,"props":733,"children":734},"em",{},[735],{"type":48,"value":736},"system",{"type":48,"value":738}," attributes, NOT user message attributes. They are never returned by default from ",{"type":42,"tag":707,"props":740,"children":742},{"className":741},[],[743],{"type":48,"value":744},"ReceiveMessage",{"type":48,"value":746}," — request them explicitly via ",{"type":42,"tag":707,"props":748,"children":750},{"className":749},[],[751],{"type":48,"value":752},"AttributeNames=[...]",{"type":48,"value":754}," (or ",{"type":42,"tag":707,"props":756,"children":758},{"className":757},[],[759],{"type":48,"value":760},"MessageSystemAttributeNames",{"type":48,"value":762},"), separate from ",{"type":42,"tag":707,"props":764,"children":766},{"className":765},[],[767],{"type":48,"value":768},"MessageAttributeNames",{"type":48,"value":770}," which fetches user attributes. This matters for DLQs, where the trace header rides on the system attribute and the user-attributes slot carries the service's failure metadata (e.g. EventBridge's ",{"type":42,"tag":707,"props":772,"children":774},{"className":773},[],[775],{"type":48,"value":776},"RULE_ARN",{"type":48,"value":722},{"type":42,"tag":707,"props":779,"children":781},{"className":780},[],[782],{"type":48,"value":783},"ERROR_CODE",{"type":48,"value":785},").",{"type":42,"tag":130,"props":787,"children":788},{},[789,794,796,802,804,810],{"type":42,"tag":74,"props":790,"children":791},{},[792],{"type":48,"value":793},"SNS → Firehose → S3 record separator:",{"type":48,"value":795}," For SNS subscriptions using the ",{"type":42,"tag":707,"props":797,"children":799},{"className":798},[],[800],{"type":48,"value":801},"firehose",{"type":48,"value":803}," protocol that land in S3, records are already newline-delimited by default (NDJSON). Do NOT turn on Firehose's ",{"type":42,"tag":707,"props":805,"children":807},{"className":806},[],[808],{"type":48,"value":809},"AppendDelimiterToRecord",{"type":48,"value":811}," — SNS emits the newline itself, and enabling the processor produces double newlines.",{"type":42,"tag":130,"props":813,"children":814},{},[815,820,822,828,830,836,838,844,846,852,853,859,861,867,869,875,877,883],{"type":42,"tag":74,"props":816,"children":817},{},[818],{"type":48,"value":819},"EventBridge rule target DLQ + SNS subscription DLQ both need a DLQ queue policy.",{"type":48,"value":821}," Attaching the DLQ alone is not enough — the DLQ silently drops messages until its queue policy allows the service principal. EventBridge: ",{"type":42,"tag":707,"props":823,"children":825},{"className":824},[],[826],{"type":48,"value":827},"PutTargets",{"type":48,"value":829}," with ",{"type":42,"tag":707,"props":831,"children":833},{"className":832},[],[834],{"type":48,"value":835},"DeadLetterConfig.Arn=\u003CDLQ>",{"type":48,"value":837},", plus SQS policy ",{"type":42,"tag":707,"props":839,"children":841},{"className":840},[],[842],{"type":48,"value":843},"Allow sqs:SendMessage",{"type":48,"value":845}," for ",{"type":42,"tag":707,"props":847,"children":849},{"className":848},[],[850],{"type":48,"value":851},"Service: events.amazonaws.com",{"type":48,"value":829},{"type":42,"tag":707,"props":854,"children":856},{"className":855},[],[857],{"type":48,"value":858},"aws:SourceArn",{"type":48,"value":860}," = the rule ARN. SNS: ",{"type":42,"tag":707,"props":862,"children":864},{"className":863},[],[865],{"type":48,"value":866},"SetSubscriptionAttributes",{"type":48,"value":868}," ",{"type":42,"tag":707,"props":870,"children":872},{"className":871},[],[873],{"type":48,"value":874},"RedrivePolicy={\"deadLetterTargetArn\":\"\u003CDLQ>\"}",{"type":48,"value":876},", plus SQS policy allowing ",{"type":42,"tag":707,"props":878,"children":880},{"className":879},[],[881],{"type":48,"value":882},"Service: sns.amazonaws.com",{"type":48,"value":884}," scoped by the topic ARN.",{"type":42,"tag":130,"props":886,"children":887},{},[888,893,895,901,903,909,910,916,918,924,926,932],{"type":42,"tag":74,"props":889,"children":890},{},[891],{"type":48,"value":892},"SQS production defaults: long polling + customer-managed encryption.",{"type":48,"value":894}," New queues default to short-poll (",{"type":42,"tag":707,"props":896,"children":898},{"className":897},[],[899],{"type":48,"value":900},"ReceiveMessageWaitTimeSeconds=0",{"type":48,"value":902},") and SSE-SQS (AWS-owned key). For production, ",{"type":42,"tag":707,"props":904,"children":906},{"className":905},[],[907],{"type":48,"value":908},"SetQueueAttributes",{"type":48,"value":829},{"type":42,"tag":707,"props":911,"children":913},{"className":912},[],[914],{"type":48,"value":915},"ReceiveMessageWaitTimeSeconds=20",{"type":48,"value":917}," (long polling) and ",{"type":42,"tag":707,"props":919,"children":921},{"className":920},[],[922],{"type":48,"value":923},"KmsMasterKeyId=\u003Ccustomer-managed key id\u002FARN>",{"type":48,"value":925}," rather than leaving ",{"type":42,"tag":707,"props":927,"children":929},{"className":928},[],[930],{"type":48,"value":931},"alias\u002Faws\u002Fsqs",{"type":48,"value":933},".",{"type":42,"tag":130,"props":935,"children":936},{},[937,942,944,950,952,958,960,965,967,973,975,981,983,989,991,1000],{"type":42,"tag":74,"props":938,"children":939},{},[940],{"type":48,"value":941},"Broker and Kafka credentials belong in Secrets Manager, not connection strings.",{"type":48,"value":943}," Do not hardcode usernames, passwords, or SASL\u002FSCRAM credentials in application config, env vars, JAAS files, or IaC. For Amazon MQ (ActiveMQ\u002FRabbitMQ) store broker users as secrets and fetch at startup; Lambda event source mappings for Amazon MQ require the broker credentials to be supplied as a Secrets Manager secret ARN (",{"type":42,"tag":707,"props":945,"children":947},{"className":946},[],[948],{"type":48,"value":949},"BASIC_AUTH",{"type":48,"value":951},"), not inline. For MSK SASL\u002FSCRAM the secret is not optional: it must be named with the ",{"type":42,"tag":707,"props":953,"children":955},{"className":954},[],[956],{"type":48,"value":957},"AmazonMSK_",{"type":48,"value":959}," prefix and encrypted with a ",{"type":42,"tag":74,"props":961,"children":962},{},[963],{"type":48,"value":964},"customer-managed",{"type":48,"value":966}," KMS key (secrets created with the default ",{"type":42,"tag":707,"props":968,"children":970},{"className":969},[],[971],{"type":48,"value":972},"aws\u002Fsecretsmanager",{"type":48,"value":974}," key cannot be associated with a cluster), then attached via ",{"type":42,"tag":707,"props":976,"children":978},{"className":977},[],[979],{"type":48,"value":980},"BatchAssociateScramSecret",{"type":48,"value":982},". Lambda event source mappings for MSK (SASL\u002FSCRAM or mTLS) and self-managed Kafka also reference a Secrets Manager secret ARN rather than inline credentials. Enable rotation and scope IAM read access (",{"type":42,"tag":707,"props":984,"children":986},{"className":985},[],[987],{"type":48,"value":988},"secretsmanager:GetSecretValue",{"type":48,"value":990},") to the consuming role only. See AWS Well-Architected ",{"type":42,"tag":992,"props":993,"children":997},"a",{"href":994,"rel":995},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fwellarchitected\u002Flatest\u002Fsecurity-pillar\u002Fsec_identities_secrets.html",[996],"nofollow",[998],{"type":48,"value":999},"SEC02-BP03 Store and use secrets securely",{"type":48,"value":933},{"type":42,"tag":130,"props":1002,"children":1003},{},[1004,1024,1026,1032,1033,1039,1041,1047,1049,1055,1057,1063,1065,1070,1072,1078,1079,1085,1087,1092,1094,1099,1101,1106,1107,1113,1114,1119,1121,1128],{"type":42,"tag":74,"props":1005,"children":1006},{},[1007,1009,1014,1016,1022],{"type":48,"value":1008},"Service-principal resource policies need ",{"type":42,"tag":707,"props":1010,"children":1012},{"className":1011},[],[1013],{"type":48,"value":858},{"type":48,"value":1015}," \u002F ",{"type":42,"tag":707,"props":1017,"children":1019},{"className":1018},[],[1020],{"type":48,"value":1021},"aws:SourceAccount",{"type":48,"value":1023}," conditions.",{"type":48,"value":1025}," When a queue or topic policy grants a service principal like ",{"type":42,"tag":707,"props":1027,"children":1029},{"className":1028},[],[1030],{"type":48,"value":1031},"events.amazonaws.com",{"type":48,"value":722},{"type":42,"tag":707,"props":1034,"children":1036},{"className":1035},[],[1037],{"type":48,"value":1038},"sns.amazonaws.com",{"type":48,"value":1040},", or ",{"type":42,"tag":707,"props":1042,"children":1044},{"className":1043},[],[1045],{"type":48,"value":1046},"s3.amazonaws.com",{"type":48,"value":1048}," permission to ",{"type":42,"tag":707,"props":1050,"children":1052},{"className":1051},[],[1053],{"type":48,"value":1054},"sqs:SendMessage",{"type":48,"value":1056}," or ",{"type":42,"tag":707,"props":1058,"children":1060},{"className":1059},[],[1061],{"type":48,"value":1062},"sns:Publish",{"type":48,"value":1064},", omitting source conditions opens a confused-deputy hole — any rule, topic, or bucket in any AWS account can drive writes. Scope every such statement with ",{"type":42,"tag":707,"props":1066,"children":1068},{"className":1067},[],[1069],{"type":48,"value":858},{"type":48,"value":1071}," (the specific rule\u002Ftopic\u002Fbucket\u002Fpipe ARN; use ",{"type":42,"tag":707,"props":1073,"children":1075},{"className":1074},[],[1076],{"type":48,"value":1077},"ArnLike",{"type":48,"value":829},{"type":42,"tag":707,"props":1080,"children":1082},{"className":1081},[],[1083],{"type":48,"value":1084},"*",{"type":48,"value":1086}," when the ARN isn't fully known yet) and ",{"type":42,"tag":707,"props":1088,"children":1090},{"className":1089},[],[1091],{"type":48,"value":1021},{"type":48,"value":1093}," (your account ID). For S3 event notifications both keys are required because S3 bucket ARNs don't carry the account ID, so ",{"type":42,"tag":707,"props":1095,"children":1097},{"className":1096},[],[1098],{"type":48,"value":858},{"type":48,"value":1100}," alone doesn't constrain the account. The same pattern applies to role trust policies for IAM roles used by EventBridge rules and EventBridge Pipes (principal ",{"type":42,"tag":707,"props":1102,"children":1104},{"className":1103},[],[1105],{"type":48,"value":1031},{"type":48,"value":1015},{"type":42,"tag":707,"props":1108,"children":1110},{"className":1109},[],[1111],{"type":48,"value":1112},"pipes.amazonaws.com",{"type":48,"value":722},{"type":42,"tag":707,"props":1115,"children":1117},{"className":1116},[],[1118],{"type":48,"value":858},{"type":48,"value":1120}," = the rule or pipe ARN) — not just the DLQ case called out above. See the IAM User Guide on ",{"type":42,"tag":992,"props":1122,"children":1125},{"href":1123,"rel":1124},"https:\u002F\u002Fdocs.aws.amazon.com\u002FIAM\u002Flatest\u002FUserGuide\u002Fconfused-deputy.html",[996],[1126],{"type":48,"value":1127},"The confused deputy problem",{"type":48,"value":933},{"items":1130,"total":1301},[1131,1148,1163,1178,1193,1203,1218,1234,1251,1264,1276,1291],{"slug":1132,"name":1132,"fn":1133,"description":1134,"org":1135,"tags":1136,"stars":24,"repoUrl":25,"updatedAt":1147},"agents-build","add capabilities to existing agent projects","Use when adding capabilities to an existing agent project — memory, app integration, VPC, multi-agent, migration, model changes, browser, code interpreter, or resource removal. Triggers on: \"add memory\", \"remember across sessions\", \"call agent from app\", \"invoke agent from code\", \"auth to call agent\", \"streaming responses\", \"VPC\", \"VPC connectivity\", \"VPC error\", \"can't reach from VPC\", \"multi-agent\", \"A2A\", \"A2A auth\", \"orchestrator not delegating\", \"specialist not called\", \"migrate Bedrock Agent\", \"after import\", \"migration issue\", \"framework for migration\", \"change model\", \"browser tool\", \"code interpreter\", \"delete agent\", \"tear down\", \"agentcore remove\", \"cross-account memory\", \"resource-based policy on memory\", \"pay for x402 content\", \"402 Payment Required\", \"microtransactions\", \"paid API or tool\". Not for connecting to external APIs via Gateway — use agents-connect. Not for scaffolding a new project — use agents-get-started. Not for CLI\u002Fdev server errors — use agents-debug. Strands vs LangGraph in a migration context routes here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1137,1140,1143,1144],{"name":1138,"slug":1139,"type":15},"Agents","agents",{"name":1141,"slug":1142,"type":15},"Automation","automation",{"name":23,"slug":8,"type":15},{"name":1145,"slug":1146,"type":15},"Engineering","engineering","2026-07-12T08:42:53.812877",{"slug":1149,"name":1149,"fn":1150,"description":1151,"org":1152,"tags":1153,"stars":24,"repoUrl":25,"updatedAt":1162},"agents-connect","connect agents to external services","Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: \"connect to API\", \"add gateway\", \"connect to MCP server\", \"Lambda tools\", \"OpenAPI\", \"gateway target\", \"Cedar policy\", \"restrict tools\", \"policy engine\", \"gateway auth error\", \"store API key\", \"outbound credential\", \"env var API key\", \"API key None after deploy\", \"credential not available after deploy\", \"should this be a gateway target\", \"give my agent tools\", \"add tools to agent\". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1154,1155,1158,1161],{"name":1138,"slug":1139,"type":15},{"name":1156,"slug":1157,"type":15},"API Development","api-development",{"name":1159,"slug":1160,"type":15},"Authentication","authentication",{"name":23,"slug":8,"type":15},"2026-07-16T06:00:38.866147",{"slug":1164,"name":1164,"fn":1165,"description":1166,"org":1167,"tags":1168,"stars":24,"repoUrl":25,"updatedAt":1177},"agents-debug","debug agent and environment issues","Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: \"agent not working\", \"wrong answer\", \"agent error\", \"tool call failing\", \"debug agent\", \"check logs\", \"read traces\", \"broken\", \"500 error\", \"424 error\", \"model access denied\", \"command not found\", \"stuck in DELETING\", \"maxVms exceeded\", \"cold start diagnosis\", \"cold start slow\", \"agentcore create error\", \"create failed\", \"exit code 7\", \"connection refused local dev\". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1169,1170,1171,1174],{"name":1138,"slug":1139,"type":15},{"name":23,"slug":8,"type":15},{"name":1172,"slug":1173,"type":15},"Debugging","debugging",{"name":1175,"slug":1176,"type":15},"Observability","observability","2026-07-16T06:00:44.679093",{"slug":1179,"name":1179,"fn":1180,"description":1181,"org":1182,"tags":1183,"stars":24,"repoUrl":25,"updatedAt":1192},"agents-deploy","deploy AI agents to AWS","Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK\u002FIAM\u002Fquota error diagnosis, version management, rollback, and canary deployments. Triggers on: \"deploy my agent\", \"agentcore deploy\", \"deploy failed\", \"CDK error\", \"rollback\", \"canary deploy\", \"pin version\", \"redeploy\", \"deploy stuck\". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1184,1185,1186,1189],{"name":1138,"slug":1139,"type":15},{"name":23,"slug":8,"type":15},{"name":1187,"slug":1188,"type":15},"CI\u002FCD","ci-cd",{"name":1190,"slug":1191,"type":15},"Deployment","deployment","2026-07-12T08:42:55.059577",{"slug":1194,"name":1194,"fn":1195,"description":1196,"org":1197,"tags":1198,"stars":24,"repoUrl":25,"updatedAt":1202},"agents-get-started","scaffold and deploy new agent projects","Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: \"build an agent\", \"create an agent\", \"get started\", \"new project\", \"agentcore create\", \"which framework\", \"Strands vs LangGraph\", \"hello world agent\", \"first agent\", \"create MCP server\", \"host MCP server\", \"agentcore dev\", \"dev server\", \"what port\", \"local development\". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1199,1200,1201],{"name":1138,"slug":1139,"type":15},{"name":23,"slug":8,"type":15},{"name":1190,"slug":1191,"type":15},"2026-07-12T08:42:51.963247",{"slug":1204,"name":1204,"fn":1205,"description":1206,"org":1207,"tags":1208,"stars":24,"repoUrl":25,"updatedAt":1217},"agents-harden","harden agents for production","Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: \"production checklist\", \"harden agent\", \"production ready\", \"secure agent\", \"inbound auth\", \"going live\", \"cold start optimization\", \"session lifecycle\", \"StopRuntimeSession\", \"quota\", \"throttling\", \"maxVms\", \"rate limit\", \"security audit of outbound API calls\", \"gateway target audit for production\", \"restrict who can call\", \"lock down endpoint\", \"only our app can call\". Not for Cedar tool-restriction policies — use agents-connect. Not for quality measurement — use agents-optimize. Not for outbound credential storage or API key wiring — use agents-connect. Not for A2A agent-to-agent auth — use agents-build. Cold start observation and diagnosis (not optimization) routes to agents-debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1209,1210,1211,1214],{"name":1138,"slug":1139,"type":15},{"name":23,"slug":8,"type":15},{"name":1212,"slug":1213,"type":15},"Best Practices","best-practices",{"name":1215,"slug":1216,"type":15},"Security","security","2026-07-16T06:00:42.174705",{"slug":1219,"name":1219,"fn":1220,"description":1221,"org":1222,"tags":1223,"stars":24,"repoUrl":25,"updatedAt":1233},"agents-optimize","optimize agent quality and performance","Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI\u002FCD quality gates, observability, or cost optimization. Triggers on: \"evaluate my agent\", \"add evaluator\", \"measure quality\", \"quality gate\", \"run evals\", \"agent too slow\", \"why is it slow\", \"reduce latency\", \"set up observability\", \"CloudWatch dashboard\", \"how much does my agent cost\", \"cost optimization\", \"logs not showing up\", \"logs missing\", \"spans not found\", \"eval failing\", \"eval error\", \"dev traces\", \"local traces\", \"agentcore dev traces\", \"traces to CloudWatch\". Not for debugging errors or crashes — use agents-debug. Slow but correct routes here; broken routes to debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1224,1225,1226,1229,1230],{"name":1138,"slug":1139,"type":15},{"name":23,"slug":8,"type":15},{"name":1227,"slug":1228,"type":15},"Evals","evals",{"name":1175,"slug":1176,"type":15},{"name":1231,"slug":1232,"type":15},"Performance","performance","2026-07-12T08:42:56.488105",{"slug":1235,"name":1235,"fn":1236,"description":1237,"org":1238,"tags":1239,"stars":24,"repoUrl":25,"updatedAt":1250},"amazon-aurora-mysql","manage Amazon Aurora MySQL clusters","Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or MySQL upgrade planning. Aurora MySQL uses full (VPC-based) configuration — express configuration is PostgreSQL-only. For Aurora PostgreSQL, use amazon-aurora-postgresql instead. Contains safety guardrails and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1240,1241,1244,1247],{"name":23,"slug":8,"type":15},{"name":1242,"slug":1243,"type":15},"Database","database",{"name":1245,"slug":1246,"type":15},"MySQL","mysql",{"name":1248,"slug":1249,"type":15},"Serverless","serverless","2026-07-12T08:43:13.27939",{"slug":1252,"name":1252,"fn":1253,"description":1254,"org":1255,"tags":1256,"stars":24,"repoUrl":25,"updatedAt":1263},"amazon-aurora-postgresql","configure Amazon Aurora PostgreSQL clusters","Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or PostgreSQL upgrade planning. For Aurora MySQL, use amazon-aurora-mysql instead. Contains safety guardrails, express-first routing, and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1257,1258,1259,1262],{"name":23,"slug":8,"type":15},{"name":1242,"slug":1243,"type":15},{"name":1260,"slug":1261,"type":15},"PostgreSQL","postgresql",{"name":1248,"slug":1249,"type":15},"2026-07-16T06:00:34.789624",{"slug":1265,"name":1265,"fn":1266,"description":1267,"org":1268,"tags":1269,"stars":24,"repoUrl":25,"updatedAt":1275},"amazon-bedrock","build generative AI apps with Amazon Bedrock","Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore. Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, migrating\u002Fporting\u002Fconverting a Bedrock Agent (including inline agents) to an AgentCore Harness, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching setup and debugging, quota health checks and throttling diagnosis, cost attribution and tracking, migrating between Claude model generations (4.5 to 4.6 to 4.7), chunking strategies, API selection (Converse vs InvokeModel), guardrail capabilities, and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Connector, Instrument, Coinbase CDP, Stripe Privy, 402 Payment Required, pay for content, paid endpoint, agent payments). NOT for custom model training, Rekognition, or Comprehend.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1270,1271,1272],{"name":1138,"slug":1139,"type":15},{"name":23,"slug":8,"type":15},{"name":1273,"slug":1274,"type":15},"LLM","llm","2026-07-25T05:30:35.20899",{"slug":1277,"name":1277,"fn":1278,"description":1279,"org":1280,"tags":1281,"stars":24,"repoUrl":25,"updatedAt":1290},"amazon-documentdb","manage Amazon DocumentDB clusters","Manages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS\u002FVPC\u002Fdriver config, flexible-schema and vector-search data modeling, MongoDB compatibility assessment, DMS-based migration, slow-query diagnosis, major version upgrades (4.0→5.0→8.0), Well-Architected reviews (41-check wa_review.py), cost estimation, and security hardening. Retrieve for every DocumentDB question and when the user asks to set up or migrate MongoDB to AWS — DocumentDB is AWS's MongoDB-compatible managed database. Triggers: JSON document store, document database, MongoDB on AWS, Nested fields, Lambda cannot connect, TLS handshake, VPC port 27017, IAM auth, Secrets Manager, encryption at rest, $graphLookup, flexible schema, COLLSCAN, compound index, DMS migration, CDC cutover, $vectorSearch, RAG, Global Clusters, DR replication, cost sizing, audit, health check, production-readiness.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1282,1283,1284,1287],{"name":23,"slug":8,"type":15},{"name":1242,"slug":1243,"type":15},{"name":1285,"slug":1286,"type":15},"MongoDB","mongodb",{"name":1288,"slug":1289,"type":15},"NoSQL","nosql","2026-07-12T08:43:00.455878",{"slug":1292,"name":1292,"fn":1293,"description":1294,"org":1295,"tags":1296,"stars":24,"repoUrl":25,"updatedAt":1300},"amazon-dynamodb","design and debug DynamoDB data layers","Designs, reviews, and debugs DynamoDB data layers from design axioms — enumerates access patterns, chooses partition\u002Fsort keys and GSIs, decides single-table vs. multi-table, configures Streams, Global Tables, TTL, and zero-ETL integrations to OpenSearch\u002FRedshift\u002FSageMaker Lakehouse, and produces a defensible data-layer design with a monthly cost estimate and optional live validation. Applies whenever a user is designing, reviewing, or refactoring anything backed by DynamoDB — schemas, access patterns, GSIs, single- vs. multi-table choices, Streams consumers, transactional outboxes, Global Tables, zero-ETL pipelines — even when they don't say \"axioms\" or \"design review.\" Also applies when debugging hot partitions, throttling, unbounded Scans, LWW conflicts, or surprise bills on DynamoDB workloads.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1297,1298,1299],{"name":23,"slug":8,"type":15},{"name":1242,"slug":1243,"type":15},{"name":1288,"slug":1289,"type":15},"2026-07-16T06:00:37.690386",115,{"items":1303,"total":1353},[1304,1311,1318,1325,1332,1338,1345],{"slug":1132,"name":1132,"fn":1133,"description":1134,"org":1305,"tags":1306,"stars":24,"repoUrl":25,"updatedAt":1147},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1307,1308,1309,1310],{"name":1138,"slug":1139,"type":15},{"name":1141,"slug":1142,"type":15},{"name":23,"slug":8,"type":15},{"name":1145,"slug":1146,"type":15},{"slug":1149,"name":1149,"fn":1150,"description":1151,"org":1312,"tags":1313,"stars":24,"repoUrl":25,"updatedAt":1162},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1314,1315,1316,1317],{"name":1138,"slug":1139,"type":15},{"name":1156,"slug":1157,"type":15},{"name":1159,"slug":1160,"type":15},{"name":23,"slug":8,"type":15},{"slug":1164,"name":1164,"fn":1165,"description":1166,"org":1319,"tags":1320,"stars":24,"repoUrl":25,"updatedAt":1177},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1321,1322,1323,1324],{"name":1138,"slug":1139,"type":15},{"name":23,"slug":8,"type":15},{"name":1172,"slug":1173,"type":15},{"name":1175,"slug":1176,"type":15},{"slug":1179,"name":1179,"fn":1180,"description":1181,"org":1326,"tags":1327,"stars":24,"repoUrl":25,"updatedAt":1192},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1328,1329,1330,1331],{"name":1138,"slug":1139,"type":15},{"name":23,"slug":8,"type":15},{"name":1187,"slug":1188,"type":15},{"name":1190,"slug":1191,"type":15},{"slug":1194,"name":1194,"fn":1195,"description":1196,"org":1333,"tags":1334,"stars":24,"repoUrl":25,"updatedAt":1202},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1335,1336,1337],{"name":1138,"slug":1139,"type":15},{"name":23,"slug":8,"type":15},{"name":1190,"slug":1191,"type":15},{"slug":1204,"name":1204,"fn":1205,"description":1206,"org":1339,"tags":1340,"stars":24,"repoUrl":25,"updatedAt":1217},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1341,1342,1343,1344],{"name":1138,"slug":1139,"type":15},{"name":23,"slug":8,"type":15},{"name":1212,"slug":1213,"type":15},{"name":1215,"slug":1216,"type":15},{"slug":1219,"name":1219,"fn":1220,"description":1221,"org":1346,"tags":1347,"stars":24,"repoUrl":25,"updatedAt":1233},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1348,1349,1350,1351,1352],{"name":1138,"slug":1139,"type":15},{"name":23,"slug":8,"type":15},{"name":1227,"slug":1228,"type":15},{"name":1175,"slug":1176,"type":15},{"name":1231,"slug":1232,"type":15},114]