[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-processing-s3-uploads-with-step-functions":3,"mdc-6ez3hs-key":35,"related-repo-aws-processing-s3-uploads-with-step-functions":1312,"related-org-aws-processing-s3-uploads-with-step-functions":1416},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":30,"sourceUrl":33,"mdContent":34},"processing-s3-uploads-with-step-functions","process S3 uploads with Step Functions","Deploy an event-driven workflow that routes S3 uploads to either Lambda or Fargate via Step Functions based on file size. Uses EventBridge to trigger a Step Functions state machine when objects are uploaded to S3. Small files are processed by Lambda, large files by a Fargate task. Includes VPC, ECR repository, ECS cluster, and scoped IAM roles. Trigger keywords: Step Functions, Fargate, Lambda, S3 event, EventBridge, ECS, ECR, file processing, workflow orchestration, serverless.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"aws","AWS (Amazon)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Automation","automation","tag",{"name":17,"slug":18,"type":15},"Data Pipeline","data-pipeline",{"name":20,"slug":21,"type":15},"Cloud","cloud",{"name":23,"slug":8,"type":15},"AWS",1822,"https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws","2026-07-12T08:44:32.203144",null,157,[],{"repoUrl":25,"stars":24,"forks":28,"topics":31,"description":32},[],"Official, AWS-supported MCP servers, skills, and plugins to help AI agents build on AWS","https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws\u002Ftree\u002FHEAD\u002Fskills\u002Fspecialized-skills\u002Fserverless-skills\u002Fprocessing-s3-uploads-with-step-functions","---\nname: processing-s3-uploads-with-step-functions\ndescription: >\n  Deploy an event-driven workflow that routes S3 uploads to either Lambda or Fargate\n  via Step Functions based on file size. Uses EventBridge to trigger a Step Functions\n  state machine when objects are uploaded to S3. Small files are processed by Lambda,\n  large files by a Fargate task. Includes VPC, ECR repository, ECS cluster, and scoped\n  IAM roles. Trigger keywords: Step Functions, Fargate, Lambda, S3 event, EventBridge,\n  ECS, ECR, file processing, workflow orchestration, serverless.\nversion: 1\n---\n\n# Step Functions Workflow: Route S3 Uploads to Lambda or Fargate\n\n## Overview\n\nThis skill deploys an event-driven workflow using AWS CLI. When a file is uploaded to\nan S3 bucket, EventBridge triggers a Step Functions state machine. The state machine\nchecks the file size and routes processing to either a Lambda function (files ≤ 6 MB)\nor a Fargate task (files > 6 MB).\n\nThe architecture includes:\n\n- An S3 bucket with EventBridge notifications enabled\n- An EventBridge rule that triggers Step Functions on S3 object creation\n- A Step Functions state machine with a Choice state for routing\n- A Lambda function for processing small files\n- An ECS Fargate task for processing large files\n- A VPC with two subnets, internet gateway, and security group\n- An ECR repository for the Fargate container image\n- Scoped IAM roles for Lambda, Step Functions, and ECS tasks\n\nUse this skill when:\n\n- You need to process S3 uploads with different compute based on file size\n- You want a serverless workflow that can handle both small and large files\n- You need Step Functions orchestration with Lambda and Fargate\n\nDo not use this skill when:\n\n- All files are small enough for Lambda (use S3 → Lambda directly)\n- You need real-time streaming (use Kinesis)\n- You don't need file-size-based routing\n\n## Prerequisites\n\n1. **AWS CLI v2** — Installed and configured. Verify with `aws sts get-caller-identity`.\n2. **Python 3.12** — For the Lambda function runtime.\n3. **Docker** — For building and pushing the Fargate container image.\n\n## Parameters\n\n- bucket_name (required): Name for the S3 bucket (globally unique, lowercase, 3-63 characters)\n- region (required): AWS region for all resources\n- ecr_repo_name (required): Name for the ECR repository\n- state_machine_name (required): Name for the Step Functions state machine\n- kms_key_arn (optional): ARN of a KMS key for CloudWatch Logs encryption. If not provided, create one with `aws kms create-key --description \"Key for CloudWatch Logs encryption\" --region {region}`\n\nConstraints for parameter acquisition:\n\n- You MUST ask for all required parameters upfront in a single prompt\n- You MUST support multiple input methods (direct input, file path, URL)\n- You MUST confirm successful acquisition of all parameters before proceeding\n- You MUST validate that bucket_name follows S3 naming rules\n\n## Procedures\n\n### Step 0: Verify Dependencies\n\nConstraints:\n\n- You MUST verify the following tools are available: aws-cli, python3 (3.12+), docker\n- You MUST inform the user about any missing tools with a clear message\n- You MUST ask if the user wants to proceed despite missing tools\n- You MUST respect the customer's decision to abort at any point\n- You MUST explain to the customer what step is being executed, why, and which tool is being called\n\n### Step 1: Retrieve AWS Account ID\n\nConstraints:\n\n- You MUST retrieve the account ID with: `aws sts get-caller-identity --query 'Account' --output text`\n- You MUST store the result as {account_id} for use in all subsequent steps\n- You MUST abort if credentials are not configured\n\n### Step 2: Get the Default VPC and Networking\n\nConstraints:\n\n- You MUST retrieve the default VPC ID with:\n  `aws ec2 describe-vpcs --filters Name=isDefault,Values=true --query 'Vpcs[0].VpcId' --output text --region {region}`\n- If no default VPC exists, inform the user they must create one with `aws ec2 create-default-vpc --region {region}` or provide a VPC ID manually\n- You MUST retrieve two subnet IDs from the default VPC:\n  `aws ec2 describe-subnets --filters Name=vpc-id,Values={vpc_id} --query 'Subnets[0:2].SubnetId' --output text --region {region}`\n- You MUST create a security group in the default VPC:\n  `aws ec2 create-security-group --group-name fargate-sg --description \"Security group for Fargate tasks\" --vpc-id {vpc_id} --region {region}`\n- You MUST configure security group egress rules to allow only HTTPS and DNS outbound. First revoke the default allow-all egress rule:\n  `aws ec2 revoke-security-group-egress --group-id {sg_id} --ip-permissions IpProtocol=-1,IpRanges='[{CidrIp=0.0.0.0\u002F0}]' --region {region}`\n  Then add scoped rules:\n  `aws ec2 authorize-security-group-egress --group-id {sg_id} --protocol tcp --port 443 --cidr 0.0.0.0\u002F0 --region {region}` and\n  `aws ec2 authorize-security-group-egress --group-id {sg_id} --protocol udp --port 53 --cidr 0.0.0.0\u002F0 --region {region}`\n- You MUST recommend VPC endpoints for S3 and CloudWatch Logs for production workloads to avoid internet-routed traffic and eliminate the need for broad egress rules\n- You MUST capture {vpc_id}, {subnet1_id}, {subnet2_id}, and {sg_id} for use in later steps\n\n### Step 3: Create the ECR Repository\n\nConstraints:\n\n- You MUST create the repository with:\n  `aws ecr create-repository --repository-name {ecr_repo_name} --region {region}`\n- You MUST capture the repositoryUri from the response\n\n### Step 4: Build and Push the Container Image\n\nConstraints:\n\n- You MUST verify Docker is installed by running `docker --version`. If Docker is not installed, instruct the user to install it from https:\u002F\u002Fdocs.docker.com\u002Fget-docker\u002F and abort until it is available\n- You MUST authenticate Docker with ECR:\n  `aws ecr get-login-password --region {region} | docker login --username AWS --password-stdin {account_id}.dkr.ecr.{region}.amazonaws.com`\n- The Dockerfile and processor code are in `scripts\u002FDockerfile` and `scripts\u002Ffargate_processor.py`\n- You MUST build and push the image from the scripts directory:\n\n  ```\n  cd scripts\n  docker build --platform linux\u002Famd64 -t {ecr_repo_name} .\n  docker tag {ecr_repo_name}:latest {account_id}.dkr.ecr.{region}.amazonaws.com\u002F{ecr_repo_name}:latest\n  docker push {account_id}.dkr.ecr.{region}.amazonaws.com\u002F{ecr_repo_name}:latest\n  cd ..\n  ```\n\n### Step 5: Create IAM Roles\n\nFollow the detailed instructions in `references\u002Fiam-roles.md` to create all IAM roles (Lambda, ECS task execution, ECS task, Step Functions, and EventBridge roles).\n\n- You MUST wait at least 10 seconds for IAM role propagation\n\n### Step 6: Create the Lambda Function\n\nConstraints:\n\n- The function code is in `scripts\u002Flambda_function.py`\n- You MUST be in the skill root directory before packaging and creating the function\n- You MUST package it with: `python3 -c \"import zipfile,io; z=io.BytesIO(); f=zipfile.ZipFile(z,'w'); f.writestr('lambda_function.py', open('scripts\u002Flambda_function.py').read()); f.close(); open('\u002Ftmp\u002Flambda_function.zip','wb').write(z.getvalue())\"`\n- You MUST create the function with:\n\n  ```\n  aws lambda create-function \\\n      --function-name sfn-file-processor \\\n      --runtime python3.12 \\\n      --handler lambda_function.lambda_handler \\\n      --role arn:aws:iam::{account_id}:role\u002Fsfn-lambda-role \\\n      --zip-file fileb:\u002F\u002F\u002Ftmp\u002Flambda_function.zip \\\n      --timeout 60 \\\n      --architectures x86_64 \\\n      --region {region}\n  ```\n\n- You MUST verify the function was created with:\n  `aws lambda get-function --function-name sfn-file-processor --region {region}`\n\n### Step 7: Create the CloudWatch Log Group\n\nConstraints:\n\n- You MUST create the log group for Fargate:\n  `aws logs create-log-group --log-group-name \u002FStepFunctionFargateTask --region {region}`\n- You MUST encrypt the log group with a KMS key:\n  `aws logs associate-kms-key --log-group-name \u002FStepFunctionFargateTask --kms-key-arn {kms_key_arn} --region {region}`\n\n### Step 8: Create the ECS Cluster and Task Definition\n\nFollow the detailed instructions in `references\u002Fecs-task-definition.md` to create the ECS cluster and register the Fargate task definition.\n\n- You MUST capture the task definition ARN from the response\n\n### Step 9: Create the S3 Bucket with EventBridge Notifications\n\nConstraints:\n\n- You MUST create the bucket with:\n  `aws s3api create-bucket --bucket {bucket_name} --region {region} --create-bucket-configuration LocationConstraint={region}`\n- You MUST NOT include `--create-bucket-configuration` if region is us-east-1\n- You MUST enable EventBridge notifications on the bucket:\n  `aws s3api put-bucket-notification-configuration --bucket {bucket_name} --notification-configuration '{\"EventBridgeConfiguration\": {}}' --region {region}`\n- You MUST enable default encryption on the bucket:\n  `aws s3api put-bucket-encryption --bucket {bucket_name} --server-side-encryption-configuration '{\"Rules\":[{\"ApplyServerSideEncryptionByDefault\":{\"SSEAlgorithm\":\"aws:kms\"}}]}' --region {region}`\n\n### Step 10: Create the Step Functions State Machine\n\nConstraints:\n\n- The state machine definition is in `scripts\u002Fstatemachine.asl.json`\n- You MUST create a working copy and replace all placeholders:\n\n  ```\n  sed -e 's|${LambdaFunction}|arn:aws:lambda:{region}:{account_id}:function:sfn-file-processor|g' \\\n      -e 's|${Cluster}|arn:aws:ecs:{region}:{account_id}:cluster\u002Fsfn-cluster|g' \\\n      -e 's|${TaskDefinition}|{task_definition_arn}|g' \\\n      -e 's|${Subnet1}|{subnet1_id}|g' \\\n      -e 's|${Subnet2}|{subnet2_id}|g' \\\n      -e 's|${SecurityGroup}|{sg_id}|g' \\\n      scripts\u002Fstatemachine.asl.json > \u002Ftmp\u002Fstatemachine.asl.json\n  ```\n\n- You MUST create the state machine with:\n\n  ```\n  aws stepfunctions create-state-machine \\\n      --name {state_machine_name} \\\n      --definition file:\u002F\u002F\u002Ftmp\u002Fstatemachine.asl.json \\\n      --role-arn arn:aws:iam::{account_id}:role\u002Fsfn-state-machine-role \\\n      --type STANDARD \\\n      --region {region}\n  ```\n\n- You MUST capture the stateMachineArn from the response\n\n### Step 11: Create the EventBridge Rule\n\nConstraints:\n\n- You MUST create the EventBridge rule to trigger on S3 object creation:\n\n  ```\n  aws events put-rule \\\n      --name s3-to-stepfunctions \\\n      --event-pattern '{\n        \"source\": [\"aws.s3\"],\n        \"detail-type\": [\"Object Created\"],\n        \"detail\": {\n          \"bucket\": {\n            \"name\": [\"{bucket_name}\"]\n          }\n        }\n      }' \\\n      --region {region}\n  ```\n\n- You MUST add the state machine as a target:\n\n  ```\n  aws events put-targets \\\n      --rule s3-to-stepfunctions \\\n      --targets '[{\n        \"Id\": \"StepFunctionsTarget\",\n        \"Arn\": \"{state_machine_arn}\",\n        \"RoleArn\": \"arn:aws:iam::{account_id}:role\u002Fsfn-eventbridge-role\"\n      }]' \\\n      --region {region}\n  ```\n\n### Step 12: Configure Monitoring\n\nConstraints:\n\n- You MUST create a Dead Letter Queue for failed EventBridge invocations:\n  `aws sqs create-queue --queue-name s3-to-stepfunctions-dlq --region {region}`\n- You MUST update the EventBridge target to attach the DLQ:\n\n  ```\n  aws events put-targets \\\n      --rule s3-to-stepfunctions \\\n      --targets '[{\n        \"Id\": \"StepFunctionsTarget\",\n        \"Arn\": \"{state_machine_arn}\",\n        \"RoleArn\": \"arn:aws:iam::{account_id}:role\u002Fsfn-eventbridge-role\",\n        \"DeadLetterConfig\": {\n          \"Arn\": \"arn:aws:sqs:{region}:{account_id}:s3-to-stepfunctions-dlq\"\n        }\n      }]' \\\n      --region {region}\n  ```\n\n- You MUST create a CloudWatch alarm for Step Functions execution failures:\n  `aws cloudwatch put-metric-alarm --alarm-name sfn-execution-failures --metric-name ExecutionsFailed --namespace AWS\u002FStates --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --dimensions Name=StateMachineArn,Value={state_machine_arn} --region {region}`\n\n### Step 13: Validate\n\nConstraints:\n\n- You MUST test with a small file (\u003C 6 MB) to verify Lambda processing:\n\n  ```\n  echo 'test data' > \u002Ftmp\u002Fsmall-file.txt\n  aws s3 cp \u002Ftmp\u002Fsmall-file.txt s3:\u002F\u002F{bucket_name}\u002Fsmall-file.txt --region {region}\n  ```\n\n- You MUST wait 15 seconds then check the Step Functions execution:\n  `aws stepfunctions list-executions --state-machine-arn {state_machine_arn} --region {region}`\n- You MUST verify the execution succeeded and routed to Lambda\n- You MUST provide a summary of all created resources including: VPC ID, subnet IDs, security group ID, ECR repo URI, ECS cluster ARN, task definition ARN, Lambda function ARN, state machine ARN, bucket name, and EventBridge rule name\n\n## Troubleshooting\n\n### EventBridge rule not triggering\n\n- Verify EventBridge notifications are enabled on the bucket: `aws s3api get-bucket-notification-configuration --bucket {bucket_name}`\n- Verify the rule exists: `aws events describe-rule --name s3-to-stepfunctions --region {region}`\n- Check that the target has the correct state machine ARN and role\n\n### Step Functions execution fails at Fargate task\n\n- Verify the container image exists in ECR: `aws ecr describe-images --repository-name {ecr_repo_name} --region {region}`\n- Check that the subnets have internet access (route table with IGW)\n- Verify the security group allows outbound traffic\n- Check CloudWatch Logs at `\u002FStepFunctionFargateTask`\n\n### Lambda invocation fails\n\n- Check CloudWatch Logs: `aws logs tail \u002Faws\u002Flambda\u002Fsfn-file-processor --region {region}`\n- Verify the Step Functions role has `lambda:InvokeFunction` permission\n\n### IAM PassRole errors\n\n- The Step Functions role must have `iam:PassRole` for both the ECS execution role and task role ARNs\n\n### Fargate task stuck in PROVISIONING\n\n- Verify the subnets have auto-assign public IP enabled\n- Verify the internet gateway is attached and route table has 0.0.0.0\u002F0 route\n\n## Security Considerations\n\n- Fargate tasks with public IPs are exposed to the internet. Revoke the default allow-all egress rule and configure scoped egress: `aws ec2 revoke-security-group-egress --group-id {sg_id} --ip-permissions IpProtocol=-1,IpRanges='[{CidrIp=0.0.0.0\u002F0}]'` then add `aws ec2 authorize-security-group-egress --group-id {sg_id} --protocol tcp --port 443 --cidr 0.0.0.0\u002F0` and `aws ec2 authorize-security-group-egress --group-id {sg_id} --protocol udp --port 53 --cidr 0.0.0.0\u002F0`. For production, consider using VPC endpoints for S3 and CloudWatch Logs instead of internet-routed traffic.\n- Scan container images for vulnerabilities before pushing to ECR. Enable ECR image scanning with: `aws ecr put-image-scanning-configuration --repository-name {ecr_repo_name} --image-scanning-configuration scanOnPush=true --region {region}`\n- Use IAM roles for credentials — never hardcode access keys in container code.\n- Enable encryption at rest for the S3 bucket: `aws s3api put-bucket-encryption --bucket {bucket_name} --server-side-encryption-configuration '{\"Rules\":[{\"ApplyServerSideEncryptionByDefault\":{\"SSEAlgorithm\":\"aws:kms\"}}]}'`\n- Enable CloudWatch Logs encryption for Fargate container logs: `aws logs associate-kms-key --log-group-name \u002FStepFunctionFargateTask --kms-key-arn \u003CKMS_KEY_ARN>`\n- Configure a Dead Letter Queue on the EventBridge rule for failed invocations\n- Set up CloudWatch alarms on Step Functions execution failures for operational visibility\n\n## Version information\n\n- **AWS CLI**: 2.x\n- **Python runtime**: 3.12\n- **Last validated**: 2026-04-27\n\n## Additional Resources\n\n- [Step Functions developer guide](https:\u002F\u002Fdocs.aws.amazon.com\u002Fstep-functions\u002Flatest\u002Fdg\u002Fwelcome.html)\n- [EventBridge S3 events](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonS3\u002Flatest\u002Fuserguide\u002FEventBridge.html)\n- [Fargate task definitions](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002Fdeveloperguide\u002Ftask_definitions.html)\n- [ECR pushing images](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECR\u002Flatest\u002Fuserguide\u002Fdocker-push-ecr-image.html)\n- [Step Functions Fargate integration](https:\u002F\u002Fdocs.aws.amazon.com\u002Fstep-functions\u002Flatest\u002Fdg\u002Fconnect-ecs.html)\n",{"data":36,"body":38},{"name":4,"description":6,"version":37},1,{"type":39,"children":40},"root",[41,50,57,63,68,113,118,136,141,159,165,209,215,249,254,277,283,290,295,323,329,333,357,363,367,453,459,463,482,488,492,565,571,584,592,598,602,657,663,667,692,698,710,718,724,728,777,783,787,834,840,844,875,881,885,924,930,934,972,978,984,1014,1020,1055,1061,1088,1094,1110,1116,1129,1135,1214,1220,1253,1259],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"step-functions-workflow-route-s3-uploads-to-lambda-or-fargate",[47],{"type":48,"value":49},"text","Step Functions Workflow: Route S3 Uploads to Lambda or Fargate",{"type":42,"tag":51,"props":52,"children":54},"h2",{"id":53},"overview",[55],{"type":48,"value":56},"Overview",{"type":42,"tag":58,"props":59,"children":60},"p",{},[61],{"type":48,"value":62},"This skill deploys an event-driven workflow using AWS CLI. When a file is uploaded to\nan S3 bucket, EventBridge triggers a Step Functions state machine. The state machine\nchecks the file size and routes processing to either a Lambda function (files ≤ 6 MB)\nor a Fargate task (files > 6 MB).",{"type":42,"tag":58,"props":64,"children":65},{},[66],{"type":48,"value":67},"The architecture includes:",{"type":42,"tag":69,"props":70,"children":71},"ul",{},[72,78,83,88,93,98,103,108],{"type":42,"tag":73,"props":74,"children":75},"li",{},[76],{"type":48,"value":77},"An S3 bucket with EventBridge notifications enabled",{"type":42,"tag":73,"props":79,"children":80},{},[81],{"type":48,"value":82},"An EventBridge rule that triggers Step Functions on S3 object creation",{"type":42,"tag":73,"props":84,"children":85},{},[86],{"type":48,"value":87},"A Step Functions state machine with a Choice state for routing",{"type":42,"tag":73,"props":89,"children":90},{},[91],{"type":48,"value":92},"A Lambda function for processing small files",{"type":42,"tag":73,"props":94,"children":95},{},[96],{"type":48,"value":97},"An ECS Fargate task for processing large files",{"type":42,"tag":73,"props":99,"children":100},{},[101],{"type":48,"value":102},"A VPC with two subnets, internet gateway, and security group",{"type":42,"tag":73,"props":104,"children":105},{},[106],{"type":48,"value":107},"An ECR repository for the Fargate container image",{"type":42,"tag":73,"props":109,"children":110},{},[111],{"type":48,"value":112},"Scoped IAM roles for Lambda, Step Functions, and ECS tasks",{"type":42,"tag":58,"props":114,"children":115},{},[116],{"type":48,"value":117},"Use this skill when:",{"type":42,"tag":69,"props":119,"children":120},{},[121,126,131],{"type":42,"tag":73,"props":122,"children":123},{},[124],{"type":48,"value":125},"You need to process S3 uploads with different compute based on file size",{"type":42,"tag":73,"props":127,"children":128},{},[129],{"type":48,"value":130},"You want a serverless workflow that can handle both small and large files",{"type":42,"tag":73,"props":132,"children":133},{},[134],{"type":48,"value":135},"You need Step Functions orchestration with Lambda and Fargate",{"type":42,"tag":58,"props":137,"children":138},{},[139],{"type":48,"value":140},"Do not use this skill when:",{"type":42,"tag":69,"props":142,"children":143},{},[144,149,154],{"type":42,"tag":73,"props":145,"children":146},{},[147],{"type":48,"value":148},"All files are small enough for Lambda (use S3 → Lambda directly)",{"type":42,"tag":73,"props":150,"children":151},{},[152],{"type":48,"value":153},"You need real-time streaming (use Kinesis)",{"type":42,"tag":73,"props":155,"children":156},{},[157],{"type":48,"value":158},"You don't need file-size-based routing",{"type":42,"tag":51,"props":160,"children":162},{"id":161},"prerequisites",[163],{"type":48,"value":164},"Prerequisites",{"type":42,"tag":166,"props":167,"children":168},"ol",{},[169,189,199],{"type":42,"tag":73,"props":170,"children":171},{},[172,178,180,187],{"type":42,"tag":173,"props":174,"children":175},"strong",{},[176],{"type":48,"value":177},"AWS CLI v2",{"type":48,"value":179}," — Installed and configured. Verify with ",{"type":42,"tag":181,"props":182,"children":184},"code",{"className":183},[],[185],{"type":48,"value":186},"aws sts get-caller-identity",{"type":48,"value":188},".",{"type":42,"tag":73,"props":190,"children":191},{},[192,197],{"type":42,"tag":173,"props":193,"children":194},{},[195],{"type":48,"value":196},"Python 3.12",{"type":48,"value":198}," — For the Lambda function runtime.",{"type":42,"tag":73,"props":200,"children":201},{},[202,207],{"type":42,"tag":173,"props":203,"children":204},{},[205],{"type":48,"value":206},"Docker",{"type":48,"value":208}," — For building and pushing the Fargate container image.",{"type":42,"tag":51,"props":210,"children":212},{"id":211},"parameters",[213],{"type":48,"value":214},"Parameters",{"type":42,"tag":69,"props":216,"children":217},{},[218,223,228,233,238],{"type":42,"tag":73,"props":219,"children":220},{},[221],{"type":48,"value":222},"bucket_name (required): Name for the S3 bucket (globally unique, lowercase, 3-63 characters)",{"type":42,"tag":73,"props":224,"children":225},{},[226],{"type":48,"value":227},"region (required): AWS region for all resources",{"type":42,"tag":73,"props":229,"children":230},{},[231],{"type":48,"value":232},"ecr_repo_name (required): Name for the ECR repository",{"type":42,"tag":73,"props":234,"children":235},{},[236],{"type":48,"value":237},"state_machine_name (required): Name for the Step Functions state machine",{"type":42,"tag":73,"props":239,"children":240},{},[241,243],{"type":48,"value":242},"kms_key_arn (optional): ARN of a KMS key for CloudWatch Logs encryption. If not provided, create one with ",{"type":42,"tag":181,"props":244,"children":246},{"className":245},[],[247],{"type":48,"value":248},"aws kms create-key --description \"Key for CloudWatch Logs encryption\" --region {region}",{"type":42,"tag":58,"props":250,"children":251},{},[252],{"type":48,"value":253},"Constraints for parameter acquisition:",{"type":42,"tag":69,"props":255,"children":256},{},[257,262,267,272],{"type":42,"tag":73,"props":258,"children":259},{},[260],{"type":48,"value":261},"You MUST ask for all required parameters upfront in a single prompt",{"type":42,"tag":73,"props":263,"children":264},{},[265],{"type":48,"value":266},"You MUST support multiple input methods (direct input, file path, URL)",{"type":42,"tag":73,"props":268,"children":269},{},[270],{"type":48,"value":271},"You MUST confirm successful acquisition of all parameters before proceeding",{"type":42,"tag":73,"props":273,"children":274},{},[275],{"type":48,"value":276},"You MUST validate that bucket_name follows S3 naming rules",{"type":42,"tag":51,"props":278,"children":280},{"id":279},"procedures",[281],{"type":48,"value":282},"Procedures",{"type":42,"tag":284,"props":285,"children":287},"h3",{"id":286},"step-0-verify-dependencies",[288],{"type":48,"value":289},"Step 0: Verify Dependencies",{"type":42,"tag":58,"props":291,"children":292},{},[293],{"type":48,"value":294},"Constraints:",{"type":42,"tag":69,"props":296,"children":297},{},[298,303,308,313,318],{"type":42,"tag":73,"props":299,"children":300},{},[301],{"type":48,"value":302},"You MUST verify the following tools are available: aws-cli, python3 (3.12+), docker",{"type":42,"tag":73,"props":304,"children":305},{},[306],{"type":48,"value":307},"You MUST inform the user about any missing tools with a clear message",{"type":42,"tag":73,"props":309,"children":310},{},[311],{"type":48,"value":312},"You MUST ask if the user wants to proceed despite missing tools",{"type":42,"tag":73,"props":314,"children":315},{},[316],{"type":48,"value":317},"You MUST respect the customer's decision to abort at any point",{"type":42,"tag":73,"props":319,"children":320},{},[321],{"type":48,"value":322},"You MUST explain to the customer what step is being executed, why, and which tool is being called",{"type":42,"tag":284,"props":324,"children":326},{"id":325},"step-1-retrieve-aws-account-id",[327],{"type":48,"value":328},"Step 1: Retrieve AWS Account ID",{"type":42,"tag":58,"props":330,"children":331},{},[332],{"type":48,"value":294},{"type":42,"tag":69,"props":334,"children":335},{},[336,347,352],{"type":42,"tag":73,"props":337,"children":338},{},[339,341],{"type":48,"value":340},"You MUST retrieve the account ID with: ",{"type":42,"tag":181,"props":342,"children":344},{"className":343},[],[345],{"type":48,"value":346},"aws sts get-caller-identity --query 'Account' --output text",{"type":42,"tag":73,"props":348,"children":349},{},[350],{"type":48,"value":351},"You MUST store the result as {account_id} for use in all subsequent steps",{"type":42,"tag":73,"props":353,"children":354},{},[355],{"type":48,"value":356},"You MUST abort if credentials are not configured",{"type":42,"tag":284,"props":358,"children":360},{"id":359},"step-2-get-the-default-vpc-and-networking",[361],{"type":48,"value":362},"Step 2: Get the Default VPC and Networking",{"type":42,"tag":58,"props":364,"children":365},{},[366],{"type":48,"value":294},{"type":42,"tag":69,"props":368,"children":369},{},[370,381,394,405,416,443,448],{"type":42,"tag":73,"props":371,"children":372},{},[373,375],{"type":48,"value":374},"You MUST retrieve the default VPC ID with:\n",{"type":42,"tag":181,"props":376,"children":378},{"className":377},[],[379],{"type":48,"value":380},"aws ec2 describe-vpcs --filters Name=isDefault,Values=true --query 'Vpcs[0].VpcId' --output text --region {region}",{"type":42,"tag":73,"props":382,"children":383},{},[384,386,392],{"type":48,"value":385},"If no default VPC exists, inform the user they must create one with ",{"type":42,"tag":181,"props":387,"children":389},{"className":388},[],[390],{"type":48,"value":391},"aws ec2 create-default-vpc --region {region}",{"type":48,"value":393}," or provide a VPC ID manually",{"type":42,"tag":73,"props":395,"children":396},{},[397,399],{"type":48,"value":398},"You MUST retrieve two subnet IDs from the default VPC:\n",{"type":42,"tag":181,"props":400,"children":402},{"className":401},[],[403],{"type":48,"value":404},"aws ec2 describe-subnets --filters Name=vpc-id,Values={vpc_id} --query 'Subnets[0:2].SubnetId' --output text --region {region}",{"type":42,"tag":73,"props":406,"children":407},{},[408,410],{"type":48,"value":409},"You MUST create a security group in the default VPC:\n",{"type":42,"tag":181,"props":411,"children":413},{"className":412},[],[414],{"type":48,"value":415},"aws ec2 create-security-group --group-name fargate-sg --description \"Security group for Fargate tasks\" --vpc-id {vpc_id} --region {region}",{"type":42,"tag":73,"props":417,"children":418},{},[419,421,427,429,435,437],{"type":48,"value":420},"You MUST configure security group egress rules to allow only HTTPS and DNS outbound. First revoke the default allow-all egress rule:\n",{"type":42,"tag":181,"props":422,"children":424},{"className":423},[],[425],{"type":48,"value":426},"aws ec2 revoke-security-group-egress --group-id {sg_id} --ip-permissions IpProtocol=-1,IpRanges='[{CidrIp=0.0.0.0\u002F0}]' --region {region}",{"type":48,"value":428},"\nThen add scoped rules:\n",{"type":42,"tag":181,"props":430,"children":432},{"className":431},[],[433],{"type":48,"value":434},"aws ec2 authorize-security-group-egress --group-id {sg_id} --protocol tcp --port 443 --cidr 0.0.0.0\u002F0 --region {region}",{"type":48,"value":436}," and\n",{"type":42,"tag":181,"props":438,"children":440},{"className":439},[],[441],{"type":48,"value":442},"aws ec2 authorize-security-group-egress --group-id {sg_id} --protocol udp --port 53 --cidr 0.0.0.0\u002F0 --region {region}",{"type":42,"tag":73,"props":444,"children":445},{},[446],{"type":48,"value":447},"You MUST recommend VPC endpoints for S3 and CloudWatch Logs for production workloads to avoid internet-routed traffic and eliminate the need for broad egress rules",{"type":42,"tag":73,"props":449,"children":450},{},[451],{"type":48,"value":452},"You MUST capture {vpc_id}, {subnet1_id}, {subnet2_id}, and {sg_id} for use in later steps",{"type":42,"tag":284,"props":454,"children":456},{"id":455},"step-3-create-the-ecr-repository",[457],{"type":48,"value":458},"Step 3: Create the ECR Repository",{"type":42,"tag":58,"props":460,"children":461},{},[462],{"type":48,"value":294},{"type":42,"tag":69,"props":464,"children":465},{},[466,477],{"type":42,"tag":73,"props":467,"children":468},{},[469,471],{"type":48,"value":470},"You MUST create the repository with:\n",{"type":42,"tag":181,"props":472,"children":474},{"className":473},[],[475],{"type":48,"value":476},"aws ecr create-repository --repository-name {ecr_repo_name} --region {region}",{"type":42,"tag":73,"props":478,"children":479},{},[480],{"type":48,"value":481},"You MUST capture the repositoryUri from the response",{"type":42,"tag":284,"props":483,"children":485},{"id":484},"step-4-build-and-push-the-container-image",[486],{"type":48,"value":487},"Step 4: Build and Push the Container Image",{"type":42,"tag":58,"props":489,"children":490},{},[491],{"type":48,"value":294},{"type":42,"tag":69,"props":493,"children":494},{},[495,518,529,548],{"type":42,"tag":73,"props":496,"children":497},{},[498,500,506,508,516],{"type":48,"value":499},"You MUST verify Docker is installed by running ",{"type":42,"tag":181,"props":501,"children":503},{"className":502},[],[504],{"type":48,"value":505},"docker --version",{"type":48,"value":507},". If Docker is not installed, instruct the user to install it from ",{"type":42,"tag":509,"props":510,"children":514},"a",{"href":511,"rel":512},"https:\u002F\u002Fdocs.docker.com\u002Fget-docker\u002F",[513],"nofollow",[515],{"type":48,"value":511},{"type":48,"value":517}," and abort until it is available",{"type":42,"tag":73,"props":519,"children":520},{},[521,523],{"type":48,"value":522},"You MUST authenticate Docker with ECR:\n",{"type":42,"tag":181,"props":524,"children":526},{"className":525},[],[527],{"type":48,"value":528},"aws ecr get-login-password --region {region} | docker login --username AWS --password-stdin {account_id}.dkr.ecr.{region}.amazonaws.com",{"type":42,"tag":73,"props":530,"children":531},{},[532,534,540,542],{"type":48,"value":533},"The Dockerfile and processor code are in ",{"type":42,"tag":181,"props":535,"children":537},{"className":536},[],[538],{"type":48,"value":539},"scripts\u002FDockerfile",{"type":48,"value":541}," and ",{"type":42,"tag":181,"props":543,"children":545},{"className":544},[],[546],{"type":48,"value":547},"scripts\u002Ffargate_processor.py",{"type":42,"tag":73,"props":549,"children":550},{},[551,553],{"type":48,"value":552},"You MUST build and push the image from the scripts directory:",{"type":42,"tag":554,"props":555,"children":559},"pre",{"className":556,"code":558,"language":48},[557],"language-text","cd scripts\ndocker build --platform linux\u002Famd64 -t {ecr_repo_name} .\ndocker tag {ecr_repo_name}:latest {account_id}.dkr.ecr.{region}.amazonaws.com\u002F{ecr_repo_name}:latest\ndocker push {account_id}.dkr.ecr.{region}.amazonaws.com\u002F{ecr_repo_name}:latest\ncd ..\n",[560],{"type":42,"tag":181,"props":561,"children":563},{"__ignoreMap":562},"",[564],{"type":48,"value":558},{"type":42,"tag":284,"props":566,"children":568},{"id":567},"step-5-create-iam-roles",[569],{"type":48,"value":570},"Step 5: Create IAM Roles",{"type":42,"tag":58,"props":572,"children":573},{},[574,576,582],{"type":48,"value":575},"Follow the detailed instructions in ",{"type":42,"tag":181,"props":577,"children":579},{"className":578},[],[580],{"type":48,"value":581},"references\u002Fiam-roles.md",{"type":48,"value":583}," to create all IAM roles (Lambda, ECS task execution, ECS task, Step Functions, and EventBridge roles).",{"type":42,"tag":69,"props":585,"children":586},{},[587],{"type":42,"tag":73,"props":588,"children":589},{},[590],{"type":48,"value":591},"You MUST wait at least 10 seconds for IAM role propagation",{"type":42,"tag":284,"props":593,"children":595},{"id":594},"step-6-create-the-lambda-function",[596],{"type":48,"value":597},"Step 6: Create the Lambda Function",{"type":42,"tag":58,"props":599,"children":600},{},[601],{"type":48,"value":294},{"type":42,"tag":69,"props":603,"children":604},{},[605,616,621,632,646],{"type":42,"tag":73,"props":606,"children":607},{},[608,610],{"type":48,"value":609},"The function code is in ",{"type":42,"tag":181,"props":611,"children":613},{"className":612},[],[614],{"type":48,"value":615},"scripts\u002Flambda_function.py",{"type":42,"tag":73,"props":617,"children":618},{},[619],{"type":48,"value":620},"You MUST be in the skill root directory before packaging and creating the function",{"type":42,"tag":73,"props":622,"children":623},{},[624,626],{"type":48,"value":625},"You MUST package it with: ",{"type":42,"tag":181,"props":627,"children":629},{"className":628},[],[630],{"type":48,"value":631},"python3 -c \"import zipfile,io; z=io.BytesIO(); f=zipfile.ZipFile(z,'w'); f.writestr('lambda_function.py', open('scripts\u002Flambda_function.py').read()); f.close(); open('\u002Ftmp\u002Flambda_function.zip','wb').write(z.getvalue())\"",{"type":42,"tag":73,"props":633,"children":634},{},[635,637],{"type":48,"value":636},"You MUST create the function with:",{"type":42,"tag":554,"props":638,"children":641},{"className":639,"code":640,"language":48},[557],"aws lambda create-function \\\n    --function-name sfn-file-processor \\\n    --runtime python3.12 \\\n    --handler lambda_function.lambda_handler \\\n    --role arn:aws:iam::{account_id}:role\u002Fsfn-lambda-role \\\n    --zip-file fileb:\u002F\u002F\u002Ftmp\u002Flambda_function.zip \\\n    --timeout 60 \\\n    --architectures x86_64 \\\n    --region {region}\n",[642],{"type":42,"tag":181,"props":643,"children":644},{"__ignoreMap":562},[645],{"type":48,"value":640},{"type":42,"tag":73,"props":647,"children":648},{},[649,651],{"type":48,"value":650},"You MUST verify the function was created with:\n",{"type":42,"tag":181,"props":652,"children":654},{"className":653},[],[655],{"type":48,"value":656},"aws lambda get-function --function-name sfn-file-processor --region {region}",{"type":42,"tag":284,"props":658,"children":660},{"id":659},"step-7-create-the-cloudwatch-log-group",[661],{"type":48,"value":662},"Step 7: Create the CloudWatch Log Group",{"type":42,"tag":58,"props":664,"children":665},{},[666],{"type":48,"value":294},{"type":42,"tag":69,"props":668,"children":669},{},[670,681],{"type":42,"tag":73,"props":671,"children":672},{},[673,675],{"type":48,"value":674},"You MUST create the log group for Fargate:\n",{"type":42,"tag":181,"props":676,"children":678},{"className":677},[],[679],{"type":48,"value":680},"aws logs create-log-group --log-group-name \u002FStepFunctionFargateTask --region {region}",{"type":42,"tag":73,"props":682,"children":683},{},[684,686],{"type":48,"value":685},"You MUST encrypt the log group with a KMS key:\n",{"type":42,"tag":181,"props":687,"children":689},{"className":688},[],[690],{"type":48,"value":691},"aws logs associate-kms-key --log-group-name \u002FStepFunctionFargateTask --kms-key-arn {kms_key_arn} --region {region}",{"type":42,"tag":284,"props":693,"children":695},{"id":694},"step-8-create-the-ecs-cluster-and-task-definition",[696],{"type":48,"value":697},"Step 8: Create the ECS Cluster and Task Definition",{"type":42,"tag":58,"props":699,"children":700},{},[701,702,708],{"type":48,"value":575},{"type":42,"tag":181,"props":703,"children":705},{"className":704},[],[706],{"type":48,"value":707},"references\u002Fecs-task-definition.md",{"type":48,"value":709}," to create the ECS cluster and register the Fargate task definition.",{"type":42,"tag":69,"props":711,"children":712},{},[713],{"type":42,"tag":73,"props":714,"children":715},{},[716],{"type":48,"value":717},"You MUST capture the task definition ARN from the response",{"type":42,"tag":284,"props":719,"children":721},{"id":720},"step-9-create-the-s3-bucket-with-eventbridge-notifications",[722],{"type":48,"value":723},"Step 9: Create the S3 Bucket with EventBridge Notifications",{"type":42,"tag":58,"props":725,"children":726},{},[727],{"type":48,"value":294},{"type":42,"tag":69,"props":729,"children":730},{},[731,742,755,766],{"type":42,"tag":73,"props":732,"children":733},{},[734,736],{"type":48,"value":735},"You MUST create the bucket with:\n",{"type":42,"tag":181,"props":737,"children":739},{"className":738},[],[740],{"type":48,"value":741},"aws s3api create-bucket --bucket {bucket_name} --region {region} --create-bucket-configuration LocationConstraint={region}",{"type":42,"tag":73,"props":743,"children":744},{},[745,747,753],{"type":48,"value":746},"You MUST NOT include ",{"type":42,"tag":181,"props":748,"children":750},{"className":749},[],[751],{"type":48,"value":752},"--create-bucket-configuration",{"type":48,"value":754}," if region is us-east-1",{"type":42,"tag":73,"props":756,"children":757},{},[758,760],{"type":48,"value":759},"You MUST enable EventBridge notifications on the bucket:\n",{"type":42,"tag":181,"props":761,"children":763},{"className":762},[],[764],{"type":48,"value":765},"aws s3api put-bucket-notification-configuration --bucket {bucket_name} --notification-configuration '{\"EventBridgeConfiguration\": {}}' --region {region}",{"type":42,"tag":73,"props":767,"children":768},{},[769,771],{"type":48,"value":770},"You MUST enable default encryption on the bucket:\n",{"type":42,"tag":181,"props":772,"children":774},{"className":773},[],[775],{"type":48,"value":776},"aws s3api put-bucket-encryption --bucket {bucket_name} --server-side-encryption-configuration '{\"Rules\":[{\"ApplyServerSideEncryptionByDefault\":{\"SSEAlgorithm\":\"aws:kms\"}}]}' --region {region}",{"type":42,"tag":284,"props":778,"children":780},{"id":779},"step-10-create-the-step-functions-state-machine",[781],{"type":48,"value":782},"Step 10: Create the Step Functions State Machine",{"type":42,"tag":58,"props":784,"children":785},{},[786],{"type":48,"value":294},{"type":42,"tag":69,"props":788,"children":789},{},[790,801,815,829],{"type":42,"tag":73,"props":791,"children":792},{},[793,795],{"type":48,"value":794},"The state machine definition is in ",{"type":42,"tag":181,"props":796,"children":798},{"className":797},[],[799],{"type":48,"value":800},"scripts\u002Fstatemachine.asl.json",{"type":42,"tag":73,"props":802,"children":803},{},[804,806],{"type":48,"value":805},"You MUST create a working copy and replace all placeholders:",{"type":42,"tag":554,"props":807,"children":810},{"className":808,"code":809,"language":48},[557],"sed -e 's|${LambdaFunction}|arn:aws:lambda:{region}:{account_id}:function:sfn-file-processor|g' \\\n    -e 's|${Cluster}|arn:aws:ecs:{region}:{account_id}:cluster\u002Fsfn-cluster|g' \\\n    -e 's|${TaskDefinition}|{task_definition_arn}|g' \\\n    -e 's|${Subnet1}|{subnet1_id}|g' \\\n    -e 's|${Subnet2}|{subnet2_id}|g' \\\n    -e 's|${SecurityGroup}|{sg_id}|g' \\\n    scripts\u002Fstatemachine.asl.json > \u002Ftmp\u002Fstatemachine.asl.json\n",[811],{"type":42,"tag":181,"props":812,"children":813},{"__ignoreMap":562},[814],{"type":48,"value":809},{"type":42,"tag":73,"props":816,"children":817},{},[818,820],{"type":48,"value":819},"You MUST create the state machine with:",{"type":42,"tag":554,"props":821,"children":824},{"className":822,"code":823,"language":48},[557],"aws stepfunctions create-state-machine \\\n    --name {state_machine_name} \\\n    --definition file:\u002F\u002F\u002Ftmp\u002Fstatemachine.asl.json \\\n    --role-arn arn:aws:iam::{account_id}:role\u002Fsfn-state-machine-role \\\n    --type STANDARD \\\n    --region {region}\n",[825],{"type":42,"tag":181,"props":826,"children":827},{"__ignoreMap":562},[828],{"type":48,"value":823},{"type":42,"tag":73,"props":830,"children":831},{},[832],{"type":48,"value":833},"You MUST capture the stateMachineArn from the response",{"type":42,"tag":284,"props":835,"children":837},{"id":836},"step-11-create-the-eventbridge-rule",[838],{"type":48,"value":839},"Step 11: Create the EventBridge Rule",{"type":42,"tag":58,"props":841,"children":842},{},[843],{"type":48,"value":294},{"type":42,"tag":69,"props":845,"children":846},{},[847,861],{"type":42,"tag":73,"props":848,"children":849},{},[850,852],{"type":48,"value":851},"You MUST create the EventBridge rule to trigger on S3 object creation:",{"type":42,"tag":554,"props":853,"children":856},{"className":854,"code":855,"language":48},[557],"aws events put-rule \\\n    --name s3-to-stepfunctions \\\n    --event-pattern '{\n      \"source\": [\"aws.s3\"],\n      \"detail-type\": [\"Object Created\"],\n      \"detail\": {\n        \"bucket\": {\n          \"name\": [\"{bucket_name}\"]\n        }\n      }\n    }' \\\n    --region {region}\n",[857],{"type":42,"tag":181,"props":858,"children":859},{"__ignoreMap":562},[860],{"type":48,"value":855},{"type":42,"tag":73,"props":862,"children":863},{},[864,866],{"type":48,"value":865},"You MUST add the state machine as a target:",{"type":42,"tag":554,"props":867,"children":870},{"className":868,"code":869,"language":48},[557],"aws events put-targets \\\n    --rule s3-to-stepfunctions \\\n    --targets '[{\n      \"Id\": \"StepFunctionsTarget\",\n      \"Arn\": \"{state_machine_arn}\",\n      \"RoleArn\": \"arn:aws:iam::{account_id}:role\u002Fsfn-eventbridge-role\"\n    }]' \\\n    --region {region}\n",[871],{"type":42,"tag":181,"props":872,"children":873},{"__ignoreMap":562},[874],{"type":48,"value":869},{"type":42,"tag":284,"props":876,"children":878},{"id":877},"step-12-configure-monitoring",[879],{"type":48,"value":880},"Step 12: Configure Monitoring",{"type":42,"tag":58,"props":882,"children":883},{},[884],{"type":48,"value":294},{"type":42,"tag":69,"props":886,"children":887},{},[888,899,913],{"type":42,"tag":73,"props":889,"children":890},{},[891,893],{"type":48,"value":892},"You MUST create a Dead Letter Queue for failed EventBridge invocations:\n",{"type":42,"tag":181,"props":894,"children":896},{"className":895},[],[897],{"type":48,"value":898},"aws sqs create-queue --queue-name s3-to-stepfunctions-dlq --region {region}",{"type":42,"tag":73,"props":900,"children":901},{},[902,904],{"type":48,"value":903},"You MUST update the EventBridge target to attach the DLQ:",{"type":42,"tag":554,"props":905,"children":908},{"className":906,"code":907,"language":48},[557],"aws events put-targets \\\n    --rule s3-to-stepfunctions \\\n    --targets '[{\n      \"Id\": \"StepFunctionsTarget\",\n      \"Arn\": \"{state_machine_arn}\",\n      \"RoleArn\": \"arn:aws:iam::{account_id}:role\u002Fsfn-eventbridge-role\",\n      \"DeadLetterConfig\": {\n        \"Arn\": \"arn:aws:sqs:{region}:{account_id}:s3-to-stepfunctions-dlq\"\n      }\n    }]' \\\n    --region {region}\n",[909],{"type":42,"tag":181,"props":910,"children":911},{"__ignoreMap":562},[912],{"type":48,"value":907},{"type":42,"tag":73,"props":914,"children":915},{},[916,918],{"type":48,"value":917},"You MUST create a CloudWatch alarm for Step Functions execution failures:\n",{"type":42,"tag":181,"props":919,"children":921},{"className":920},[],[922],{"type":48,"value":923},"aws cloudwatch put-metric-alarm --alarm-name sfn-execution-failures --metric-name ExecutionsFailed --namespace AWS\u002FStates --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --dimensions Name=StateMachineArn,Value={state_machine_arn} --region {region}",{"type":42,"tag":284,"props":925,"children":927},{"id":926},"step-13-validate",[928],{"type":48,"value":929},"Step 13: Validate",{"type":42,"tag":58,"props":931,"children":932},{},[933],{"type":48,"value":294},{"type":42,"tag":69,"props":935,"children":936},{},[937,951,962,967],{"type":42,"tag":73,"props":938,"children":939},{},[940,942],{"type":48,"value":941},"You MUST test with a small file (\u003C 6 MB) to verify Lambda processing:",{"type":42,"tag":554,"props":943,"children":946},{"className":944,"code":945,"language":48},[557],"echo 'test data' > \u002Ftmp\u002Fsmall-file.txt\naws s3 cp \u002Ftmp\u002Fsmall-file.txt s3:\u002F\u002F{bucket_name}\u002Fsmall-file.txt --region {region}\n",[947],{"type":42,"tag":181,"props":948,"children":949},{"__ignoreMap":562},[950],{"type":48,"value":945},{"type":42,"tag":73,"props":952,"children":953},{},[954,956],{"type":48,"value":955},"You MUST wait 15 seconds then check the Step Functions execution:\n",{"type":42,"tag":181,"props":957,"children":959},{"className":958},[],[960],{"type":48,"value":961},"aws stepfunctions list-executions --state-machine-arn {state_machine_arn} --region {region}",{"type":42,"tag":73,"props":963,"children":964},{},[965],{"type":48,"value":966},"You MUST verify the execution succeeded and routed to Lambda",{"type":42,"tag":73,"props":968,"children":969},{},[970],{"type":48,"value":971},"You MUST provide a summary of all created resources including: VPC ID, subnet IDs, security group ID, ECR repo URI, ECS cluster ARN, task definition ARN, Lambda function ARN, state machine ARN, bucket name, and EventBridge rule name",{"type":42,"tag":51,"props":973,"children":975},{"id":974},"troubleshooting",[976],{"type":48,"value":977},"Troubleshooting",{"type":42,"tag":284,"props":979,"children":981},{"id":980},"eventbridge-rule-not-triggering",[982],{"type":48,"value":983},"EventBridge rule not triggering",{"type":42,"tag":69,"props":985,"children":986},{},[987,998,1009],{"type":42,"tag":73,"props":988,"children":989},{},[990,992],{"type":48,"value":991},"Verify EventBridge notifications are enabled on the bucket: ",{"type":42,"tag":181,"props":993,"children":995},{"className":994},[],[996],{"type":48,"value":997},"aws s3api get-bucket-notification-configuration --bucket {bucket_name}",{"type":42,"tag":73,"props":999,"children":1000},{},[1001,1003],{"type":48,"value":1002},"Verify the rule exists: ",{"type":42,"tag":181,"props":1004,"children":1006},{"className":1005},[],[1007],{"type":48,"value":1008},"aws events describe-rule --name s3-to-stepfunctions --region {region}",{"type":42,"tag":73,"props":1010,"children":1011},{},[1012],{"type":48,"value":1013},"Check that the target has the correct state machine ARN and role",{"type":42,"tag":284,"props":1015,"children":1017},{"id":1016},"step-functions-execution-fails-at-fargate-task",[1018],{"type":48,"value":1019},"Step Functions execution fails at Fargate task",{"type":42,"tag":69,"props":1021,"children":1022},{},[1023,1034,1039,1044],{"type":42,"tag":73,"props":1024,"children":1025},{},[1026,1028],{"type":48,"value":1027},"Verify the container image exists in ECR: ",{"type":42,"tag":181,"props":1029,"children":1031},{"className":1030},[],[1032],{"type":48,"value":1033},"aws ecr describe-images --repository-name {ecr_repo_name} --region {region}",{"type":42,"tag":73,"props":1035,"children":1036},{},[1037],{"type":48,"value":1038},"Check that the subnets have internet access (route table with IGW)",{"type":42,"tag":73,"props":1040,"children":1041},{},[1042],{"type":48,"value":1043},"Verify the security group allows outbound traffic",{"type":42,"tag":73,"props":1045,"children":1046},{},[1047,1049],{"type":48,"value":1048},"Check CloudWatch Logs at ",{"type":42,"tag":181,"props":1050,"children":1052},{"className":1051},[],[1053],{"type":48,"value":1054},"\u002FStepFunctionFargateTask",{"type":42,"tag":284,"props":1056,"children":1058},{"id":1057},"lambda-invocation-fails",[1059],{"type":48,"value":1060},"Lambda invocation fails",{"type":42,"tag":69,"props":1062,"children":1063},{},[1064,1075],{"type":42,"tag":73,"props":1065,"children":1066},{},[1067,1069],{"type":48,"value":1068},"Check CloudWatch Logs: ",{"type":42,"tag":181,"props":1070,"children":1072},{"className":1071},[],[1073],{"type":48,"value":1074},"aws logs tail \u002Faws\u002Flambda\u002Fsfn-file-processor --region {region}",{"type":42,"tag":73,"props":1076,"children":1077},{},[1078,1080,1086],{"type":48,"value":1079},"Verify the Step Functions role has ",{"type":42,"tag":181,"props":1081,"children":1083},{"className":1082},[],[1084],{"type":48,"value":1085},"lambda:InvokeFunction",{"type":48,"value":1087}," permission",{"type":42,"tag":284,"props":1089,"children":1091},{"id":1090},"iam-passrole-errors",[1092],{"type":48,"value":1093},"IAM PassRole errors",{"type":42,"tag":69,"props":1095,"children":1096},{},[1097],{"type":42,"tag":73,"props":1098,"children":1099},{},[1100,1102,1108],{"type":48,"value":1101},"The Step Functions role must have ",{"type":42,"tag":181,"props":1103,"children":1105},{"className":1104},[],[1106],{"type":48,"value":1107},"iam:PassRole",{"type":48,"value":1109}," for both the ECS execution role and task role ARNs",{"type":42,"tag":284,"props":1111,"children":1113},{"id":1112},"fargate-task-stuck-in-provisioning",[1114],{"type":48,"value":1115},"Fargate task stuck in PROVISIONING",{"type":42,"tag":69,"props":1117,"children":1118},{},[1119,1124],{"type":42,"tag":73,"props":1120,"children":1121},{},[1122],{"type":48,"value":1123},"Verify the subnets have auto-assign public IP enabled",{"type":42,"tag":73,"props":1125,"children":1126},{},[1127],{"type":48,"value":1128},"Verify the internet gateway is attached and route table has 0.0.0.0\u002F0 route",{"type":42,"tag":51,"props":1130,"children":1132},{"id":1131},"security-considerations",[1133],{"type":48,"value":1134},"Security Considerations",{"type":42,"tag":69,"props":1136,"children":1137},{},[1138,1166,1177,1182,1193,1204,1209],{"type":42,"tag":73,"props":1139,"children":1140},{},[1141,1143,1149,1151,1157,1158,1164],{"type":48,"value":1142},"Fargate tasks with public IPs are exposed to the internet. Revoke the default allow-all egress rule and configure scoped egress: ",{"type":42,"tag":181,"props":1144,"children":1146},{"className":1145},[],[1147],{"type":48,"value":1148},"aws ec2 revoke-security-group-egress --group-id {sg_id} --ip-permissions IpProtocol=-1,IpRanges='[{CidrIp=0.0.0.0\u002F0}]'",{"type":48,"value":1150}," then add ",{"type":42,"tag":181,"props":1152,"children":1154},{"className":1153},[],[1155],{"type":48,"value":1156},"aws ec2 authorize-security-group-egress --group-id {sg_id} --protocol tcp --port 443 --cidr 0.0.0.0\u002F0",{"type":48,"value":541},{"type":42,"tag":181,"props":1159,"children":1161},{"className":1160},[],[1162],{"type":48,"value":1163},"aws ec2 authorize-security-group-egress --group-id {sg_id} --protocol udp --port 53 --cidr 0.0.0.0\u002F0",{"type":48,"value":1165},". For production, consider using VPC endpoints for S3 and CloudWatch Logs instead of internet-routed traffic.",{"type":42,"tag":73,"props":1167,"children":1168},{},[1169,1171],{"type":48,"value":1170},"Scan container images for vulnerabilities before pushing to ECR. Enable ECR image scanning with: ",{"type":42,"tag":181,"props":1172,"children":1174},{"className":1173},[],[1175],{"type":48,"value":1176},"aws ecr put-image-scanning-configuration --repository-name {ecr_repo_name} --image-scanning-configuration scanOnPush=true --region {region}",{"type":42,"tag":73,"props":1178,"children":1179},{},[1180],{"type":48,"value":1181},"Use IAM roles for credentials — never hardcode access keys in container code.",{"type":42,"tag":73,"props":1183,"children":1184},{},[1185,1187],{"type":48,"value":1186},"Enable encryption at rest for the S3 bucket: ",{"type":42,"tag":181,"props":1188,"children":1190},{"className":1189},[],[1191],{"type":48,"value":1192},"aws s3api put-bucket-encryption --bucket {bucket_name} --server-side-encryption-configuration '{\"Rules\":[{\"ApplyServerSideEncryptionByDefault\":{\"SSEAlgorithm\":\"aws:kms\"}}]}'",{"type":42,"tag":73,"props":1194,"children":1195},{},[1196,1198],{"type":48,"value":1197},"Enable CloudWatch Logs encryption for Fargate container logs: ",{"type":42,"tag":181,"props":1199,"children":1201},{"className":1200},[],[1202],{"type":48,"value":1203},"aws logs associate-kms-key --log-group-name \u002FStepFunctionFargateTask --kms-key-arn \u003CKMS_KEY_ARN>",{"type":42,"tag":73,"props":1205,"children":1206},{},[1207],{"type":48,"value":1208},"Configure a Dead Letter Queue on the EventBridge rule for failed invocations",{"type":42,"tag":73,"props":1210,"children":1211},{},[1212],{"type":48,"value":1213},"Set up CloudWatch alarms on Step Functions execution failures for operational visibility",{"type":42,"tag":51,"props":1215,"children":1217},{"id":1216},"version-information",[1218],{"type":48,"value":1219},"Version information",{"type":42,"tag":69,"props":1221,"children":1222},{},[1223,1233,1243],{"type":42,"tag":73,"props":1224,"children":1225},{},[1226,1231],{"type":42,"tag":173,"props":1227,"children":1228},{},[1229],{"type":48,"value":1230},"AWS CLI",{"type":48,"value":1232},": 2.x",{"type":42,"tag":73,"props":1234,"children":1235},{},[1236,1241],{"type":42,"tag":173,"props":1237,"children":1238},{},[1239],{"type":48,"value":1240},"Python runtime",{"type":48,"value":1242},": 3.12",{"type":42,"tag":73,"props":1244,"children":1245},{},[1246,1251],{"type":42,"tag":173,"props":1247,"children":1248},{},[1249],{"type":48,"value":1250},"Last validated",{"type":48,"value":1252},": 2026-04-27",{"type":42,"tag":51,"props":1254,"children":1256},{"id":1255},"additional-resources",[1257],{"type":48,"value":1258},"Additional Resources",{"type":42,"tag":69,"props":1260,"children":1261},{},[1262,1272,1282,1292,1302],{"type":42,"tag":73,"props":1263,"children":1264},{},[1265],{"type":42,"tag":509,"props":1266,"children":1269},{"href":1267,"rel":1268},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fstep-functions\u002Flatest\u002Fdg\u002Fwelcome.html",[513],[1270],{"type":48,"value":1271},"Step Functions developer guide",{"type":42,"tag":73,"props":1273,"children":1274},{},[1275],{"type":42,"tag":509,"props":1276,"children":1279},{"href":1277,"rel":1278},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonS3\u002Flatest\u002Fuserguide\u002FEventBridge.html",[513],[1280],{"type":48,"value":1281},"EventBridge S3 events",{"type":42,"tag":73,"props":1283,"children":1284},{},[1285],{"type":42,"tag":509,"props":1286,"children":1289},{"href":1287,"rel":1288},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002Fdeveloperguide\u002Ftask_definitions.html",[513],[1290],{"type":48,"value":1291},"Fargate task definitions",{"type":42,"tag":73,"props":1293,"children":1294},{},[1295],{"type":42,"tag":509,"props":1296,"children":1299},{"href":1297,"rel":1298},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECR\u002Flatest\u002Fuserguide\u002Fdocker-push-ecr-image.html",[513],[1300],{"type":48,"value":1301},"ECR pushing images",{"type":42,"tag":73,"props":1303,"children":1304},{},[1305],{"type":42,"tag":509,"props":1306,"children":1309},{"href":1307,"rel":1308},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fstep-functions\u002Flatest\u002Fdg\u002Fconnect-ecs.html",[513],[1310],{"type":48,"value":1311},"Step Functions Fargate integration",{"items":1313,"total":1415},[1314,1329,1344,1359,1374,1384,1399],{"slug":1315,"name":1315,"fn":1316,"description":1317,"org":1318,"tags":1319,"stars":24,"repoUrl":25,"updatedAt":1328},"agents-build","add capabilities to existing agent projects","Use when adding capabilities to an existing agent project — memory, app integration, VPC, multi-agent, migration, model changes, browser, code interpreter, or resource removal. Triggers on: \"add memory\", \"remember across sessions\", \"call agent from app\", \"invoke agent from code\", \"auth to call agent\", \"streaming responses\", \"VPC\", \"VPC connectivity\", \"VPC error\", \"can't reach from VPC\", \"multi-agent\", \"A2A\", \"A2A auth\", \"orchestrator not delegating\", \"specialist not called\", \"migrate Bedrock Agent\", \"after import\", \"migration issue\", \"framework for migration\", \"change model\", \"browser tool\", \"code interpreter\", \"delete agent\", \"tear down\", \"agentcore remove\", \"cross-account memory\", \"resource-based policy on memory\", \"pay for x402 content\", \"402 Payment Required\", \"microtransactions\", \"paid API or tool\". Not for connecting to external APIs via Gateway — use agents-connect. Not for scaffolding a new project — use agents-get-started. Not for CLI\u002Fdev server errors — use agents-debug. Strands vs LangGraph in a migration context routes here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1320,1323,1324,1325],{"name":1321,"slug":1322,"type":15},"Agents","agents",{"name":13,"slug":14,"type":15},{"name":23,"slug":8,"type":15},{"name":1326,"slug":1327,"type":15},"Engineering","engineering","2026-07-12T08:42:53.812877",{"slug":1330,"name":1330,"fn":1331,"description":1332,"org":1333,"tags":1334,"stars":24,"repoUrl":25,"updatedAt":1343},"agents-connect","connect agents to external services","Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: \"connect to API\", \"add gateway\", \"connect to MCP server\", \"Lambda tools\", \"OpenAPI\", \"gateway target\", \"Cedar policy\", \"restrict tools\", \"policy engine\", \"gateway auth error\", \"store API key\", \"outbound credential\", \"env var API key\", \"API key None after deploy\", \"credential not available after deploy\", \"should this be a gateway target\", \"give my agent tools\", \"add tools to agent\". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1335,1336,1339,1342],{"name":1321,"slug":1322,"type":15},{"name":1337,"slug":1338,"type":15},"API Development","api-development",{"name":1340,"slug":1341,"type":15},"Authentication","authentication",{"name":23,"slug":8,"type":15},"2026-07-16T06:00:38.866147",{"slug":1345,"name":1345,"fn":1346,"description":1347,"org":1348,"tags":1349,"stars":24,"repoUrl":25,"updatedAt":1358},"agents-debug","debug agent and environment issues","Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: \"agent not working\", \"wrong answer\", \"agent error\", \"tool call failing\", \"debug agent\", \"check logs\", \"read traces\", \"broken\", \"500 error\", \"424 error\", \"model access denied\", \"command not found\", \"stuck in DELETING\", \"maxVms exceeded\", \"cold start diagnosis\", \"cold start slow\", \"agentcore create error\", \"create failed\", \"exit code 7\", \"connection refused local dev\". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1350,1351,1352,1355],{"name":1321,"slug":1322,"type":15},{"name":23,"slug":8,"type":15},{"name":1353,"slug":1354,"type":15},"Debugging","debugging",{"name":1356,"slug":1357,"type":15},"Observability","observability","2026-07-16T06:00:44.679093",{"slug":1360,"name":1360,"fn":1361,"description":1362,"org":1363,"tags":1364,"stars":24,"repoUrl":25,"updatedAt":1373},"agents-deploy","deploy AI agents to AWS","Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK\u002FIAM\u002Fquota error diagnosis, version management, rollback, and canary deployments. Triggers on: \"deploy my agent\", \"agentcore deploy\", \"deploy failed\", \"CDK error\", \"rollback\", \"canary deploy\", \"pin version\", \"redeploy\", \"deploy stuck\". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1365,1366,1367,1370],{"name":1321,"slug":1322,"type":15},{"name":23,"slug":8,"type":15},{"name":1368,"slug":1369,"type":15},"CI\u002FCD","ci-cd",{"name":1371,"slug":1372,"type":15},"Deployment","deployment","2026-07-12T08:42:55.059577",{"slug":1375,"name":1375,"fn":1376,"description":1377,"org":1378,"tags":1379,"stars":24,"repoUrl":25,"updatedAt":1383},"agents-get-started","scaffold and deploy new agent projects","Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: \"build an agent\", \"create an agent\", \"get started\", \"new project\", \"agentcore create\", \"which framework\", \"Strands vs LangGraph\", \"hello world agent\", \"first agent\", \"create MCP server\", \"host MCP server\", \"agentcore dev\", \"dev server\", \"what port\", \"local development\". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1380,1381,1382],{"name":1321,"slug":1322,"type":15},{"name":23,"slug":8,"type":15},{"name":1371,"slug":1372,"type":15},"2026-07-12T08:42:51.963247",{"slug":1385,"name":1385,"fn":1386,"description":1387,"org":1388,"tags":1389,"stars":24,"repoUrl":25,"updatedAt":1398},"agents-harden","harden agents for production","Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: \"production checklist\", \"harden agent\", \"production ready\", \"secure agent\", \"inbound auth\", \"going live\", \"cold start optimization\", \"session lifecycle\", \"StopRuntimeSession\", \"quota\", \"throttling\", \"maxVms\", \"rate limit\", \"security audit of outbound API calls\", \"gateway target audit for production\", \"restrict who can call\", \"lock down endpoint\", \"only our app can call\". Not for Cedar tool-restriction policies — use agents-connect. Not for quality measurement — use agents-optimize. Not for outbound credential storage or API key wiring — use agents-connect. Not for A2A agent-to-agent auth — use agents-build. Cold start observation and diagnosis (not optimization) routes to agents-debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1390,1391,1392,1395],{"name":1321,"slug":1322,"type":15},{"name":23,"slug":8,"type":15},{"name":1393,"slug":1394,"type":15},"Best Practices","best-practices",{"name":1396,"slug":1397,"type":15},"Security","security","2026-07-16T06:00:42.174705",{"slug":1400,"name":1400,"fn":1401,"description":1402,"org":1403,"tags":1404,"stars":24,"repoUrl":25,"updatedAt":1414},"agents-optimize","optimize agent quality and performance","Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI\u002FCD quality gates, observability, or cost optimization. Triggers on: \"evaluate my agent\", \"add evaluator\", \"measure quality\", \"quality gate\", \"run evals\", \"agent too slow\", \"why is it slow\", \"reduce latency\", \"set up observability\", \"CloudWatch dashboard\", \"how much does my agent cost\", \"cost optimization\", \"logs not showing up\", \"logs missing\", \"spans not found\", \"eval failing\", \"eval error\", \"dev traces\", \"local traces\", \"agentcore dev traces\", \"traces to CloudWatch\". Not for debugging errors or crashes — use agents-debug. Slow but correct routes here; broken routes to debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1405,1406,1407,1410,1411],{"name":1321,"slug":1322,"type":15},{"name":23,"slug":8,"type":15},{"name":1408,"slug":1409,"type":15},"Evals","evals",{"name":1356,"slug":1357,"type":15},{"name":1412,"slug":1413,"type":15},"Performance","performance","2026-07-12T08:42:56.488105",114,{"items":1417,"total":1534},[1418,1425,1432,1439,1446,1452,1459,1467,1484,1497,1509,1524],{"slug":1315,"name":1315,"fn":1316,"description":1317,"org":1419,"tags":1420,"stars":24,"repoUrl":25,"updatedAt":1328},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1421,1422,1423,1424],{"name":1321,"slug":1322,"type":15},{"name":13,"slug":14,"type":15},{"name":23,"slug":8,"type":15},{"name":1326,"slug":1327,"type":15},{"slug":1330,"name":1330,"fn":1331,"description":1332,"org":1426,"tags":1427,"stars":24,"repoUrl":25,"updatedAt":1343},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1428,1429,1430,1431],{"name":1321,"slug":1322,"type":15},{"name":1337,"slug":1338,"type":15},{"name":1340,"slug":1341,"type":15},{"name":23,"slug":8,"type":15},{"slug":1345,"name":1345,"fn":1346,"description":1347,"org":1433,"tags":1434,"stars":24,"repoUrl":25,"updatedAt":1358},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1435,1436,1437,1438],{"name":1321,"slug":1322,"type":15},{"name":23,"slug":8,"type":15},{"name":1353,"slug":1354,"type":15},{"name":1356,"slug":1357,"type":15},{"slug":1360,"name":1360,"fn":1361,"description":1362,"org":1440,"tags":1441,"stars":24,"repoUrl":25,"updatedAt":1373},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1442,1443,1444,1445],{"name":1321,"slug":1322,"type":15},{"name":23,"slug":8,"type":15},{"name":1368,"slug":1369,"type":15},{"name":1371,"slug":1372,"type":15},{"slug":1375,"name":1375,"fn":1376,"description":1377,"org":1447,"tags":1448,"stars":24,"repoUrl":25,"updatedAt":1383},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1449,1450,1451],{"name":1321,"slug":1322,"type":15},{"name":23,"slug":8,"type":15},{"name":1371,"slug":1372,"type":15},{"slug":1385,"name":1385,"fn":1386,"description":1387,"org":1453,"tags":1454,"stars":24,"repoUrl":25,"updatedAt":1398},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1455,1456,1457,1458],{"name":1321,"slug":1322,"type":15},{"name":23,"slug":8,"type":15},{"name":1393,"slug":1394,"type":15},{"name":1396,"slug":1397,"type":15},{"slug":1400,"name":1400,"fn":1401,"description":1402,"org":1460,"tags":1461,"stars":24,"repoUrl":25,"updatedAt":1414},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1462,1463,1464,1465,1466],{"name":1321,"slug":1322,"type":15},{"name":23,"slug":8,"type":15},{"name":1408,"slug":1409,"type":15},{"name":1356,"slug":1357,"type":15},{"name":1412,"slug":1413,"type":15},{"slug":1468,"name":1468,"fn":1469,"description":1470,"org":1471,"tags":1472,"stars":24,"repoUrl":25,"updatedAt":1483},"amazon-aurora-mysql","manage Amazon Aurora MySQL clusters","Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or MySQL upgrade planning. Aurora MySQL uses full (VPC-based) configuration — express configuration is PostgreSQL-only. For Aurora PostgreSQL, use amazon-aurora-postgresql instead. Contains safety guardrails and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1473,1474,1477,1480],{"name":23,"slug":8,"type":15},{"name":1475,"slug":1476,"type":15},"Database","database",{"name":1478,"slug":1479,"type":15},"MySQL","mysql",{"name":1481,"slug":1482,"type":15},"Serverless","serverless","2026-07-12T08:43:13.27939",{"slug":1485,"name":1485,"fn":1486,"description":1487,"org":1488,"tags":1489,"stars":24,"repoUrl":25,"updatedAt":1496},"amazon-aurora-postgresql","configure Amazon Aurora PostgreSQL clusters","Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or PostgreSQL upgrade planning. For Aurora MySQL, use amazon-aurora-mysql instead. Contains safety guardrails, express-first routing, and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1490,1491,1492,1495],{"name":23,"slug":8,"type":15},{"name":1475,"slug":1476,"type":15},{"name":1493,"slug":1494,"type":15},"PostgreSQL","postgresql",{"name":1481,"slug":1482,"type":15},"2026-07-16T06:00:34.789624",{"slug":1498,"name":1498,"fn":1499,"description":1500,"org":1501,"tags":1502,"stars":24,"repoUrl":25,"updatedAt":1508},"amazon-bedrock","build generative AI apps with Amazon Bedrock","Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore. Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, migrating\u002Fporting\u002Fconverting a Bedrock Agent (including inline agents) to an AgentCore Harness, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching setup and debugging, quota health checks and throttling diagnosis, cost attribution and tracking, migrating between Claude model generations (4.5 to 4.6 to 4.7), chunking strategies, API selection (Converse vs InvokeModel), guardrail capabilities, and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Connector, Instrument, Coinbase CDP, Stripe Privy, 402 Payment Required, pay for content, paid endpoint, agent payments). NOT for custom model training, Rekognition, or Comprehend.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1503,1504,1505],{"name":1321,"slug":1322,"type":15},{"name":23,"slug":8,"type":15},{"name":1506,"slug":1507,"type":15},"LLM","llm","2026-07-25T05:30:35.20899",{"slug":1510,"name":1510,"fn":1511,"description":1512,"org":1513,"tags":1514,"stars":24,"repoUrl":25,"updatedAt":1523},"amazon-documentdb","manage Amazon DocumentDB clusters","Manages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS\u002FVPC\u002Fdriver config, flexible-schema and vector-search data modeling, MongoDB compatibility assessment, DMS-based migration, slow-query diagnosis, major version upgrades (4.0→5.0→8.0), Well-Architected reviews (41-check wa_review.py), cost estimation, and security hardening. Retrieve for every DocumentDB question and when the user asks to set up or migrate MongoDB to AWS — DocumentDB is AWS's MongoDB-compatible managed database. Triggers: JSON document store, document database, MongoDB on AWS, Nested fields, Lambda cannot connect, TLS handshake, VPC port 27017, IAM auth, Secrets Manager, encryption at rest, $graphLookup, flexible schema, COLLSCAN, compound index, DMS migration, CDC cutover, $vectorSearch, RAG, Global Clusters, DR replication, cost sizing, audit, health check, production-readiness.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1515,1516,1517,1520],{"name":23,"slug":8,"type":15},{"name":1475,"slug":1476,"type":15},{"name":1518,"slug":1519,"type":15},"MongoDB","mongodb",{"name":1521,"slug":1522,"type":15},"NoSQL","nosql","2026-07-12T08:43:00.455878",{"slug":1525,"name":1525,"fn":1526,"description":1527,"org":1528,"tags":1529,"stars":24,"repoUrl":25,"updatedAt":1533},"amazon-dynamodb","design and debug DynamoDB data layers","Designs, reviews, and debugs DynamoDB data layers from design axioms — enumerates access patterns, chooses partition\u002Fsort keys and GSIs, decides single-table vs. multi-table, configures Streams, Global Tables, TTL, and zero-ETL integrations to OpenSearch\u002FRedshift\u002FSageMaker Lakehouse, and produces a defensible data-layer design with a monthly cost estimate and optional live validation. Applies whenever a user is designing, reviewing, or refactoring anything backed by DynamoDB — schemas, access patterns, GSIs, single- vs. multi-table choices, Streams consumers, transactional outboxes, Global Tables, zero-ETL pipelines — even when they don't say \"axioms\" or \"design review.\" Also applies when debugging hot partitions, throttling, unbounded Scans, LWW conflicts, or surprise bills on DynamoDB workloads.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1530,1531,1532],{"name":23,"slug":8,"type":15},{"name":1475,"slug":1476,"type":15},{"name":1521,"slug":1522,"type":15},"2026-07-16T06:00:37.690386",115]