aws-containers

Name: aws-containers
Author: aws

3.3kinstalls190forks

How to install aws-containers?

aws/agent-toolkit-for-aws/aws-containers

$npx -y skills add aws/agent-toolkit-for-aws --skill aws-containers

Installs into the current project.

Summary

Deploys and operates containerized workloads on ECS, Fargate, and ECR. Covers task definitions, Fargate services, ECR repository setup and lifecycle policies, ECS Exec debugging, service scaling, deployment strategies, load balancer integration, and logging configuration. Use whe

Files · 1

View on GitHub

SKILL.md

1	# AWS Containers
2
3	## Service Overview
4
5	\| Developer Need \| Recommend \| Key CLI / CDK \|
6	\|---\|---\|---\|
7	\| Simplest container deploy (HTTP app/API, new customers) \| ECS Express Mode \| `aws ecs create-express-gateway-service` \|
8	\| Web app, worker, batch, scheduled task \| ECS on Fargate \| `aws ecs create-service` / CDK `ecsPatterns.ApplicationLoadBalancedFargateService` \|
9	\| GPU workloads or >16 vCPU \| ECS on EC2 \| CDK `ecs.Ec2Service` \|
10	\| Store container images \| ECR \| `aws ecr create-repository` \|
11	\| Web app behind a load balancer \| ECS Fargate + ALB \| CDK `ecsPatterns.ApplicationLoadBalancedFargateService` \|
12	\| SQS worker scaling on queue depth \| ECS Fargate + SQS \| CDK `ecsPatterns.QueueProcessingFargateService` \|
13	\| Cron job / scheduled task \| ECS Fargate + EventBridge \| CDK `ecsPatterns.ScheduledFargateTask` \|
14	\| Service mesh / service-to-service \| ECS Service Connect \| Configure on ECS service with Cloud Map namespace \|
15	\| Debug a running container \| ECS Exec \| `aws ecs execute-command --interactive --command "/bin/sh"` \|
16
17	When a developer says "deploy my container" without naming a service: recommend ECS Express Mode for simple HTTP apps (replaces App Runner for new customers). Recommend ECS Fargate for everything else. Never recommend EKS unless they explicitly ask for Kubernetes.
18
19	## Overview
20
21	Provides expertise for building, deploying, and operating containerized workloads using Amazon ECS, AWS Fargate, Amazon ECR, and AWS App Runner.
22
23	Recommended setup: Install the AWS MCP server for sandboxed execution, audit logging, and enterprise controls. See: aws.amazon.com/mcp
24
25	Without AWS MCP: This skill works with any agent that has AWS CLI access. All commands use standard AWS CLI syntax.
26
27	When NOT to use this skill:
28
29	- Kubernetes or EKS workloads → use the kubernetes skill
30	- CI/CD pipeline setup for container deployments → use the deploy skill
31	- VPC subnet design and security group architecture → use the networking skill
32	- Running code without containers (Lambda, Step Functions) → use the serverless skill
33
34	Before executing any commands:
35
36	- You MUST verify AWS CLI v2 is installed and configured before running commands
37	- You MUST inform the user if required tools (AWS CLI, Docker, Session Manager plugin) are missing
38	- You MUST respect the user's decision to abort at any point
39
40	## Gotchas
41
42	Apply these every time. Each corrects a mistake agents make without explicit instruction.
43
44	1. Fargate CPU/memory must be valid combinations. Arbitrary values cause `Invalid 'cpu' setting for task`:
45	- 256 (0.25 vCPU): 512 MiB, 1 GB, 2 GB
46	- 512 (0.5 vCPU): 1–4 GB (1 GB increments)
47	- 1024 (1 vCPU): 2–8 GB (1 GB increments)
48	- 2048 (2 vCPU): 4–16 GB (1 GB increments)
49	- 4096 (4 vCPU): 8–30 GB (1 GB increments)
50	- 8192 (8 vCPU): 16–60 GB (4 GB increments)
51	- 16384 (16 vCPU): 32–120 GB (8 GB increments)
52
53	If the user requests an invalid combination, tell them and recommend the nearest valid option. You MUST NOT silently produce an invalid task definition.
54
55	2. Fargate requires `awsvpc` networking mode — no exceptions. Agents frequently suggest `bridge` or `host` mode for Fargate tasks, which causes immediate registration failure. You MUST set `networkMode` to `awsvpc` for all Fargate task definitions. On EC2, `awsvpc` is recommended; `bridge` is legacy only.
56
57	3. Execution role vs task role — never confuse them. `executionRoleArn`: ECS agent uses it to pull images, fetch secrets, write logs. `taskRoleArn`: application code uses it to call AWS APIs. ECS Exec permissions (`ssmmessages:`) go on the task role. ECR pull permissions go on the execution role. `ecr:GetAuthorizationToken` MUST use `Resource: ""` (registry-level action).
58
59	4. Secrets are injected at task launch only — no hot-reload. Changed secrets require `aws ecs update-service --force-new-deployment`. To reference a specific JSON key in Secrets Manager: `arn:aws:secretsmanager:region:account:secret:name-hash:json-key::` — the trailing colons are required (they represent empty version-stage and version-id fields). You can also use SSM Parameter Store with `valueFrom` pointing to the parameter ARN — the execution role needs `ssm:GetParameters` permission.
60
61	5. ALB deregistration delay defaults to 300s — reduce to 30–60s. This is the #1 cause of

People who liked this also viewed

6 picks

Type

aws-containers

3.3kinstalls190forks

View on GitHub

How to install aws-containers?

aws/agent-toolkit-for-aws/aws-containers

$npx -y skills add aws/agent-toolkit-for-aws --skill aws-containers

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AWS Containers
2
3	## Service Overview
4
5	\| Developer Need \| Recommend \| Key CLI / CDK \|
6	\|---\|---\|---\|
7	\| Simplest container deploy (HTTP app/API, new customers) \| ECS Express Mode \| `aws ecs create-express-gateway-service` \|
8	\| Web app, worker, batch, scheduled task \| ECS on Fargate \| `aws ecs create-service` / CDK `ecsPatterns.ApplicationLoadBalancedFargateService` \|
9	\| GPU workloads or >16 vCPU \| ECS on EC2 \| CDK `ecs.Ec2Service` \|
10	\| Store container images \| ECR \| `aws ecr create-repository` \|
11	\| Web app behind a load balancer \| ECS Fargate + ALB \| CDK `ecsPatterns.ApplicationLoadBalancedFargateService` \|
12	\| SQS worker scaling on queue depth \| ECS Fargate + SQS \| CDK `ecsPatterns.QueueProcessingFargateService` \|
13	\| Cron job / scheduled task \| ECS Fargate + EventBridge \| CDK `ecsPatterns.ScheduledFargateTask` \|
14	\| Service mesh / service-to-service \| ECS Service Connect \| Configure on ECS service with Cloud Map namespace \|
15	\| Debug a running container \| ECS Exec \| `aws ecs execute-command --interactive --command "/bin/sh"` \|
16
17	When a developer says "deploy my container" without naming a service: recommend ECS Express Mode for simple HTTP apps (replaces App Runner for new customers). Recommend ECS Fargate for everything else. Never recommend EKS unless they explicitly ask for Kubernetes.
18
19	## Overview
20
21	Provides expertise for building, deploying, and operating containerized workloads using Amazon ECS, AWS Fargate, Amazon ECR, and AWS App Runner.
22
23	Recommended setup: Install the AWS MCP server for sandboxed execution, audit logging, and enterprise controls. See: aws.amazon.com/mcp
24
25	Without AWS MCP: This skill works with any agent that has AWS CLI access. All commands use standard AWS CLI syntax.
26
27	When NOT to use this skill:
28
29	- Kubernetes or EKS workloads → use the kubernetes skill
30	- CI/CD pipeline setup for container deployments → use the deploy skill
31	- VPC subnet design and security group architecture → use the networking skill
32	- Running code without containers (Lambda, Step Functions) → use the serverless skill
33
34	Before executing any commands:
35
36	- You MUST verify AWS CLI v2 is installed and configured before running commands
37	- You MUST inform the user if required tools (AWS CLI, Docker, Session Manager plugin) are missing
38	- You MUST respect the user's decision to abort at any point
39
40	## Gotchas
41
42	Apply these every time. Each corrects a mistake agents make without explicit instruction.
43
44	1. Fargate CPU/memory must be valid combinations. Arbitrary values cause `Invalid 'cpu' setting for task`:
45	- 256 (0.25 vCPU): 512 MiB, 1 GB, 2 GB
46	- 512 (0.5 vCPU): 1–4 GB (1 GB increments)
47	- 1024 (1 vCPU): 2–8 GB (1 GB increments)
48	- 2048 (2 vCPU): 4–16 GB (1 GB increments)
49	- 4096 (4 vCPU): 8–30 GB (1 GB increments)
50	- 8192 (8 vCPU): 16–60 GB (4 GB increments)
51	- 16384 (16 vCPU): 32–120 GB (8 GB increments)
52
53	If the user requests an invalid combination, tell them and recommend the nearest valid option. You MUST NOT silently produce an invalid task definition.
54
55	2. Fargate requires `awsvpc` networking mode — no exceptions. Agents frequently suggest `bridge` or `host` mode for Fargate tasks, which causes immediate registration failure. You MUST set `networkMode` to `awsvpc` for all Fargate task definitions. On EC2, `awsvpc` is recommended; `bridge` is legacy only.
56
57	3. Execution role vs task role — never confuse them. `executionRoleArn`: ECS agent uses it to pull images, fetch secrets, write logs. `taskRoleArn`: application code uses it to call AWS APIs. ECS Exec permissions (`ssmmessages:`) go on the task role. ECR pull permissions go on the execution role. `ecr:GetAuthorizationToken` MUST use `Resource: ""` (registry-level action).
58
59	4. Secrets are injected at task launch only — no hot-reload. Changed secrets require `aws ecs update-service --force-new-deployment`. To reference a specific JSON key in Secrets Manager: `arn:aws:secretsmanager:region:account:secret:name-hash:json-key::` — the trailing colons are required (they represent empty version-stage and version-id fields). You can also use SSM Parameter Store with `valueFrom` pointing to the parameter ARN — the execution role needs `ssm:GetParameters` permission.
60
61	5. ALB deregistration delay defaults to 300s — reduce to 30–60s. This is the #1 cause of

People who liked this also viewed

6 picks

Type