$npx -y skills add aws/agent-toolkit-for-aws --skill exploring-data-catalogexploring-data-catalog is an agent skill published from aws/agent-toolkit-for-aws, installable through the skills CLI.
| 1 | Structured inventory and cataloging across your AWS data landscape: Glue Data Catalog with S3 Tables, Redshift-federated, and remote Iceberg catalogs. |
| 2 | |
| 3 | ## Overview |
| 4 | |
| 5 | Maps data in an AWS account. Starts with catalog landscape (Glue, S3 Tables, federated), then drills into databases and tables. Read-only — no query execution. |
| 6 | |
| 7 | **Constraints for parameter acquisition:** |
| 8 | |
| 9 | - You MUST ask for the target AWS region upfront if not provided |
| 10 | - You MUST support a single optional argument: search term, catalog name, database name, S3 path, or table name |
| 11 | - You MUST accept the argument as direct input or a pointer to a file containing the spec |
| 12 | - You MUST confirm the scope (full landscape vs. targeted deep dive) before making API calls |
| 13 | - You MUST respect the user's decision to abort at any step |
| 14 | |
| 15 | ## Common Tasks |
| 16 | |
| 17 | **Pagination:** All list and search calls in this workflow may return paginated results. You MUST pass `--next-token` from the previous response until no more tokens are returned. You MUST NOT assume a single page contains all results. |
| 18 | |
| 19 | ### 1. Verify Dependencies |
| 20 | |
| 21 | Check for required tools and AWS access before discovery. |
| 22 | |
| 23 | **Constraints:** |
| 24 | |
| 25 | - You MUST verify AWS MCP server tools are available (`aws___call_aws`, `aws___search_documentation`) and fall back to AWS CLI if not |
| 26 | - You MUST confirm credentials are valid: `aws sts get-caller-identity` |
| 27 | - You MUST inform the user about any missing tools and ask whether to proceed |
| 28 | |
| 29 | ### 2. Consult Catalog Context (experimental — suggested first lookup) |
| 30 | |
| 31 | Customers may publish context assets that describe the data landscape (canonical |
| 32 | names, domains, ownership) faster than a full enumeration. |
| 33 | |
| 34 | These are the **Glue Discovery** operations (`SearchAssets` / `GetAsset` / |
| 35 | `ListIterableForms` / `BatchGetIterableForms`) — a distinct metadata-search surface, |
| 36 | NOT the legacy `glue search-tables`. They are **experimental** — not available in every |
| 37 | CLI build. Gate the |
| 38 | lookup on two checks first: |
| 39 | |
| 40 | 1. **Availability.** Confirm the `GetAsset` operation exists in the caller's Glue |
| 41 | CLI model (redirect output so the CLI pager cannot block a non-interactive agent): |
| 42 | |
| 43 | ``` |
| 44 | aws glue get-asset help > /dev/null 2>&1 |
| 45 | # exit 0 = available. exit 2 (with "Invalid choice" in stderr) = not in this CLI (skip). |
| 46 | # any other non-zero (network/credential error) = inconclusive; treat as unavailable. |
| 47 | ``` |
| 48 | |
| 49 | If it is not available, skip this step and go to full discovery (Steps 3-5). |
| 50 | 2. **User opt-in.** If available, ask the user: "I can consult the Glue Data Catalog |
| 51 | for customer-authored context using an experimental SearchAssets/GetAsset API. |
| 52 | Use it? (yes/no)". Proceed only on an explicit yes; otherwise skip to Steps 3-5. |
| 53 | |
| 54 | **How this model differs:** Discovery indexes **assets** (not databases/tables). Each |
| 55 | asset's `Id` is an **ARN**, and `get-asset` / `list-iterable-forms` key off it via the |
| 56 | identifier — there is no `--database-name`. CLI flags are kebab-case; top-level response fields are PascalCase. NOTE: a `*.Content` value is itself a JSON STRING with its own camelCase schema (e.g. `dataLocation`, `dataFormat`, `isPartitionKey`) — parse it as embedded JSON. The operations: |
| 57 | |
| 58 | | Operation | Input → Output | |
| 59 | |---|---| |
| 60 | | `search-assets` | `--search-text` (+ optional `--filter-clause`) → `Items[]` of `{Id, AssetName, Type, Namespace, AssetTypeId, UpdatedAt}` (search items have NO description — call `get-asset` for `Description`/`Forms`) | |
| 61 | | `get-asset` | `--identifier <Id, an ARN>` → one asset's `{Description, Forms, IterableForms}`; `Forms."amazon::Table".Content` is JSON `{dataLocation, dataFormat, type}`; advertises column availability via `IterableForms: {"columns": {...}}` | |
| 62 | | `list-iterable-forms` | `--asset-identifier <table ARN> --iterable-form-name columns` → that table's columns `Items[]` of `{ItemId, ItemName, Description}` | |
| 63 | | `batch-get-iterable-forms` | `--asset-identifier <table ARN> --iterable-form-name columns --item-identifiers <id1> <id2> ...` (space-separated list) → `Items[]` of `{ItemName, Forms}` where `Forms.Column.Content` is JSON `{"type": "...", "isPartitionKey": ...}` | |
| 64 | |
| 65 | ``` |
| 66 | aws glue search-assets --search-text '<scope or domain, e.g. sales>' --max-results 10 |
| 67 | aws glue get-asset --identifier "arn:aws:glue:<region>:<account>:table/<db>/<table>" |
| 68 | ``` |
| 69 | |
| 70 | Narrow with `--filter-clause` to scope the audit (filterable: `type`, |
| 71 | `amazon.glue::GlueTable.databaseName`, `dataFormat`, `c |