How to use the AWS Resource Health Diagnosis agent skill

What an agent skill is and what this one makes the agent do

An agent skill is a folder containing a SKILL.md file with instructions that an AI agent loads when a request matches the skill's description. This skill's description is: analyze AWS resource health, diagnose issues from CloudWatch logs and metrics, and create a remediation plan for identified problems.

Once triggered, the agent follows a fixed workflow. It identifies the target resource, runs service-specific health checks, queries CloudWatch Logs Insights, classifies issues as Critical, High, Medium or Low, works out likely root causes, and then proposes a phased plan with AWS CLI commands and a validation checklist.

Install the skill from the ZIP download

Download the ZIP for the skill from this page and unzip it. The skill is a single file, SKILL.md. You can install it in one of two places, depending on how you want to use it.

For a personal install that works across projects, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder so it applies only there. In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/aws-resource-health-diagnose/
• Project only: .claude/skills/aws-resource-health-diagnose/ inside your repository
• Claude apps: Settings → Capabilities → Skills, then upload the skill

Check the requirements before you start

The skill runs AWS CLI commands on your behalf, so the CLI must already work on your machine. The source lists these prerequisites: the AWS CLI installed and configured with credentials, the target resource identified by name and type (plus region or account if needed), and CloudWatch logging and metrics enabled on that resource.

Permissions matter too. Diagnosis needs read access to logs, cloudwatch and pi actions. The suggested remediation commands would need write permissions. The examples use GNU date (date -d), so run them in a Bash-style shell.

• AWS CLI installed and configured with credentials (run aws configure if authentication fails)
• IAM read access for logs, cloudwatch and pi actions for diagnosis
• Write permissions only if you plan to run remediation commands
• CloudWatch logging and metrics enabled on the target resource
• A Bash-style shell with GNU date

Trigger the skill with a natural request

You do not need a special command. Describe the resource and the problem in plain language, and name the resource type and, if you know it, the region. The agent matches the request to the skill's description and begins the workflow.

Good requests name the resource and the symptom. Vague requests make the agent ask follow-up questions, which is also fine.

• Why is my Lambda function order-processor throwing errors in us-east-1?
• Check the health of the RDS instance prod-orders-db and suggest what to fix.
• Our ECS service checkout-api shows fewer running tasks than desired. Diagnose it.
• Run a health review of the SQS queue payments-dlq and tell me the severity of any issues.

Read the report and confirm before any changes

The agent first returns a summary: resource name and type, an overall status, counts of issues by severity, the top issues and the number of immediate, short-term and long-term actions. It then asks whether you want the detailed remediation plan. Answer yes only when you want the full markdown report with root cause analysis, phased CLI commands, CloudWatch alarm recommendations and a validation checklist.

The skill is designed to recommend fixes, not apply them on its own. Review each command before running it.

Safety notes: scripts, network and risky commands

This skill runs scripts and uses the network. Its commands call AWS APIs, and the workflow also tells the agent to fetch AWS CloudWatch documentation for guidance. Because the commands run against your real account, the credentials you have configured are the ones used.

Some suggested actions can disrupt live traffic. The source's own examples include rebooting an RDS instance to reset connections and raising Lambda reserved concurrency. Do not run remediation commands blindly in production. Check the impact, and have a rollback plan. The skill's success criteria call for validation and rollback steps, so ask for them explicitly if the plan omits them.

• Use read-only credentials for diagnosis when you can
• Review every write command before running it, especially aws rds reboot-db-instance
• Test remediation in a non-production account first where possible
• Coverage is limited to the resource types in the workflow: EC2, Lambda, RDS, ECS, ALB, DynamoDB, SQS and API Gateway

Tips for better results

Give the agent the region, account and resource name up front. If several resources match a name, the workflow asks you to choose. The skill also suggests shorter time windows when log queries time out, which helps on busy log groups.

If the agent reports missing logs, check that CloudWatch logging is enabled for that resource type. Without logs, the diagnosis relies only on status and metrics.

• Name the resource type (Lambda, RDS, ECS, ALB, SQS, DynamoDB, API Gateway) to speed up discovery
• Mention the time window when the problem started
• Ask for a shorter time window if log queries time out
• Ask the agent to list the exact IAM actions required if you get permission errors