Hey readers! It is 3 a.m. An alert fires. The on-call engineer opens a dozen tabs, checks recent deployments, scans logs and tries to remember what the runbook said about this exact kind of failure. Now imagine an AI agent that already knows your team’s way of investigating that problem and follows it every time, step by step, with a record of what it did. That’s the idea behind AWS DevOps Agent skills.
This guide explains what they are, how they work, how to create and upload them and how to get real value from them. Since this product is evolving quickly, confirm details in AWS’s official documentation before relying on any specific setting.
A Quick Look at AWS DevOps Agent
AWS DevOps Agent is an AI-powered operations agent focused on incident response, root cause analysis and operational troubleshooting. You set it up inside an Agent Space, the workspace where the agent connects to your environment, and you work with it through the Operator Web App.
On its own, it is a capable general assistant. Skills are what make it yours.
What are AWS DevOps Agent Skills?
AWS DevOps Agent Skills are modular instruction sets that extend the agent with specialized domain knowledge and investigation methods tailored to your infrastructure and operational workflows.
Put simply, a skill is a reusable “how we do things here” package. It might contain:
A step-by-step investigation procedure
Decision trees (if you see X and check Y)
Best practices for a particular AWS service
Instructions for using your custom tools
Skills are self-contained directories of Markdown instructions that give the agent specialized capabilities. They follow the open Agent Skills specification, though AWS DevOps Agent supports a subset of it.
Why Use Skills? The Real Benefits
AWS describes skills as transforming the agent from a general-purpose assistant into a specialist for your infrastructure. In practice, that means:
Consistency. Every investigation follows your team’s proven procedure instead of whatever general reasoning the agent chooses that day.
Less repetition. Unlike one-time instructions typed into a chat message, skills load automatically when they are relevant to a task. You write the workflow once.
Captured expertise. Your senior engineers’ knowledge stops living only in their heads and Slack history.
Better use of custom tools. You can write skills that guide the agent in using your own MCP server tools effectively.
Traceability. When an incident happens, the agent loads the skills that match the scenario, tracks them using AWS APIs and tools, and logs every single step in the Investigation Timeline. So it is easier to review what happened, and why.
How AWS DevOps Agent Skills Work
The flow is straightforward:
You upload skills to your Agent Space
An investigation starts. The agent fetches the list of skills from that Agent Space
The agent selects relevant skills based on the type of task and agent
It responds to instructions through AWS APIs and related tools.
Investigation Timeline records each step.
Multiple skills can be active in one investigation. For example, one skill could retrieve deployments from your custom CI/CD pipeline while another searches your code repositories.
Agent Type Targeting: Keep the Agent Focused
Not every skill belongs everywhere. You can target skills to specific agent types, which AWS lists as Generic, On-demand, Incident Triage, Incident RCA, Incident Mitigation and Evaluation. This reduces context consumption and keeps each agent focused on what matters for its job.
A triage skill might help classify severity, while an RCA skill might dig into dependency chains, so there is no reason to load both everywhere.
Types of Skills You’ll Encounter
Custom Skills
Skills you write or upload yourself for your own workflows, tools and standards.
Built-in and sample skills
AWS DevOps Agent includes or documents skills for tasks such as AWS Health event investigation and AWS Support case analysis. An open-source repository from AWS also provides ready-to-use skills for incident response, root cause analysis and operational reviews, including best-practice assessments for services like EKS and RDS. These are provided as sample code, so review them before using them in production.
Learned skills
These capture what the agent figures out about your environment as it works, including topology, code dependencies, pipeline structure and tool-use patterns. AWS says learned skills are moving to memory, so you will eventually view and manage them on the Memories tab of the knowledge page rather than the Skills tab.
Community-contributed skills
Public GitHub collections offer examples such as Well-Architected reviews and multi-account scenarios. Treat them as starting points, not drop-in solutions.
How to Upload a Skill to AWS DevOps Agent
Here is the general process:
Make sure you have an Agent Space. You need one before you can add skills.
Prepare your skill as a directory of Markdown instructions (plus any supporting files)
Zip it. Community guidance notes that custom skills must be uploaded as a .zip file through the Operator Web App and go to the Skills page.
Upload the zip and choose which agent types should use it.
Review and test it against a realistic scenario.
A few practical limits from a community sample repository: the agent loads Markdown, PDFs, images and data files, and the full zip should stay under about 6 MB. Confirm current limits in the official docs.
Prefer automation? Skills are assets you can create, read, update and delete through the AWS CLI and SDKs using a CreateAsset call with the asset type set to skill. That makes it possible to manage skills in version control and deploy them through your pipeline.
Don't Forget Permissions
A skill can only do what the agent’s role allows. If a skill tells the agent to read CloudWatch logs or describe EKS resources, the DevOps Agent role must have those permissions. The AWS sample repo provides a CloudFormation template with suggested policies. Always apply least privilege and review what you grant.
How to Write a Great DevOps Agent Skill
A skill is only as good as its instructions. Follow these habits:
Start with a real incident. Document what your best engineer actually does, in order.
Keep each skill focused. One scenario per skill beats one giant playbook.
Write for clarity. Use plain steps, expected outputs and decision points.
Name it well. Give your skill a clear name and a description that makes it obvious when it should trigger.
Be explicit about tools. Say which tools or data sources to use and in what order.
Include what ‘not’ to do. Guardrails prevent risky actions.
Add examples. Show a sample finding and what a good conclusion looks like.
Target the right agent types to save context.
Test and iterate. Run the skill against past incidents and compare to what actually happened. Evaluation frameworks for skills exist, such as the open-source Agent Skill Eval referenced in AWS’s tooling.
Version it. Treat skills like code, with reviews and change history.
A simple structure
A skill typically follows this shape:
Name and description: what it does and when to use it
When to use it: triggering conditions
Steps: the ordered investigation or review procedure
Decision guidance: how to interpret what it finds
Output format: how to report results
Safety notes: limits, approvals and things to avoid.
Practical Use Cases
Faster incident triage. Encode how your team categorizes severity and decides who to page.
Root cause analysis. Standard steps for checking deployments, configuration changes, dependencies and recent events.
Service-specific reviews. Best-practice checks on Kubernetes clusters or databases.
Cost and security checks. Repeatable reviews across accounts.
Custom tooling. Teach the agent when and how to call your internal systems.
Onboarding. New engineers can read the same skills the agent follows.
Scheduled health reports. Combine skills with custom agents for recurring summaries.
Skills vs. Custom Agents vs. MCP Servers
These pieces work together but do different jobs:
Component | What it is | Think of it as |
Skills | Instructions and knowledge in Markdown | The playbook |
Custom agents | Configured agent workflows (following the AGENTS.md standard) | The role or job description |
MCP servers | Tools that connect the agent to systems | The hands and tools |
AWS notes you can pair MCP servers with skills that guide the agent on when and how to use the tools. A strong setup often combines all three.
Best Practices for Production
Start small. Roll out one or two high-value skills, not twenty.
Review community skills line by line before enabling them.
Keep sensitive data out of skill files. Don’t hardcode secrets or credentials.
Use least-privilege IAM on the agent role.
Humans-in-the-loop for risky/irreversible actions.
See the Investigation. Timeline to understand how skills affect the agent’s decisions.
Retire outdated skills. Stale runbooks are worse than none.
Measure results. Track time to diagnose and time to resolve before and after.
Common Mistakes to Avoid
Writing vague instructions. "Investigate the problem" teaches nothing.
Cramming everything into one skill. It bloats context and confuses selection.
Skipping permissions. The skill looks fine but fails silently.
Trusting samples blindly. Sample code is a starting point.
Never testing. Replay past incidents before you rely on a skill live.
Forgetting upload rules. Zip structure and size limits can cause failures.
Frequently Asked Questions
What are AWS DevOps Agent skills?
Modular reusable instruction sets that give the agent specialized knowledge and methods of investigation for your infrastructure and workflows.
How do I add a skill?
Open the Operator Web App for your Agent Space, go to the Skills page, and upload your skill as a zip. You can also manage skills through the AWS CLI and SDKs.
Do skills follow a standard?
They follow a subset of the open Agent Skills specification.
Can skills be limited to certain tasks?
Yes. You can also target them to specific agent types such as incident triage or root cause analysis.
What's the difference between custom skills and learned skills?
Custom skills are written by you. Learned skills capture knowledge the agent builds about your environment, and AWS is moving them to the Memories tab.
Are there ready-made skills?
Yes. AWS and the community publish sample skills, but they're sample code. Review and test them before production use.
Do skills replace runbooks?
No. They can encode the logic of a runbook for the agent to follow but human judgment and clear documentation are still important.
Is AWS DevOps Agent only for AWS?
It's built around AWS, and its docs describe integrations with custom tools through MCP servers. Check current documentation for supported integrations