skilld
All skills
aws avatar

/resilience-hub-getting-started

@7618003
by Amazon Web Servicesaws/agent-toolkit-for-aws2.8k stars
337

Sets up AWS Resilience Hub v2 from scratch: creates resilience policies with SLO targets, registers systems and user journeys, onboards services with input sources, and runs a first failure mode assessment. Applies when the user wants to get started with Resilience Hub v2, create a policy, onboard a service, or run an assessment — including creating one concrete policy with specific availability/RTO/RPO targets and a DR approach for a single service (even a tier-1 one). Does not apply to FIS experiments or ARC routing controls.

Ask your Agent

Use this Skill: https://skilld.dev/gh/aws/agent-toolkit-for-aws/resilience-hub-getting-started

This session only. Nothing lands on disk.

SKILL.md

≈142 tokens always: the name and description. ≈816 when used: this file. ≈3.7k more on demand in 1 file.

Getting Started with AWS Resilience Hub v2

Overview

Domain expertise for first-time Resilience Hub v2 setup: policies, systems, user journeys, services, input sources, and failure mode assessments.

The AWS MCP server is recommended for executing this skill's AWS API calls, but it is not required — all operations also work with the AWS CLI directly.

Guardrail — where this skill's own files live (MCP vs local install)

Before reading a reference file, determine how this skill was loaded:

  • Loaded via the AWS MCP retrieve_skill tool: the skill's reference files are not on the local filesystem. Fetch each one through retrieve_skill with the file parameter (e.g. file="references/setup-procedure.md") — do NOT file_read these paths locally or search the filesystem for them.
  • Installed locally (e.g. .kiro/skills/resilience-hub-getting-started/ or ~/.claude/skills/resilience-hub-getting-started/): read reference files from the local skill directory using the relative paths shown here.

This applies only to the skill's own reference files; always read and write user or session data in the working directory, never through retrieve_skill.

Set up Resilience Hub v2

To configure Resilience Hub v2 from scratch, follow the procedure exactly. See references/setup-procedure.md.

Troubleshooting

Assessment stuck in IN_PROGRESS

Poll with aws resiliencehubv2 list-failure-mode-assessments. If stuck >30 min, check the errorCode field — common causes are INVALID_PERMISSIONS or CMK_ACCESS_DENIED on cross-account roles.

Achievability shows NOT_ACHIEVABLE

Your architecture cannot meet the policy targets. Fix infrastructure before running FIS experiments — testing won't help if the architecture is fundamentally insufficient.

No resources discovered

Verify input sources are correct: CFN stack ARN exists, Terraform state file is accessible, EKS cluster is in the specified regions, or resource tags match actual resources.

Security Considerations

  • Least privilege: scope the invoker role to read-only discovery of only the resource types in your input sources; attach the AWS managed AWSResilienceHubAsssessmentExecutionPolicy (AWS spells it with three s's) or a tighter custom policy.
  • Encryption at rest / in transit: recommend S3 buckets for Terraform state and assessment reports use server-side encryption (SSE-KMS) and a bucket policy enforcing TLS via aws:SecureTransport.
  • Condition keys (confused-deputy): add an aws:SourceAccount (and ideally aws:SourceArn scoped to the specific Resilience Hub service ARN) condition to the invoker role's trust policy so only your account's Resilience Hub can assume it.
  • Limit assessment exposure: restrict who can call start-failure-mode-assessment (it reads infrastructure state) and who can read assessment findings and reports — these can contain sensitive architecture detail.
  • Further reading: see Security in AWS Resilience Hub and IAM Best Practices (including cross-service confused-deputy prevention).

Source: SKILL.md on GitHub

Third-party checks

No alerts2mo3 checks · Risk SAFE
  • Gen Agent Trust Hub2mo

    This skill provides a standard operational procedure for setting up AWS Resilience Hub v2. It follows AWS security best practices, including guidance on least privilege, IAM role management, and resource encryption. No security concerns were identified.

  • Socket2mo

    No alerts

  • Snyk2mo

    Risk: LOW · No issues

Provenance

Signed by skilld at 7618003. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated 2 months ago

Capability

version
1

README badge

README badge for aws/agent-toolkit-for-aws/resilience-hub-getting-started