Claude Skill

rds-operation-review

Comprehensive Amazon RDS and Aurora operational review aligned with the

LLM Mart · 0 points · 0 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download aws-tools-for-devops-agent-skills_rds-operation-review-1c971c7.zip · 18 KB

aws/tools-for-devops-agent 82 62 forks Apache-2.0 Updated 1d ago

Part of aws/tools-for-devops-agent — 21 skills

Install

skills CLI npx skills add https://github.com/aws/tools-for-devops-agent/tree/main/skills/rds-operation-review

Claude Code

claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install aws-tools-for-devops-agent@llmmart

Git git clone https://github.com/aws/tools-for-devops-agent.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole aws/tools-for-devops-agent collection as a plugin from our marketplace. Git is the plain clone.

README

RDS Operation Review — AWS DevOps Agent Skill

A comprehensive Amazon RDS and Aurora operational review skill for AWS DevOps Agent. Conducts best-practices assessments aligned with the Amazon RDS Best Practices Guide, the Aurora Best Practices Guide, and the AWS Well-Architected Framework. Generates a shareable report artifact per resource.

What It Does

When activated via Chat, this skill instructs the DevOps Agent to:

Discover RDS instances and Aurora clusters in the configured account/regions.
Collect database configuration, parameter groups, security groups, subnet groups, snapshots, and events.
Collect 7-day historical CloudWatch metrics, RDS log group entries, and 14-day RDS events.
Pull 3-month Cost Explorer data and proportionally estimate per-database monthly cost.
Analyze against five Well-Architected pillars (Security, Reliability, Performance, Cost Optimization, Operational Excellence) plus engine-specific guidance.
Generate a shareable report artifact per resource, named rds-review-<resource>-<YYYY-MM-DD>.md.

All data is gathered through native AWS APIs (rds, cloudwatch, logs, ec2, kms, costexplorer, applicationautoscaling, pi). The skill does not require Kubernetes (k8s), EKS, or Dante MCP servers.

Agent Types

This skill is intended for the following agent types (selected in the Operator Web App at upload time):

On-demand — conversational invocation in Chat ("review my Aurora cluster", "RDS health check").
Evaluation — proactive operational improvement recommendations.

Select Generic instead if you want the skill available to all agent types.

Prerequisites

1. An AWS DevOps Agent Space with the target AWS account

You need an existing Agent Space with the target AWS account configured as a cloud source.

2. IAM permissions for the DevOps Agent's primary cloud-source role

The Agent Space's IAM role must have read access to RDS, Aurora, CloudWatch, Logs, EC2, KMS, and Cost Explorer APIs. The AWS managed policy AWSDevOpsAgent...ReadOnlyAccess (or your custom equivalent) typically covers all of the following — verify in your account before running the review:

rds:Describe*, rds:ListTagsForResource, rds:DownloadDBLogFilePortion
pi:DescribeDimensionKeys, pi:GetResourceMetrics (Performance Insights — only if PI is enabled on the target databases)
cloudwatch:GetMetricData, cloudwatch:GetMetricStatistics, cloudwatch:DescribeAlarms, cloudwatch:DescribeAlarmsForMetric
logs:DescribeLogGroups, logs:DescribeLogStreams, logs:FilterLogEvents, logs:GetLogEvents
ec2:DescribeSecurityGroups, ec2:DescribeSubnets, ec2:DescribeVpcs
kms:DescribeKey, kms:ListAliases
application-autoscaling:DescribeScalableTargets, application-autoscaling:DescribeScalingPolicies
ce:GetCostAndUsage, ce:GetReservationCoverage, ce:GetReservationUtilization
tag:GetResources (optional — for cross-service tag reporting)

The skill operates entirely in read-only mode: it never calls Modify*, Reboot*, Restore*, Create*, or Delete* RDS APIs.

3. Performance Insights (recommended)

For richer query-level analysis, enable Performance Insights on databases you want to review:

RDS console → Modify the instance → Performance Insights → enable (free 7-day retention by default).
Or aws rds modify-db-instance --db-instance-identifier <id> --enable-performance-insights --apply-immediately.

Without Performance Insights, the skill still produces a complete report from CloudWatch metrics, logs, and configuration data — it just won't include db.load.avg and top-SQL breakdowns.

4. CloudWatch Logs export (recommended)

For log-pattern analysis in Step 6, enable CloudWatch Logs export for the engine logs you care about:

MySQL/MariaDB: audit, error, general, slowquery
PostgreSQL: postgresql, upgrade
Oracle: alert, audit, listener, trace
SQL Server: agent, error

RDS console → Modify the instance → Log exports → select log types. The skill reports "log exports disabled" as a finding when this is missing, but cannot retrieve historical log events without it.

5. (Conditional) Network reachability for databases in private VPCs

The rds, cloudwatch, logs, and other AWS APIs the skill calls are regional control-plane APIs — they're reached over the public AWS API endpoints regardless of whether the database itself sits in a private VPC. There is no need for a private connection to run the operational review against a database with a private endpoint, because the skill only reads metadata via control-plane APIs (it never connects to the database engine on port 3306 / 5432 / 1521 / 1433).

If your account requires all AWS API traffic to traverse VPC endpoints (org-level guardrail), ensure the following interface VPC endpoints are reachable from the agent's source path: com.amazonaws.<region>.rds, com.amazonaws.<region>.monitoring (CloudWatch), com.amazonaws.<region>.logs, com.amazonaws.<region>.ec2, com.amazonaws.<region>.kms. Cost Explorer is global (ce.us-east-1.amazonaws.com) and does not have a VPC endpoint.

If you separately want the agent to execute SQL inside a private database (out of scope for this skill — but a related capability), use the DevOps Agent private connection mechanism with an MCP server that fronts the database.

Uploading to AWS DevOps Agent

Reference: Uploading a skill

1. Package the skill

From the skills/ directory in this repo:

cd skills
zip -r rds-operation-review.zip rds-operation-review/ -x 'rds-operation-review/evals/*'

The resulting rds-operation-review.zip contains:

rds-operation-review/
├── SKILL.md          # frontmatter + skill instructions (required)
└── references/
    ├── best-practices-checklist.md
    └── metrics-thresholds.md

evals/ is excluded from the upload to keep the zip small (it's only used for offline evaluation).

Constraints (enforced at upload time):

Total zip size ≤ 6 MB.
SKILL.md is required and must include name and description frontmatter.
A scripts/ directory is not allowed — uploads containing scripts are rejected.

2. Upload via the Operator Web App

Navigate to the Skills page in your Agent Space Operator Web App.
Click Add skill → Upload skill.
Drag and drop rds-operation-review.zip (or browse to it).
Select agent types: On-demand and Evaluation (or leave Generic to make it available to all agent types).
Review the validation results.
Click Upload.

3. (Optional) Connect additional observability sources

For richer analysis, connect your observability tools to the Agent Space:

Tool	Setup Guide
CloudWatch	Built-in (no setup needed)
Datadog	Connecting Datadog
Dynatrace	Connecting Dynatrace
New Relic	Connecting New Relic
Splunk	Connecting Splunk
Grafana	Connecting Grafana
Custom MCP	Connecting MCP Servers

Usage

In the DevOps Agent Chat, use natural language:

"Run an RDS operational review for all databases."
"Review my Aurora cluster prod-aurora in us-east-1 for best practices."
"Audit RDS security and cost optimization across all regions."
"Generate an RDS best-practices report for instance analytics-pg."
"ORR for our production databases."

The agent will:

Collect all data automatically (no prompts for confirmation).
Use only AWS APIs — no Kubernetes or external scripts.
Generate a report artifact per resource, named rds-review-<resource-name>-<YYYY-MM-DD>.md.

Skill Contents

rds-operation-review/
├── SKILL.md                           # main skill instructions (with frontmatter)
├── README.md                          # this file
├── references/
│   ├── best-practices-checklist.md    # checklist mapped to RDS / Aurora best practices
│   └── metrics-thresholds.md          # CloudWatch metric thresholds & severity rules
└── evals/                             # evaluation data (not included in upload zip)

Best-Practices Sections Covered

#	Pillar	Reference
1	Security (Network, Encryption, IAM auth, Audit logging)	RDS security, Encryption
2	Reliability (Multi-AZ, Backups, DR, Replication)	Multi-AZ, Aurora Global Database
3	Performance (CPU, Memory, IOPS, PI, Connection mgmt)	Monitoring RDS, Performance Insights
4	Cost Optimization (RIs, gp3, Graviton, idle DBs)	Cost-optimized RDS
5	Operational Excellence (Alarms, Events, Maintenance, Tagging)	RDS events, Well-Architected Operational Excellence
Engine-specific	MySQL / PostgreSQL / Oracle / SQL Server / Aurora tuning	linked in SKILL.md

Severity Definitions

Severity	Definition	SLA
CRITICAL	Immediate risk to availability, security, or data integrity	24–48 hours
HIGH	Significant gap that could lead to incidents	1 week
MEDIUM	Notable improvement opportunity	30 days
LOW	Minor optimization or hardening	When convenient
INFO	Observation, no action required	N/A

Skill manifest

RDS / Aurora Operational Review

Conduct a comprehensive operational review of Amazon RDS instances and Amazon Aurora clusters aligned with the AWS Well-Architected Framework and the Amazon RDS and Aurora best-practices guides.

This skill uses the AWS RDS, Aurora, CloudWatch, CloudWatch Logs, EC2, and Cost Explorer APIs only — no Kubernetes (k8s) or eks MCP tools. All data is collected through native AWS APIs available to the DevOps Agent's primary cloud source role.

When to Use

Activate this skill when the user asks to:

Review, audit, or assess RDS instances or Aurora clusters
Check RDS / Aurora best-practices compliance
Evaluate database security, cost, reliability, performance, or backups
Perform an RDS / Aurora operational readiness review (ORR)
Investigate database health or configuration drift

Step 1: Identify Target Resources

Ask the user which databases to review. Accept:

Specific instance / cluster identifiers and regions
"all instances" / "all clusters" in specific regions
"all RDS in all regions"

If no scope is given, default to all configured account regions.

Step 2: Discover RDS / Aurora Resources

Per region (skip empty regions):

rds.DescribeDBInstances           # RDS instances + Aurora cluster member instances
rds.DescribeDBClusters            # Aurora clusters (skip if user said "Provisioned only")
rds.DescribeDBClusterEndpoints    # Aurora reader/writer endpoints
rds.DescribeGlobalClusters        # Aurora Global Database (cross-region)
rds.DescribeDBProxies             # RDS Proxy

Capture per resource:

Engine, engineVersion, dbInstanceClass / serverlessV2 capacity
Multi-AZ, AvailabilityZones, subnetGroup, VpcId
AllocatedStorage, MaxAllocatedStorage, StorageType, Iops, StorageThroughput, StorageEncrypted, KmsKeyId
BackupRetentionPeriod, PreferredBackupWindow, PreferredMaintenanceWindow, AutoMinorVersionUpgrade
DeletionProtection, PubliclyAccessible, IAMDatabaseAuthenticationEnabled
PerformanceInsightsEnabled, PerformanceInsightsRetentionPeriod, MonitoringInterval (Enhanced Monitoring), MonitoringRoleArn
EnabledCloudwatchLogsExports, AssociatedRoles
ReadReplicaSourceDBInstanceIdentifier / ReadReplicaDBInstanceIdentifiers
Tags (rds.ListTagsForResource — param name is ResourceName and value is the resource ARN)

Step 3: Discover Configuration Dependencies

For each database, collect:

rds.DescribeDBParameterGroups           # custom vs default
rds.DescribeDBClusterParameterGroups    # Aurora
rds.DescribeOptionGroups                # RDS option groups
rds.DescribeDBSubnetGroups              # subnet AZ spread
ec2.DescribeSecurityGroups              # vpcSecurityGroupIds → ingress rules
kms.DescribeKey                         # for KmsKeyId (encryption at rest)

Step 4: Collect Backups, Snapshots, Maintenance

rds.DescribeDBSnapshots                            # manual + automated, per instance
rds.DescribeDBClusterSnapshots                     # Aurora
rds.DescribeDBInstanceAutomatedBackups
rds.DescribeDBClusterAutomatedBackups
rds.DescribeDBEngineVersions                       # current vs latest minor/major
rds.DescribePendingMaintenanceActions
rds.DescribeEvents                                 # last 14 days; duration in MINUTES (20160)
rds.DescribeEventSubscriptions

For each instance/cluster, also fetch:

rds.DescribeDBLogFiles — list of logs available locally on the DB
logs.DescribeLogGroups with prefix:
- Instances: /aws/rds/instance/<dbInstanceIdentifier>/
- Aurora: /aws/rds/cluster/<dbClusterIdentifier>/

Step 5: Collect CloudWatch Metrics (7-Day Historical)

One cloudwatch.GetMetricData call per resource. Period: 21600 (6 hours). StartTime: 7 days ago. EndTime: now.

5.1 RDS Instances (dimension `DBInstanceIdentifier`)

id	metricName	stat	unit
`cpu`	CPUUtilization	Average	%
`freeMem`	FreeableMemory	Minimum	bytes
`freeSpace`	FreeStorageSpace	Minimum	bytes
`readIops`	ReadIOPS	Average	count/s
`writeIops`	WriteIOPS	Average	count/s
`readLat`	ReadLatency	Average	s
`writeLat`	WriteLatency	Average	s
`dbConn`	DatabaseConnections	Maximum	count
`swap`	SwapUsage	Average	bytes
`netIn`	NetworkReceiveThroughput	Average	bytes/s
`netOut`	NetworkTransmitThroughput	Average	bytes/s
`binLog`	BinLogDiskUsage	Average	bytes
`replLag`	ReplicaLag	Maximum	s

5.2 Aurora Clusters (dimension `DBClusterIdentifier`)

id	metricName	stat	unit
`cpu`	CPUUtilization	Average	%
`freeMem`	FreeableMemory	Minimum	bytes
`dbConn`	DatabaseConnections	Maximum	count
`replLag`	AuroraReplicaLag	Maximum	ms
`bufCache`	BufferCacheHitRatio	Average	%
`commitLat`	CommitLatency	Average	ms
`readLat`	ReadLatency	Average	s
`writeLat`	WriteLatency	Average	s
`volReadIops`	VolumeReadIOPs	Sum	count
`volWriteIops`	VolumeWriteIOPs	Sum	count
`serverlessAcu`	ServerlessDatabaseCapacity	Average	ACU

5.3 Per-Instance Aurora Members

Same instance metrics as 5.1, dimensioned by DBInstanceIdentifier of each cluster member.

Fetch cloudwatch.DescribeAlarmsForMetric for the key metrics (CPUUtilization, FreeStorageSpace, DatabaseConnections, ReadLatency, WriteLatency, ReplicaLag / AuroraReplicaLag) per resource so the report can flag missing alarms.

Step 6: Collect Logs (7-Day)

Per database log group, scan with logs.FilterLogEvents for:

Pattern	What it indicates
`ERROR` / `FATAL`	engine errors
`Out of memory` / `OOM`	memory pressure
`connection limit exceeded` / `too many connections`	connection saturation
`deadlock` / `lock wait timeout`	contention
`slow query` / `duration:` (Postgres slow log)	query performance
`aborted connection` (MySQL)	client/network issues
`replication has stopped` / `IO_THREAD` errors	replication health
`checkpoint` warnings / `archiver failed`	I/O / WAL issues
`failed to connect` / `authentication failed`	auth/network

Record occurrence counts per pattern over the 7-day window.

Step 7: Collect CloudTrail-Visible RDS Events

Use rds.DescribeEvents (last 14 days) per resource — covers the same operational signal as CloudTrail for RDS without an extra API permission. Look for: failover, restart, parameter group apply, out-of-memory, storage-full, low-storage, automated-backup-failed, maintenance-related events, read replica error, instance stopped.

Step 8: Cost Data

Once per review (not per resource):

costexplorer.GetCostAndUsage     # 3 months, by USAGE_TYPE,
                                 # filter Service = "Amazon Relational Database Service"
rds.DescribeReservedDBInstances  # RI inventory

Estimate per-database monthly cost as a proportional split of the latest month total (Cost Explorer doesn't break down per DB):

Get the most recent full month total RDS spend.
Per resource, weight by vCPUs(instance class) × (Multi-AZ ? 2 : 1) + allocatedStorageGB.
For Aurora clusters, sum across cluster member instances; storage is cluster-shared.
Note the estimate in the report with an "estimated" badge.

Step 9: Analyze Against Best Practices

Evaluate ALL collected data across the five Well-Architected pillars and assign a severity to every finding: CRITICAL, HIGH, MEDIUM, LOW, or INFO.

9.1 Security

Ref: Security in Amazon RDS

Network exposure: PubliclyAccessible=true → CRITICAL for production. Security groups with 0.0.0.0/0 ingress on the DB port → CRITICAL.
Encryption at rest: StorageEncrypted=false → HIGH (or CRITICAL for regulated workloads). Customer-managed KMS key preferred over AWS-managed.
Encryption in transit: parameter rds.force_ssl=1 (Postgres) / require_secure_transport=ON (MySQL/MariaDB) → MEDIUM if not set.
IAM auth: IAMDatabaseAuthenticationEnabled=false → MEDIUM. Master password in app code instead of Secrets Manager → HIGH.
Secrets Manager rotation: not enabled → MEDIUM.
Audit logging: engine audit logs not in EnabledCloudwatchLogsExports → MEDIUM (HIGH for PCI/HIPAA scope).
CMK rotation: KMS key without automatic rotation → LOW.

9.2 Reliability

Ref: High Availability for Amazon RDS

Multi-AZ: production single-AZ → HIGH (Aurora: ≥1 reader in a different AZ).
Subnet group AZ spread: subnets span <2 AZs → HIGH.
Backups: BackupRetentionPeriod=0 → CRITICAL. <7 days for production → HIGH.
Deletion protection: production with DeletionProtection=false → HIGH.
Auto minor version upgrade: AutoMinorVersionUpgrade=false for non-prod → MEDIUM.
Custom parameter group: instance using default.<engine> parameter group → MEDIUM (can't tune).
Pending maintenance: required actions not applied within window → MEDIUM, escalating with age.
Replication health (read replicas): ReplicaLag 7-day max > 30s → HIGH; > 300s → CRITICAL.
Aurora replicas: clusters with no reader → MEDIUM; single-AZ readers → MEDIUM.
DR: cross-region read replica or Aurora Global Database absent for tier-1 workloads → MEDIUM.

9.3 Performance

Ref: DB Instance Performance

7-day metric thresholds (full table in references/metrics-thresholds.md):

CPUUtilization avg > 70% → MEDIUM, > 90% → HIGH.
FreeStorageSpace < 20% allocated → HIGH, < 10% → CRITICAL.
FreeableMemory < 10% instance class memory → HIGH; sustained SwapUsage > 0 → MEDIUM.
DatabaseConnections max > 80% of max_connections parameter → HIGH.
ReadLatency / WriteLatency avg > 20ms (10ms for io1/io2) → MEDIUM.
BufferCacheHitRatio (Aurora) < 95% → MEDIUM, < 90% → HIGH.
BinLogDiskUsage growth without retention bounds → MEDIUM.
Performance Insights disabled → MEDIUM (free 7-day tier should always be on).
Enhanced Monitoring disabled or interval > 60s for production → MEDIUM.
Connection pooling: high connection churn / no RDS Proxy → MEDIUM for serverless / many-client workloads.

9.4 Cost Optimization

Ref: Cost-Optimized Architectures

Stopped instances: DBInstanceStatus=stopped (still pays storage) → HIGH.
Previous-generation classes: db.m4 / db.r4 / db.t2 → MEDIUM.
gp2 → gp3: any StorageType=gp2 → MEDIUM (≈20% cheaper, equal/better performance).
Over-provisioned IOPS: io1/io2 with avg IOPS used / IOPS provisioned < 50% → MEDIUM.
Reserved Instance coverage: production On-Demand without RIs → MEDIUM, with estimated savings.
Storage autoscaling: MaxAllocatedStorage not set → LOW, increases stockout risk.
Idle databases: DatabaseConnections 7-day max < 5 + CPUUtilization 7-day avg < 5% → MEDIUM (candidate to stop / delete).
Manual snapshots: many > 90 days old → LOW (review retention).
Cost-allocation tags: missing Environment, Owner, CostCenter → LOW.
Graviton migration: x86 (db.r5, db.m5, db.t3) where Graviton is supported → MEDIUM (~20% saving).

9.5 Operational Excellence

Ref: Monitoring Amazon RDS

CloudWatch alarms: missing alarms on CPUUtilization, FreeStorageSpace, DatabaseConnections, FreeableMemory, ReplicaLag → MEDIUM each.
Event subscriptions: no rds.DescribeEventSubscriptions covering this resource → MEDIUM.
Engine version currency: minor version not latest available → LOW; major version EOL/within 6 months → HIGH.
Log exports: engine error / slow / audit logs not exported to CloudWatch → MEDIUM.
Maintenance window: not configured / overlaps business hours → LOW.
Tagging: missing operational tags (Environment, Owner, Runbook, OnCall) → LOW.
Drift: parameters changed in default parameter group (impossible by design — use as a flag for non-default usage check).

Step 10: Generate Report

Generate a separate shareable report artifact for each resource reviewed.

Artifact naming: rds-review-<resource-name>-<YYYY-MM-DD>.md Example: rds-review-prod-aurora-2026-04-29.md

For each resource, create the artifact as a Markdown document with:

Report Header

# RDS / Aurora Operational Review — <resource-name>
Account: <account-id> | Region: <region> | Date: <YYYY-MM-DD>
Engine: <engine> <engineVersion> | Class: <dbInstanceClass / serverlessV2 ACU> | Multi-AZ: <yes/no>

Executive Summary

Health: ✅ HEALTHY / ⚠️ WARNINGS / ❌ CRITICAL
Finding counts by severity
Top 3 critical/high items

Configuration Snapshot

Findings by Pillar

For each of Security, Reliability, Performance, Cost, Operational Excellence:

CloudWatch Metrics (7-Day)

Log Pattern Analysis (7-Day)

RDS Events (14-Day)

Notable events (failovers, restarts, low-storage, OOM, maintenance) with timestamps.

Pending Maintenance

List from rds.DescribePendingMaintenanceActions with action type, target window, age.

Engine Version

Current vs latest minor / latest major. Flag EOL.

Cost Summary

Latest-month estimated cost for this resource (proportional split, with "estimated" badge)
RI coverage status
Top 3 cost-optimization opportunities (linked to findings)

Priority Matrix

Next Steps

Immediate (CRITICAL/HIGH — 7 days)
Short-term (MEDIUM — 30 days)
Long-term (LOW — 90 days)

Appendix — Reference Links

Severity Definitions

Severity	Definition	SLA
CRITICAL	Immediate risk to availability, security, or data integrity	Fix within 24–48 hours
HIGH	Significant gap that could lead to incidents	Fix within 1 week
MEDIUM	Notable improvement opportunity	Plan within 30 days
LOW	Minor optimization or hardening	Address when convenient
INFO	Observation, no action required	N/A

Engine-Specific Considerations

MySQL / MariaDB — innodb_buffer_pool_size, max_connections, slow query log, binlog retention, deprecated query_cache_type on 8.0+.
PostgreSQL — shared_buffers, work_mem, autovacuum, pg_stat_statements, log_min_duration_statement, replication slots.
Oracle — BYOL tracking, SGA/PGA sizing, AWR, tablespace autoextend.
SQL Server — tempdb file count (1 per vCPU up to 8), MAXDOP, cost threshold for parallelism, Always On AGs vs Multi-AZ.
Aurora — Serverless v2 ACU floor/ceiling, Global Database for DR, fast clones, Backtrack (MySQL only), cluster cache management.

Known API Quirks (recorded so the agent doesn't trip on them)

rds.ListTagsForResource — parameter is ResourceName, value is the resource ARN.
rds.DescribeEvents — Duration is in minutes (20160 = 14 days).
applicationautoscaling.DescribeScalableTargets — ServiceNamespace="rds" covers Aurora replica autoscaling.
logs.DescribeLogGroups prefix differs:
- Instances: /aws/rds/instance/<id>/
- Aurora clusters: /aws/rds/cluster/<id>/
Some Aurora metrics are cluster-only (AuroraReplicaLag, BufferCacheHitRatio, VolumeReadIOPs), others are instance-only (FreeableMemory, CPUUtilization per member). Query the right dimension or both.
rds.DescribeDBSnapshots requires pagination for accounts with many snapshots — use MaxRecords and Marker.

Data Source Boundaries

This skill explicitly does not call:

Kubernetes API / k8s MCP — RDS is fully managed; no cluster API exists.
eks MCP — outside scope.
Dante or any non-AWS scripts — keep the skill self-contained on the AWS DevOps Agent's primary cloud-source IAM role.

If a customer needs deeper SQL-level analysis (e.g. Performance Insights db.load breakdowns, top SQL by wait event), call pi.GetResourceMetrics and pi.DescribeDimensionKeys directly — both are in the same rds permission family when Performance Insights is enabled.

Files (tools-for-devops-agent)

evals

files

database-context.json 141 B

{
  "databases": [
    { "type": "instance", "name": "demo-mysql", "engine": "mysql", "region": "us-east-1", "account": "$accountId" }
  ]
}

evals.json 3.2 KB

[
  {
    "id": "rds-review-smoke-test",
    "prompt": "Read database-context.json. List each database's name, type (instance or cluster), engine, region, and account. No analysis needed.",
    "expected_output": "Lists every database from files/database-context.json with its name, type, engine, region, and account exactly as defined in the file.",
    "files": ["files/database-context.json"],
    "assertions": [
      "matches regex /[a-z]{2}-[a-z]+-\\d/",
      "matches regex /\\b\\d{12}\\b/",
      "contains 'engine'",
      "contains 'region'",
      "contains 'account'"
    ]
  },
  {
    "id": "rds-review-first-resource-identification",
    "prompt": "Read database-context.json. Identify the FIRST database listed and state the report artifact filename you would generate for it (use today's date in YYYY-MM-DD form). Do not run the audit.",
    "expected_output": "Identifies the first database from files/database-context.json (its name and region) and proposes an artifact name of the form rds-review-<that-resource-name>-<YYYY-MM-DD>.md.",
    "files": ["files/database-context.json"],
    "assertions": [
      "matches regex /rds-review-[a-z0-9-]+-\\d{4}-\\d{2}-\\d{2}\\.md/",
      "matches regex /[a-z]{2}-[a-z]+-\\d/"
    ]
  },
  {
    "id": "rds-review-data-source-priority",
    "prompt": "According to the skill, which AWS APIs does the RDS operational review use to collect data? Name at least three specific API calls or namespaces the skill mentions. Confirm whether the skill uses Kubernetes (k8s) or EKS APIs. No database access required.",
    "expected_output": "States the skill uses RDS, CloudWatch, CloudWatch Logs (and related AWS APIs like EC2, KMS, Cost Explorer) and explicitly does NOT use Kubernetes or EKS APIs. Names specific calls such as rds.DescribeDBInstances, rds.DescribeDBClusters, cloudwatch.GetMetricData, or logs.FilterLogEvents.",
    "files": [],
    "assertions": [
      "contains 'RDS' or contains 'rds'",
      "contains 'CloudWatch' or contains 'cloudwatch'",
      "contains 'DescribeDBInstances' or contains 'DescribeDBClusters' or contains 'GetMetricData' or contains 'FilterLogEvents'",
      "contains 'not' or contains 'no '"
    ]
  },
  {
    "id": "rds-review-severity-definitions",
    "prompt": "List the five severity levels the skill uses for findings, in order from most to least urgent. No database access required.",
    "expected_output": "Lists CRITICAL, HIGH, MEDIUM, LOW, INFO in that order.",
    "files": [],
    "assertions": [
      "contains 'CRITICAL'",
      "contains 'HIGH'",
      "contains 'MEDIUM'",
      "contains 'LOW'",
      "contains 'INFO'"
    ]
  },
  {
    "id": "rds-review-pillars",
    "prompt": "List the Well-Architected pillars the skill evaluates during an RDS / Aurora operational review. No database access required.",
    "expected_output": "Mentions Security, Reliability, Performance, Cost Optimization, and Operational Excellence.",
    "files": [],
    "assertions": [
      "contains 'Security' or contains 'security'",
      "contains 'Reliability' or contains 'reliability'",
      "contains 'Performance' or contains 'performance'",
      "contains 'Cost' or contains 'cost'",
      "contains 'Operational' or contains 'operational'"
    ]
  }
]

eval_queries.json 716 B

[
  {"query": "Which skill would help me run an RDS operational review? Just name it; do not run it.", "should_trigger": true},
  {"query": "Is there a skill available for auditing Aurora clusters against best practices? Answer yes or no with the skill name; do not execute it.", "should_trigger": true},
  {"query": "Name the skill that covers RDS security and cost optimization reviews. Do not run any audit.", "should_trigger": true},
  {"query": "Write a Python script that sorts a list of numbers", "should_trigger": false},
  {"query": "What's the weather forecast for Sydney this weekend?", "should_trigger": false},
  {"query": "Create a CloudFormation template for an S3 bucket", "should_trigger": false}
]

references

best-practices-checklist.md 5.6 KB

# RDS / Aurora Best Practices Checklist

Organized by AWS Well-Architected pillar. Maps directly to the checks in `SKILL.md` Step 9.

## Security

- [ ] Database **not publicly accessible** (`PubliclyAccessible=false`)
- [ ] Database security group ingress **scoped to application SGs** (no `0.0.0.0/0` on the DB port)
- [ ] **Encryption at rest** enabled (`StorageEncrypted=true`); customer-managed KMS key preferred
- [ ] **KMS key rotation** enabled
- [ ] **Encryption in transit** enforced (`rds.force_ssl=1` for Postgres, `require_secure_transport=ON` for MySQL/MariaDB)
- [ ] **IAM database authentication** enabled where supported
- [ ] **Master credentials** stored in AWS Secrets Manager with automatic rotation (not hard-coded)
- [ ] Engine **audit logs** exported to CloudWatch (PCI/HIPAA: required)
- [ ] **CloudTrail** enabled for RDS API activity
- [ ] No use of the **default master username** for runtime access (per-app users)
- [ ] **VPC endpoint** for RDS API used in restricted-egress accounts

## Reliability

- [ ] **Multi-AZ** enabled for all production databases (Aurora: ≥1 reader in a different AZ)
- [ ] DB **subnet group spans ≥2 AZs** (≥3 for tier-1)
- [ ] **Automated backups** enabled with retention ≥7 days (35 days for production)
- [ ] **Deletion protection** enabled for production
- [ ] **Final snapshot** policy set on deletion
- [ ] **Custom parameter group** (not `default.<engine>`) — required to tune anything
- [ ] **Pending maintenance actions** applied within window
- [ ] Read-replica `ReplicaLag` 7-day max < 30s
- [ ] **Cross-region** read replica or **Aurora Global Database** for tier-1 DR
- [ ] **Failover tested** at least quarterly
- [ ] RTO / RPO documented for each database tier

## Performance

- [ ] **Performance Insights** enabled (free 7-day tier)
- [ ] **Enhanced Monitoring** enabled, interval ≤60s for production
- [ ] CPU 7-day average < 70%
- [ ] FreeStorageSpace ≥20% of allocated
- [ ] FreeableMemory ≥10% of instance class memory; `SwapUsage` near 0
- [ ] DatabaseConnections 7-day max < 80% of `max_connections`
- [ ] ReadLatency / WriteLatency < 20ms (< 10ms for io1/io2)
- [ ] Aurora `BufferCacheHitRatio` > 95%
- [ ] **RDS Proxy / connection pooling** in place for serverless or many-client workloads
- [ ] Storage type sized correctly (gp3 default; io1/io2 only for >16k sustained IOPS)
- [ ] Slow query log enabled and reviewed (`long_query_time=1`, `log_min_duration_statement=1000`)
- [ ] Indexes reviewed; N+1 query patterns eliminated

## Cost Optimization

- [ ] No **stopped instances** still incurring storage cost (delete or convert to final snapshot)
- [ ] No **previous-gen instance classes** (`db.m4`, `db.r4`, `db.t2`) in production
- [ ] **gp2 → gp3** migration for general-purpose storage
- [ ] **Provisioned IOPS** (io1/io2) actually utilized > 50% — otherwise downsize or move to gp3
- [ ] **Reserved Instances** for steady-state production (1-year No Upfront baseline)
- [ ] **Storage autoscaling** enabled with sensible `MaxAllocatedStorage`
- [ ] Idle databases identified (low connections + low CPU) and stopped/deleted
- [ ] Manual snapshots cleaned up (delete those >90 days old unless retention policy says otherwise)
- [ ] **Graviton** (`db.r6g`, `db.m6g`, `db.t4g`) used where the engine supports it
- [ ] **Cost-allocation tags** applied: `Environment`, `Owner`, `CostCenter`, `Application`
- [ ] **Cost Anomaly Detection** enabled for RDS

## Operational Excellence

- [ ] CloudWatch alarms on: `CPUUtilization`, `FreeStorageSpace`, `DatabaseConnections`, `FreeableMemory`, `ReplicaLag` / `AuroraReplicaLag`, `WriteLatency`, `ReadLatency`
- [ ] **RDS event subscription** in place, routing to SNS / chat / ticketing
- [ ] **CloudWatch Logs export** enabled for engine logs (error, slow query, audit, general)
- [ ] **AutoMinorVersionUpgrade=true** for non-production
- [ ] **Maintenance window** configured outside business hours
- [ ] Engine version is the **latest minor** within current major; major version not within 6 months of EOL
- [ ] **Operational tags** present: `Environment`, `Owner`, `Runbook`, `OnCall`
- [ ] AWS Config rules detect parameter / configuration drift
- [ ] DR / failover **runbooks** documented and linked from tags

## Engine-Specific (spot checks)

### MySQL / MariaDB

- [ ] `innodb_buffer_pool_size` ≈ 75% of memory
- [ ] `max_connections` sized to instance class
- [ ] `query_cache_type=OFF` on MySQL 8+
- [ ] Slow query log: `long_query_time=1`, `slow_query_log=1`
- [ ] Binlog retention bounded (`binlog_expire_logs_seconds`)

### PostgreSQL

- [ ] `shared_buffers` ≈ 25% of memory
- [ ] `effective_cache_size` ≈ 75% of memory
- [ ] `work_mem` 4–64 MB
- [ ] Autovacuum tuned for write-heavy tables (per-table thresholds)
- [ ] `pg_stat_statements` enabled
- [ ] `log_min_duration_statement` ≥ 1000 ms

### Oracle

- [ ] BYOL vs. License Included clear in tags
- [ ] SGA/PGA sized for workload
- [ ] AWR snapshots retained
- [ ] Tablespace autoextend on with sane MAXSIZE

### SQL Server

- [ ] Tempdb: 1 file per vCPU, up to 8
- [ ] MAXDOP set to vCPU count
- [ ] Cost threshold for parallelism = 50
- [ ] Always On AG vs. Multi-AZ choice documented
- [ ] Index maintenance jobs scheduled

### Aurora

- [ ] Cluster has ≥1 reader (≥2 for tier-1)
- [ ] Reader auto-scaling policy in place where read traffic varies
- [ ] **Aurora Global Database** for cross-region DR (tier-1)
- [ ] Backtrack window sized appropriately (Aurora MySQL only)
- [ ] **Serverless v2**: ACU floor set high enough to avoid cold-start; ceiling caps spend
- [ ] Cluster cache management enabled for failover-sensitive workloads (Aurora PG)

metrics-thresholds.md 6.3 KB

# RDS / Aurora CloudWatch Metrics Thresholds Reference

All metrics retrieved via a single `cloudwatch.GetMetricData` call per resource over a 7-day window with `Period=21600` (6h). Severity reflects sustained values, not single spikes.

## RDS Instance Metrics (Namespace: `AWS/RDS`, Dimension: `DBInstanceIdentifier`)

| Metric | Stat | Normal | Warning | Critical | Finding |
|---|---|---|---|---|---|
| CPUUtilization | Average | < 60% | > 70% | > 90% | Right-size instance class or add a read replica |
| CPUUtilization | Maximum | < 80% | > 90% sustained | 100% sustained | CPU saturation under peak |
| FreeableMemory | Minimum | > 20% of class memory | < 10% of class memory | < 5% of class memory | Memory pressure — upgrade class or tune buffer pool |
| SwapUsage | Average | 0 | > 0 sustained | > 100 MB sustained | Memory undersized — upgrade |
| FreeStorageSpace | Minimum | > 20% allocated | < 20% allocated | < 10% allocated | Increase storage / enable autoscaling |
| ReadIOPS | Average | < 70% provisioned (io1/io2) | > 80% provisioned | > 95% provisioned | Storage I/O saturation |
| WriteIOPS | Average | < 70% provisioned | > 80% provisioned | > 95% provisioned | Storage I/O saturation |
| ReadLatency | Average | < 5 ms | > 10 ms | > 20 ms (gp3) / > 10 ms (io1/io2) | Slow reads — check IOPS, working set fit |
| WriteLatency | Average | < 5 ms | > 10 ms | > 20 ms | Slow writes — check IOPS, sync settings |
| DatabaseConnections | Maximum | < 60% of `max_connections` | > 80% | > 95% | Connection saturation — add pooling (RDS Proxy) |
| ReplicaLag | Maximum | < 10 s | > 30 s | > 300 s | Replica falling behind — investigate write rate, replica class |
| BinLogDiskUsage | Average | bounded | unbounded growth | rapid growth | Tighten `binlog_expire_logs_seconds` |
| NetworkReceiveThroughput | Average | < 80% of class bandwidth | > 80% | > 95% | Network saturation |
| NetworkTransmitThroughput | Average | < 80% of class bandwidth | > 80% | > 95% | Network saturation |
| DiskQueueDepth | Average | < 5 | > 10 | > 30 | I/O queueing — increase IOPS |

## Aurora Cluster Metrics (Namespace: `AWS/RDS`, Dimension: `DBClusterIdentifier`)

| Metric | Stat | Normal | Warning | Critical | Finding |
|---|---|---|---|---|---|
| CPUUtilization | Average | < 60% | > 70% | > 90% | Scale instance class or add reader |
| FreeableMemory | Minimum | > 20% | < 10% | < 5% | Memory pressure |
| DatabaseConnections | Maximum | < 60% | > 80% | > 95% | Add RDS Proxy / pooling |
| AuroraReplicaLag | Maximum | < 50 ms | > 100 ms | > 1000 ms | Replica lag — check writer load |
| BufferCacheHitRatio | Average | > 99% | < 95% | < 90% | Working set doesn't fit — bigger class |
| CommitLatency | Average | < 10 ms | > 20 ms | > 50 ms | Write path latency |
| ReadLatency | Average | < 5 ms | > 10 ms | > 20 ms | Slow reads |
| WriteLatency | Average | < 5 ms | > 10 ms | > 20 ms | Slow writes |
| VolumeReadIOPs | Sum | — | — | sustained spike | Investigate query plan / hot rows |
| VolumeWriteIOPs | Sum | — | — | sustained spike | Investigate write amplification |
| ServerlessDatabaseCapacity (v2) | Average | within configured min/max | hitting `max` | sustained at `max` | Raise ACU ceiling or move to provisioned |
| Deadlocks | Sum | 0 | > 0 sustained | > 100 / hour | Transaction/lock review |

## Aurora Global Database

| Metric | Stat | Warning | Critical | Finding |
|---|---|---|---|---|
| AuroraGlobalDBReplicationLag | Maximum | > 1 s | > 5 s | Cross-region lag — investigate writer region load |
| AuroraGlobalDBRPOLag | Maximum | > 1 s | > 5 s | RPO violation risk |

## Performance Insights (when enabled)

| Metric | Source | Warning | Finding |
|---|---|---|---|
| `db.load.avg` | `pi.GetResourceMetrics` | > vCPU count sustained | DB at or above CPU capacity |
| `db.load.avg` (per `db.wait_event`) | top wait event | dominant wait type | targets tuning area (CPU, IO, Lock, Network) |
| `db.SQL.total_call_count` | top SQL | top 5 statements | inputs for query optimization review |

## Log Pattern Severity (CloudWatch Logs `FilterLogEvents` over 7 days)

| Pattern (case-insensitive) | Severity if found | Action |
|---|---|---|
| `out of memory` / `OOM` | HIGH | Increase memory / tune buffer pool |
| `too many connections` / `connection limit exceeded` | HIGH | Pooling, raise `max_connections` |
| `replication has stopped` / replication thread errors | HIGH | Investigate replica / network |
| `archiver failed` (Postgres WAL) | HIGH | WAL archive / disk pressure |
| `deadlock detected` / `lock wait timeout` | MEDIUM | Transaction / index review |
| `aborted connection` (MySQL) | MEDIUM | Network / client / `wait_timeout` |
| `slow query` / `duration: ` (Postgres) > 1s | MEDIUM | Query optimization |
| `authentication failed` repeated | MEDIUM | Possible credential issue / attack surface |
| `checkpoint too frequent` (Postgres) | MEDIUM | Tune `checkpoint_timeout`, `max_wal_size` |
| Generic `ERROR` > 100 / 7 days | LOW | Triage trends |

## Alarm Coverage Expectations

The skill flags any of these as **MEDIUM** when missing (`cloudwatch.DescribeAlarmsForMetric` returns nothing for the resource + metric):

| Resource | Metric | Threshold (suggested) |
|---|---|---|
| RDS instance | CPUUtilization | > 80% for 5 minutes |
| RDS instance | FreeStorageSpace | < 10% allocated |
| RDS instance | FreeableMemory | < 256 MB or < 10% of class |
| RDS instance | DatabaseConnections | > 80% of `max_connections` |
| RDS instance | ReadLatency / WriteLatency | > 20 ms |
| Read replica | ReplicaLag | > 60 s |
| Aurora cluster | AuroraReplicaLag | > 100 ms |
| Aurora cluster | DatabaseConnections | > 80% of `max_connections` |
| Aurora cluster | BufferCacheHitRatio | < 95% |

## RDS Events of Interest (`rds.DescribeEvents`, last 14 days)

| Event substring | Severity | Action |
|---|---|---|
| `failover` | INFO if scheduled, HIGH if unplanned | Confirm RCA |
| `restart` (unplanned) | HIGH | Investigate logs, alarms |
| `out of memory` / `low memory` | HIGH | Memory tuning / class upgrade |
| `storage-full` / `low-storage` | CRITICAL | Add storage / enable autoscaling |
| `automated-backup-failed` | HIGH | Investigate immediately |
| `pending-maintenance` not applied within window | MEDIUM | Apply at next window |
| `read-replica-error` | HIGH | Replica health |
| `parameter group changed` | INFO | Audit trail |
| `instance-stopped` (production) | HIGH | Verify intentional |

README.md 11.4 KB

# RDS Operation Review — AWS DevOps Agent Skill

A comprehensive Amazon RDS and Aurora operational review skill for [AWS DevOps Agent](https://docs.aws.amazon.com/devopsagent/latest/userguide/about-aws-devops-agent.html). Conducts best-practices assessments aligned with the [Amazon RDS Best Practices Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_BestPractices.html), the [Aurora Best Practices Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/CHAP_BestPractices.html), and the [AWS Well-Architected Framework](https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html). Generates a shareable report artifact per resource.

## What It Does

When activated via Chat, this skill instructs the DevOps Agent to:

1. Discover RDS instances and Aurora clusters in the configured account/regions.
2. Collect database configuration, parameter groups, security groups, subnet groups, snapshots, and events.
3. Collect 7-day historical CloudWatch metrics, RDS log group entries, and 14-day RDS events.
4. Pull 3-month Cost Explorer data and proportionally estimate per-database monthly cost.
5. Analyze against five Well-Architected pillars (Security, Reliability, Performance, Cost Optimization, Operational Excellence) plus engine-specific guidance.
6. Generate a shareable report artifact per resource, named `rds-review-<resource>-<YYYY-MM-DD>.md`.

All data is gathered through native AWS APIs (`rds`, `cloudwatch`, `logs`, `ec2`, `kms`, `costexplorer`, `applicationautoscaling`, `pi`). The skill does **not** require Kubernetes (`k8s`), EKS, or Dante MCP servers.

## Agent Types

This skill is intended for the following agent types (selected in the Operator Web App at upload time):

- **On-demand** — conversational invocation in Chat ("review my Aurora cluster", "RDS health check").
- **Evaluation** — proactive operational improvement recommendations.

Select **Generic** instead if you want the skill available to all agent types.

## Prerequisites

### 1. An AWS DevOps Agent Space with the target AWS account

You need an existing [Agent Space](https://docs.aws.amazon.com/devopsagent/latest/userguide/getting-started-with-aws-devops-agent-creating-an-agent-space.html) with the target AWS account configured as a cloud source.

### 2. IAM permissions for the DevOps Agent's primary cloud-source role

The Agent Space's IAM role must have read access to RDS, Aurora, CloudWatch, Logs, EC2, KMS, and Cost Explorer APIs. The AWS managed policy `AWSDevOpsAgent...ReadOnlyAccess` (or your custom equivalent) typically covers all of the following — verify in your account before running the review:

- `rds:Describe*`, `rds:ListTagsForResource`, `rds:DownloadDBLogFilePortion`
- `pi:DescribeDimensionKeys`, `pi:GetResourceMetrics` (Performance Insights — only if PI is enabled on the target databases)
- `cloudwatch:GetMetricData`, `cloudwatch:GetMetricStatistics`, `cloudwatch:DescribeAlarms`, `cloudwatch:DescribeAlarmsForMetric`
- `logs:DescribeLogGroups`, `logs:DescribeLogStreams`, `logs:FilterLogEvents`, `logs:GetLogEvents`
- `ec2:DescribeSecurityGroups`, `ec2:DescribeSubnets`, `ec2:DescribeVpcs`
- `kms:DescribeKey`, `kms:ListAliases`
- `application-autoscaling:DescribeScalableTargets`, `application-autoscaling:DescribeScalingPolicies`
- `ce:GetCostAndUsage`, `ce:GetReservationCoverage`, `ce:GetReservationUtilization`
- `tag:GetResources` (optional — for cross-service tag reporting)

The skill operates entirely in **read-only** mode: it never calls `Modify*`, `Reboot*`, `Restore*`, `Create*`, or `Delete*` RDS APIs.

### 3. Performance Insights (recommended)

For richer query-level analysis, enable Performance Insights on databases you want to review:

- RDS console → **Modify** the instance → **Performance Insights** → enable (free 7-day retention by default).
- Or `aws rds modify-db-instance --db-instance-identifier <id> --enable-performance-insights --apply-immediately`.

Without Performance Insights, the skill still produces a complete report from CloudWatch metrics, logs, and configuration data — it just won't include `db.load.avg` and top-SQL breakdowns.

### 4. CloudWatch Logs export (recommended)

For log-pattern analysis in Step 6, enable CloudWatch Logs export for the engine logs you care about:

- **MySQL/MariaDB**: `audit, error, general, slowquery`
- **PostgreSQL**: `postgresql, upgrade`
- **Oracle**: `alert, audit, listener, trace`
- **SQL Server**: `agent, error`

RDS console → **Modify** the instance → **Log exports** → select log types. The skill reports "log exports disabled" as a finding when this is missing, but cannot retrieve historical log events without it.

### 5. (Conditional) Network reachability for databases in private VPCs

The `rds`, `cloudwatch`, `logs`, and other AWS APIs the skill calls are **regional control-plane APIs** — they're reached over the public AWS API endpoints regardless of whether the database itself sits in a private VPC. There is **no need for a private connection** to run the operational review against a database with a private endpoint, because the skill only reads metadata via control-plane APIs (it never connects to the database engine on port 3306 / 5432 / 1521 / 1433).

If your account requires all AWS API traffic to traverse VPC endpoints (org-level guardrail), ensure the following [interface VPC endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html) are reachable from the agent's source path: `com.amazonaws.<region>.rds`, `com.amazonaws.<region>.monitoring` (CloudWatch), `com.amazonaws.<region>.logs`, `com.amazonaws.<region>.ec2`, `com.amazonaws.<region>.kms`. Cost Explorer is global (`ce.us-east-1.amazonaws.com`) and does not have a VPC endpoint.

If you separately want the agent to **execute SQL** inside a private database (out of scope for this skill — but a related capability), use the [DevOps Agent private connection](https://docs.aws.amazon.com/devopsagent/latest/userguide/configuring-capabilities-for-aws-devops-agent-connecting-to-privately-hosted-tools.html) mechanism with an MCP server that fronts the database.

## Uploading to AWS DevOps Agent

> Reference: [Uploading a skill](https://docs.aws.amazon.com/devopsagent/latest/userguide/about-aws-devops-agent-devops-agent-skills.html#uploading-a-skill)

### 1. Package the skill

From the `skills/` directory in this repo:

```bash
cd skills
zip -r rds-operation-review.zip rds-operation-review/ -x 'rds-operation-review/evals/*'
```

The resulting `rds-operation-review.zip` contains:

```
rds-operation-review/
├── SKILL.md          # frontmatter + skill instructions (required)
└── references/
    ├── best-practices-checklist.md
    └── metrics-thresholds.md
```

`evals/` is excluded from the upload to keep the zip small (it's only used for offline evaluation).

Constraints (enforced at upload time):

- Total zip size ≤ **6 MB**.
- `SKILL.md` is required and must include `name` and `description` frontmatter.
- A `scripts/` directory is **not** allowed — uploads containing scripts are rejected.

### 2. Upload via the Operator Web App

1. Navigate to the **Skills** page in your Agent Space Operator Web App.
2. Click **Add skill** → **Upload skill**.
3. Drag and drop `rds-operation-review.zip` (or browse to it).
4. Select agent types: **On-demand** and **Evaluation** (or leave **Generic** to make it available to all agent types).
5. Review the validation results.
6. Click **Upload**.

### 3. (Optional) Connect additional observability sources

For richer analysis, connect your observability tools to the Agent Space:

| Tool | Setup Guide |
|------|-------------|
| CloudWatch | Built-in (no setup needed) |
| Datadog | [Connecting Datadog](https://docs.aws.amazon.com/devopsagent/latest/userguide/connecting-telemetry-sources-connecting-datadog.html) |
| Dynatrace | [Connecting Dynatrace](https://docs.aws.amazon.com/devopsagent/latest/userguide/connecting-telemetry-sources-connecting-dynatrace.html) |
| New Relic | [Connecting New Relic](https://docs.aws.amazon.com/devopsagent/latest/userguide/connecting-telemetry-sources-connecting-new-relic.html) |
| Splunk | [Connecting Splunk](https://docs.aws.amazon.com/devopsagent/latest/userguide/connecting-telemetry-sources-connecting-splunk.html) |
| Grafana | [Connecting Grafana](https://docs.aws.amazon.com/devopsagent/latest/userguide/connecting-telemetry-sources-connecting-grafana.html) |
| Custom MCP | [Connecting MCP Servers](https://docs.aws.amazon.com/devopsagent/latest/userguide/configuring-capabilities-for-aws-devops-agent-connecting-mcp-servers.html) |

## Usage

In the DevOps Agent Chat, use natural language:

- *"Run an RDS operational review for all databases."*
- *"Review my Aurora cluster `prod-aurora` in `us-east-1` for best practices."*
- *"Audit RDS security and cost optimization across all regions."*
- *"Generate an RDS best-practices report for instance `analytics-pg`."*
- *"ORR for our production databases."*

The agent will:

- Collect all data automatically (no prompts for confirmation).
- Use only AWS APIs — no Kubernetes or external scripts.
- Generate a report artifact per resource, named `rds-review-<resource-name>-<YYYY-MM-DD>.md`.

## Skill Contents

```
rds-operation-review/
├── SKILL.md                           # main skill instructions (with frontmatter)
├── README.md                          # this file
├── references/
│   ├── best-practices-checklist.md    # checklist mapped to RDS / Aurora best practices
│   └── metrics-thresholds.md          # CloudWatch metric thresholds & severity rules
└── evals/                             # evaluation data (not included in upload zip)
```

## Best-Practices Sections Covered

| # | Pillar | Reference |
|---|--------|-----------|
| 1 | Security (Network, Encryption, IAM auth, Audit logging) | [RDS security](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.html), [Encryption](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html) |
| 2 | Reliability (Multi-AZ, Backups, DR, Replication) | [Multi-AZ](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html), [Aurora Global Database](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html) |
| 3 | Performance (CPU, Memory, IOPS, PI, Connection mgmt) | [Monitoring RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Monitoring.html), [Performance Insights](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.html) |
| 4 | Cost Optimization (RIs, gp3, Graviton, idle DBs) | [Cost-optimized RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_BestPractices.html#CHAP_BestPractices.Optimization) |
| 5 | Operational Excellence (Alarms, Events, Maintenance, Tagging) | [RDS events](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html), [Well-Architected Operational Excellence](https://docs.aws.amazon.com/wellarchitected/latest/operational-excellence-pillar/welcome.html) |
| Engine-specific | MySQL / PostgreSQL / Oracle / SQL Server / Aurora tuning | linked in SKILL.md |

## Severity Definitions

| Severity | Definition | SLA |
|----------|------------|-----|
| CRITICAL | Immediate risk to availability, security, or data integrity | 24–48 hours |
| HIGH | Significant gap that could lead to incidents | 1 week |
| MEDIUM | Notable improvement opportunity | 30 days |
| LOW | Minor optimization or hardening | When convenient |
| INFO | Observation, no action required | N/A |

SKILL.md 18.9 KB

---
name: rds-operation-review
description: Comprehensive Amazon RDS and Aurora operational review aligned with the
  AWS Well-Architected Framework and RDS/Aurora best practices. Use this skill when
  a user asks to review, audit, or assess RDS instances or Aurora clusters for best
  practices compliance, security posture, reliability, performance, cost optimization,
  backups, encryption, or operational readiness. Triggers on requests like "RDS
  review", "Aurora best practices audit", "database operational assessment", "review
  my RDS instance", "RDS health check", or "ORR for RDS".
metadata:
  author: yakiratz-aws
  version: "1.0.0"
  aws-devops-agent-skills.agent-types: "Chat tasks, Evaluation"
  aws-devops-agent-skills.aws-services: "Amazon RDS"
  aws-devops-agent-skills.technical-domains: "Databases"
---

# RDS / Aurora Operational Review

Conduct a comprehensive operational review of Amazon RDS instances and Amazon Aurora
clusters aligned with the [AWS Well-Architected Framework](https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html)
and the [Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_BestPractices.html)
and [Aurora](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/CHAP_BestPractices.html)
best-practices guides.

This skill uses the **AWS RDS, Aurora, CloudWatch, CloudWatch Logs, EC2, and Cost
Explorer APIs only** — no Kubernetes (`k8s`) or `eks` MCP tools. All data is
collected through native AWS APIs available to the DevOps Agent's primary cloud
source role.

## When to Use

Activate this skill when the user asks to:
- Review, audit, or assess RDS instances or Aurora clusters
- Check RDS / Aurora best-practices compliance
- Evaluate database security, cost, reliability, performance, or backups
- Perform an RDS / Aurora operational readiness review (ORR)
- Investigate database health or configuration drift

## Step 1: Identify Target Resources

Ask the user which databases to review. Accept:
- Specific instance / cluster identifiers and regions
- "all instances" / "all clusters" in specific regions
- "all RDS in all regions"

If no scope is given, default to all configured account regions.

## Step 2: Discover RDS / Aurora Resources

Per region (skip empty regions):

```
rds.DescribeDBInstances           # RDS instances + Aurora cluster member instances
rds.DescribeDBClusters            # Aurora clusters (skip if user said "Provisioned only")
rds.DescribeDBClusterEndpoints    # Aurora reader/writer endpoints
rds.DescribeGlobalClusters        # Aurora Global Database (cross-region)
rds.DescribeDBProxies             # RDS Proxy
```

Capture per resource:
- Engine, engineVersion, dbInstanceClass / serverlessV2 capacity
- Multi-AZ, AvailabilityZones, subnetGroup, VpcId
- AllocatedStorage, MaxAllocatedStorage, StorageType, Iops, StorageThroughput, StorageEncrypted, KmsKeyId
- BackupRetentionPeriod, PreferredBackupWindow, PreferredMaintenanceWindow, AutoMinorVersionUpgrade
- DeletionProtection, PubliclyAccessible, IAMDatabaseAuthenticationEnabled
- PerformanceInsightsEnabled, PerformanceInsightsRetentionPeriod, MonitoringInterval (Enhanced Monitoring), MonitoringRoleArn
- EnabledCloudwatchLogsExports, AssociatedRoles
- ReadReplicaSourceDBInstanceIdentifier / ReadReplicaDBInstanceIdentifiers
- Tags (`rds.ListTagsForResource` — param name is `ResourceName` and value is the resource ARN)

## Step 3: Discover Configuration Dependencies

For each database, collect:

```
rds.DescribeDBParameterGroups           # custom vs default
rds.DescribeDBClusterParameterGroups    # Aurora
rds.DescribeOptionGroups                # RDS option groups
rds.DescribeDBSubnetGroups              # subnet AZ spread
ec2.DescribeSecurityGroups              # vpcSecurityGroupIds → ingress rules
kms.DescribeKey                         # for KmsKeyId (encryption at rest)
```

## Step 4: Collect Backups, Snapshots, Maintenance

```
rds.DescribeDBSnapshots                            # manual + automated, per instance
rds.DescribeDBClusterSnapshots                     # Aurora
rds.DescribeDBInstanceAutomatedBackups
rds.DescribeDBClusterAutomatedBackups
rds.DescribeDBEngineVersions                       # current vs latest minor/major
rds.DescribePendingMaintenanceActions
rds.DescribeEvents                                 # last 14 days; duration in MINUTES (20160)
rds.DescribeEventSubscriptions
```

For each instance/cluster, also fetch:
- `rds.DescribeDBLogFiles` — list of logs available locally on the DB
- `logs.DescribeLogGroups` with prefix:
  - Instances: `/aws/rds/instance/<dbInstanceIdentifier>/`
  - Aurora: `/aws/rds/cluster/<dbClusterIdentifier>/`

## Step 5: Collect CloudWatch Metrics (7-Day Historical)

**One** `cloudwatch.GetMetricData` call per resource. `Period: 21600` (6 hours).
`StartTime`: 7 days ago. `EndTime`: now.

### 5.1 RDS Instances (dimension `DBInstanceIdentifier`)

| id | metricName | stat | unit |
|----|------------|------|------|
| `cpu` | CPUUtilization | Average | % |
| `freeMem` | FreeableMemory | Minimum | bytes |
| `freeSpace` | FreeStorageSpace | Minimum | bytes |
| `readIops` | ReadIOPS | Average | count/s |
| `writeIops` | WriteIOPS | Average | count/s |
| `readLat` | ReadLatency | Average | s |
| `writeLat` | WriteLatency | Average | s |
| `dbConn` | DatabaseConnections | Maximum | count |
| `swap` | SwapUsage | Average | bytes |
| `netIn` | NetworkReceiveThroughput | Average | bytes/s |
| `netOut` | NetworkTransmitThroughput | Average | bytes/s |
| `binLog` | BinLogDiskUsage | Average | bytes |
| `replLag` | ReplicaLag | Maximum | s |

### 5.2 Aurora Clusters (dimension `DBClusterIdentifier`)

| id | metricName | stat | unit |
|----|------------|------|------|
| `cpu` | CPUUtilization | Average | % |
| `freeMem` | FreeableMemory | Minimum | bytes |
| `dbConn` | DatabaseConnections | Maximum | count |
| `replLag` | AuroraReplicaLag | Maximum | ms |
| `bufCache` | BufferCacheHitRatio | Average | % |
| `commitLat` | CommitLatency | Average | ms |
| `readLat` | ReadLatency | Average | s |
| `writeLat` | WriteLatency | Average | s |
| `volReadIops` | VolumeReadIOPs | Sum | count |
| `volWriteIops` | VolumeWriteIOPs | Sum | count |
| `serverlessAcu` | ServerlessDatabaseCapacity | Average | ACU |

### 5.3 Per-Instance Aurora Members

Same instance metrics as 5.1, dimensioned by `DBInstanceIdentifier` of each cluster member.

Fetch `cloudwatch.DescribeAlarmsForMetric` for the key metrics
(`CPUUtilization`, `FreeStorageSpace`, `DatabaseConnections`, `ReadLatency`,
`WriteLatency`, `ReplicaLag` / `AuroraReplicaLag`) per resource so the report can
flag missing alarms.

## Step 6: Collect Logs (7-Day)

Per database log group, scan with `logs.FilterLogEvents` for:

| Pattern | What it indicates |
|---------|-------------------|
| `ERROR` / `FATAL` | engine errors |
| `Out of memory` / `OOM` | memory pressure |
| `connection limit exceeded` / `too many connections` | connection saturation |
| `deadlock` / `lock wait timeout` | contention |
| `slow query` / `duration: ` (Postgres slow log) | query performance |
| `aborted connection` (MySQL) | client/network issues |
| `replication has stopped` / `IO_THREAD` errors | replication health |
| `checkpoint` warnings / `archiver failed` | I/O / WAL issues |
| `failed to connect` / `authentication failed` | auth/network |

Record occurrence counts per pattern over the 7-day window.

## Step 7: Collect CloudTrail-Visible RDS Events

Use `rds.DescribeEvents` (last 14 days) per resource — covers the same
operational signal as CloudTrail for RDS without an extra API permission.
Look for: `failover`, `restart`, `parameter group apply`, `out-of-memory`,
`storage-full`, `low-storage`, `automated-backup-failed`,
`maintenance`-related events, `read replica error`, `instance stopped`.

## Step 8: Cost Data

Once per review (not per resource):

```
costexplorer.GetCostAndUsage     # 3 months, by USAGE_TYPE,
                                 # filter Service = "Amazon Relational Database Service"
rds.DescribeReservedDBInstances  # RI inventory
```

Estimate per-database monthly cost as a proportional split of the latest month
total (Cost Explorer doesn't break down per DB):

1. Get the most recent full month total RDS spend.
2. Per resource, weight by `vCPUs(instance class) × (Multi-AZ ? 2 : 1) + allocatedStorageGB`.
3. For Aurora clusters, sum across cluster member instances; storage is cluster-shared.
4. Note the estimate in the report with an "estimated" badge.

## Step 9: Analyze Against Best Practices

Evaluate ALL collected data across the five Well-Architected pillars and assign a
severity to every finding: CRITICAL, HIGH, MEDIUM, LOW, or INFO.

### 9.1 Security
Ref: [Security in Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.html)

- **Network exposure**: `PubliclyAccessible=true` → CRITICAL for production. Security groups with `0.0.0.0/0` ingress on the DB port → CRITICAL.
- **Encryption at rest**: `StorageEncrypted=false` → HIGH (or CRITICAL for regulated workloads). Customer-managed KMS key preferred over AWS-managed.
- **Encryption in transit**: parameter `rds.force_ssl=1` (Postgres) / `require_secure_transport=ON` (MySQL/MariaDB) → MEDIUM if not set.
- **IAM auth**: `IAMDatabaseAuthenticationEnabled=false` → MEDIUM. Master password in app code instead of Secrets Manager → HIGH.
- **Secrets Manager rotation**: not enabled → MEDIUM.
- **Audit logging**: engine audit logs not in `EnabledCloudwatchLogsExports` → MEDIUM (HIGH for PCI/HIPAA scope).
- **CMK rotation**: KMS key without automatic rotation → LOW.

### 9.2 Reliability
Ref: [High Availability for Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html)

- **Multi-AZ**: production single-AZ → HIGH (Aurora: ≥1 reader in a different AZ).
- **Subnet group AZ spread**: subnets span <2 AZs → HIGH.
- **Backups**: `BackupRetentionPeriod=0` → CRITICAL. <7 days for production → HIGH.
- **Deletion protection**: production with `DeletionProtection=false` → HIGH.
- **Auto minor version upgrade**: `AutoMinorVersionUpgrade=false` for non-prod → MEDIUM.
- **Custom parameter group**: instance using `default.<engine>` parameter group → MEDIUM (can't tune).
- **Pending maintenance**: required actions not applied within window → MEDIUM, escalating with age.
- **Replication health (read replicas)**: `ReplicaLag` 7-day max > 30s → HIGH; > 300s → CRITICAL.
- **Aurora replicas**: clusters with no reader → MEDIUM; single-AZ readers → MEDIUM.
- **DR**: cross-region read replica or Aurora Global Database absent for tier-1 workloads → MEDIUM.

### 9.3 Performance
Ref: [DB Instance Performance](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Monitoring.html)

7-day metric thresholds (full table in `references/metrics-thresholds.md`):
- `CPUUtilization` avg > 70% → MEDIUM, > 90% → HIGH.
- `FreeStorageSpace` < 20% allocated → HIGH, < 10% → CRITICAL.
- `FreeableMemory` < 10% instance class memory → HIGH; sustained `SwapUsage` > 0 → MEDIUM.
- `DatabaseConnections` max > 80% of `max_connections` parameter → HIGH.
- `ReadLatency` / `WriteLatency` avg > 20ms (10ms for io1/io2) → MEDIUM.
- `BufferCacheHitRatio` (Aurora) < 95% → MEDIUM, < 90% → HIGH.
- `BinLogDiskUsage` growth without retention bounds → MEDIUM.
- **Performance Insights** disabled → MEDIUM (free 7-day tier should always be on).
- **Enhanced Monitoring** disabled or interval > 60s for production → MEDIUM.
- **Connection pooling**: high connection churn / no RDS Proxy → MEDIUM for serverless / many-client workloads.

### 9.4 Cost Optimization
Ref: [Cost-Optimized Architectures](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_BestPractices.html#CHAP_BestPractices.Optimization)

- **Stopped instances**: `DBInstanceStatus=stopped` (still pays storage) → HIGH.
- **Previous-generation classes**: `db.m4 / db.r4 / db.t2` → MEDIUM.
- **gp2 → gp3**: any `StorageType=gp2` → MEDIUM (≈20% cheaper, equal/better performance).
- **Over-provisioned IOPS**: `io1`/`io2` with avg `IOPS used / IOPS provisioned < 50%` → MEDIUM.
- **Reserved Instance coverage**: production On-Demand without RIs → MEDIUM, with estimated savings.
- **Storage autoscaling**: `MaxAllocatedStorage` not set → LOW, increases stockout risk.
- **Idle databases**: `DatabaseConnections` 7-day max < 5 + `CPUUtilization` 7-day avg < 5% → MEDIUM (candidate to stop / delete).
- **Manual snapshots**: many > 90 days old → LOW (review retention).
- **Cost-allocation tags**: missing `Environment`, `Owner`, `CostCenter` → LOW.
- **Graviton migration**: x86 (`db.r5`, `db.m5`, `db.t3`) where Graviton is supported → MEDIUM (~20% saving).

### 9.5 Operational Excellence
Ref: [Monitoring Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Monitoring.html)

- **CloudWatch alarms**: missing alarms on `CPUUtilization`, `FreeStorageSpace`, `DatabaseConnections`, `FreeableMemory`, `ReplicaLag` → MEDIUM each.
- **Event subscriptions**: no `rds.DescribeEventSubscriptions` covering this resource → MEDIUM.
- **Engine version currency**: minor version not latest available → LOW; major version EOL/within 6 months → HIGH.
- **Log exports**: engine error / slow / audit logs not exported to CloudWatch → MEDIUM.
- **Maintenance window**: not configured / overlaps business hours → LOW.
- **Tagging**: missing operational tags (`Environment`, `Owner`, `Runbook`, `OnCall`) → LOW.
- **Drift**: parameters changed in default parameter group (impossible by design — use as a flag for non-default usage check).

## Step 10: Generate Report

Generate a separate shareable report artifact for **each resource** reviewed.

Artifact naming: `rds-review-<resource-name>-<YYYY-MM-DD>.md`
Example: `rds-review-prod-aurora-2026-04-29.md`

For each resource, create the artifact as a Markdown document with:

### Report Header
```
# RDS / Aurora Operational Review — <resource-name>
Account: <account-id> | Region: <region> | Date: <YYYY-MM-DD>
Engine: <engine> <engineVersion> | Class: <dbInstanceClass / serverlessV2 ACU> | Multi-AZ: <yes/no>
```

### Executive Summary
- Health: ✅ HEALTHY / ⚠️ WARNINGS / ❌ CRITICAL
- Finding counts by severity
- Top 3 critical/high items

### Configuration Snapshot
| Item | Value |
| Engine / version | … |
| Storage | type, allocated, max, IOPS, throughput, encrypted (KMS) |
| Network | VPC, subnet group, AZs, public access, security groups |
| Backup | retention, window, automated, deletion protection |
| HA / DR | Multi-AZ, replicas, Global DB |
| Auth | IAM auth, Secrets Manager, master user |
| Observability | Performance Insights, Enhanced Monitoring, log exports |

### Findings by Pillar
For each of Security, Reliability, Performance, Cost, Operational Excellence:

| # | Finding | Severity | Current State | Recommendation |

### CloudWatch Metrics (7-Day)
| Metric | Stat | 7-Day Avg | 7-Day Max / Min | Status | Finding |

### Log Pattern Analysis (7-Day)
| Pattern | Occurrences | Severity | Finding |

### RDS Events (14-Day)
Notable events (failovers, restarts, low-storage, OOM, maintenance) with timestamps.

### Pending Maintenance
List from `rds.DescribePendingMaintenanceActions` with action type, target window, age.

### Engine Version
Current vs latest minor / latest major. Flag EOL.

### Cost Summary
- Latest-month estimated cost for this resource (proportional split, with "estimated" badge)
- RI coverage status
- Top 3 cost-optimization opportunities (linked to findings)

### Priority Matrix
| # | Finding | Severity | Pillar | Effort | Impact |

### Next Steps
- Immediate (CRITICAL/HIGH — 7 days)
- Short-term (MEDIUM — 30 days)
- Long-term (LOW — 90 days)

### Appendix — Reference Links
- [Amazon RDS Best Practices](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_BestPractices.html)
- [Amazon Aurora Best Practices](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/CHAP_BestPractices.html)
- [Monitoring RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Monitoring.html)
- [Performance Insights](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.html)
- [Encrypting RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html)
- [Multi-AZ DB Instance Deployments](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html)
- [Aurora Global Database](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html)
- [RDS Proxy](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy.html)
- [Well-Architected Framework](https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html)

## Severity Definitions

| Severity | Definition | SLA |
|----------|------------|-----|
| CRITICAL | Immediate risk to availability, security, or data integrity | Fix within 24–48 hours |
| HIGH | Significant gap that could lead to incidents | Fix within 1 week |
| MEDIUM | Notable improvement opportunity | Plan within 30 days |
| LOW | Minor optimization or hardening | Address when convenient |
| INFO | Observation, no action required | N/A |

## Engine-Specific Considerations

- **MySQL / MariaDB** — `innodb_buffer_pool_size`, `max_connections`, slow query log,
  binlog retention, deprecated `query_cache_type` on 8.0+.
- **PostgreSQL** — `shared_buffers`, `work_mem`, autovacuum, `pg_stat_statements`,
  `log_min_duration_statement`, replication slots.
- **Oracle** — BYOL tracking, SGA/PGA sizing, AWR, tablespace autoextend.
- **SQL Server** — tempdb file count (1 per vCPU up to 8), MAXDOP, cost threshold for
  parallelism, Always On AGs vs Multi-AZ.
- **Aurora** — Serverless v2 ACU floor/ceiling, Global Database for DR, fast clones,
  Backtrack (MySQL only), cluster cache management.

## Known API Quirks (recorded so the agent doesn't trip on them)

- `rds.ListTagsForResource` — parameter is `ResourceName`, **value is the resource ARN**.
- `rds.DescribeEvents` — `Duration` is in **minutes** (20160 = 14 days).
- `applicationautoscaling.DescribeScalableTargets` — `ServiceNamespace="rds"` covers Aurora replica autoscaling.
- `logs.DescribeLogGroups` prefix differs:
  - Instances: `/aws/rds/instance/<id>/`
  - Aurora clusters: `/aws/rds/cluster/<id>/`
- Some Aurora metrics are cluster-only (`AuroraReplicaLag`, `BufferCacheHitRatio`,
  `VolumeReadIOPs`), others are instance-only (`FreeableMemory`, `CPUUtilization` per
  member). Query the right dimension or both.
- `rds.DescribeDBSnapshots` requires pagination for accounts with many snapshots —
  use `MaxRecords` and `Marker`.

## Data Source Boundaries

This skill explicitly does **not** call:
- Kubernetes API / `k8s` MCP — RDS is fully managed; no cluster API exists.
- `eks` MCP — outside scope.
- Dante or any non-AWS scripts — keep the skill self-contained on the AWS DevOps Agent's primary cloud-source IAM role.

If a customer needs deeper SQL-level analysis (e.g. Performance Insights `db.load`
breakdowns, top SQL by wait event), call `pi.GetResourceMetrics` and
`pi.DescribeDimensionKeys` directly — both are in the same `rds` permission family
when Performance Insights is enabled.

Comments (0)

No comments yet.

Reviews (0)

No reviews yet.

Claude Prompt

Tighten-my-prose editing prompt

Claude Skill

Adversarial code-review skill for Claude

Claude Workflow

Deep-research workflow (fan-out + verify)

Claude Skill

Conventional-commit writer for Claude

rds-operation-review

Install

README

RDS Operation Review — AWS DevOps Agent Skill

What It Does

Agent Types

Prerequisites

1. An AWS DevOps Agent Space with the target AWS account

2. IAM permissions for the DevOps Agent's primary cloud-source role

3. Performance Insights (recommended)

4. CloudWatch Logs export (recommended)

5. (Conditional) Network reachability for databases in private VPCs

Uploading to AWS DevOps Agent

1. Package the skill

2. Upload via the Operator Web App

3. (Optional) Connect additional observability sources

Usage

Skill Contents

Best-Practices Sections Covered

Severity Definitions

Skill manifest

RDS / Aurora Operational Review

When to Use

Step 1: Identify Target Resources

Step 2: Discover RDS / Aurora Resources

Step 3: Discover Configuration Dependencies

Step 4: Collect Backups, Snapshots, Maintenance

Step 5: Collect CloudWatch Metrics (7-Day Historical)

5.1 RDS Instances (dimension DBInstanceIdentifier)

5.2 Aurora Clusters (dimension DBClusterIdentifier)

5.3 Per-Instance Aurora Members

Step 6: Collect Logs (7-Day)

Step 7: Collect CloudTrail-Visible RDS Events

Step 8: Cost Data

Step 9: Analyze Against Best Practices

9.1 Security

9.2 Reliability

9.3 Performance

9.4 Cost Optimization

9.5 Operational Excellence

Step 10: Generate Report

Report Header

Executive Summary

Configuration Snapshot

Findings by Pillar

CloudWatch Metrics (7-Day)

Log Pattern Analysis (7-Day)

RDS Events (14-Day)

Pending Maintenance

Engine Version

Cost Summary

Priority Matrix

Next Steps

Appendix — Reference Links

Severity Definitions

Engine-Specific Considerations

Known API Quirks (recorded so the agent doesn't trip on them)

Data Source Boundaries

Comments (0)

Reviews (0)

Related

5.1 RDS Instances (dimension `DBInstanceIdentifier`)

5.2 Aurora Clusters (dimension `DBClusterIdentifier`)