amazon-keyspaces

What the source does

• FilesystemDeclared3 observations
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

import savingsPlansDataJson from '../../assets/data/savings-plans.json';

import regionsDataJson from '../../assets/data/regions.json';

import pricingDataJson from '../../assets/data/mcs.json';

The formulas and pricing tables in `references/mode-*.md` are for your internal use to produce the output numbers — do not copy them into the reply as derivation.

The skill does not create, read, write, or transmit credentials.

- You MUST NOT prompt the user to enter AWS access keys or Cassandra passwords into the chat.

Audit 0.4.1 · source sha 9d0fb564de1b · 31 Oct 2026Report an issue or request a re-scan

• Publisheraws GitHub organizationOwner of the repository this skill is read from
• Source folderaws/agent-toolkit-for-aws/skills/specialized-skills/database-skills/amazon-keyspacesThe exact folder we audited
• LicenceApache-2.0As the repository states it
• Commit pinned for this verdict9d0fb564de1bA new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Provides authoritative compatibility checks, pricing estimates, connection troubleshooting, pre-warming guidance, and infrastructure mutations for Amazon Keyspaces (for Apache Cassandra). Covers LWT/batch operations,…

---
name: amazon-keyspaces
description: >-
  Provides authoritative compatibility checks, pricing estimates, connection troubleshooting,
  pre-warming guidance, and infrastructure mutations for Amazon Keyspaces (for Apache
  Cassandra). Covers LWT/batch operations, secondary indexes, materialized views,
  capacity modes, TTL, PITR, CDC, auto-scaling, multi-region keyspaces, UDTs, nodetool
  diagnostics parsing, SQL-to-Cassandra migration, and Cassandra-to-Keyspaces migration
  scenarios. Agents frequently produce incomplete or incorrect answers about Keyspaces
  feature support without this skill loaded.
version: 1
---
# Amazon Keyspaces

## Safety guidance

This skill covers creating keyspaces and tables and modifying table-level settings (TTL, PITR, capacity mode) when the user requests it. The agent MUST confirm the action with the user before executing. Do NOT execute any create or modify operation without explicit user confirmation (e.g., "yes", "proceed", "confirmed", "go ahead"). If the user has not confirmed, present the planned action and ask for approval.

### Execute these operations (after user confirmation)

- Create a keyspace: `aws keyspaces create-keyspace`
- Create a multi-region keyspace: `aws keyspaces create-keyspace --replication-specification replicationStrategy=MULTI_REGION,regionList=[{region=us-east-1},{region=eu-west-1}]`
- Create a table: `aws keyspaces create-table` (include partition-key and clustering-key design derived from the user's access patterns)
- Add column(s) to a table: `aws keyspaces update-table --add-columns '[{"name":"col_name","type":"text"}]'` — non-destructive, no downtime, no data loss. Existing rows get null for the new column.
- Create a User Defined Type (UDT): `aws keyspaces create-type --keyspace-name <ks> --type-name <name> --field-definitions '[{"name":"field1","type":"text"},...]'`
- Modify table TTL: `aws keyspaces update-table --default-time-to-live`
- Enable/disable PITR: `aws keyspaces update-table --point-in-time-recovery-specification`
- Change capacity mode: `aws keyspaces update-table --capacity-specification` (on-demand vs provisioned) — see warnings below
- Switch table encryption key: `aws keyspaces update-table --encryption-specification type=CUSTOMER_MANAGED_KMS_KEY,kmsKeyIdentifier=arn:aws:kms:...` — no downtime or availability loss. Can also switch back to AWS owned key with `type=AWS_OWNED_KMS_KEY`.
- Pre-warm table throughput: `aws keyspaces update-table --warm-throughput-specification readUnitsPerSecond=X,writeUnitsPerSecond=Y` — sets the minimum instantaneous throughput the table can handle. Use before planned traffic spikes (flash sales, migrations, batch loads). One-time cost based on the delta above natural warm throughput. Also available on `aws keyspaces create-table --warm-throughput`. Load [pre-warming.md](references/pre-warming.md) for the decision framework and sizing formulas.
- Configure auto-scaling: `aws keyspaces update-table --auto-scaling-specification` — sets target utilization percentage and min/max capacity units for reads and/or writes. **Prerequisite:** the service-linked role `AWSServiceRoleForApplicationAutoScaling_CassandraTable` must exist. If it doesn't, the agent MUST first instruct the user to run: `aws iam create-service-linked-role --aws-service-name cassandra.application-autoscaling.amazonaws.com`. The calling IAM principal also needs `application-autoscaling:RegisterScalableTarget`, `application-autoscaling:PutScalingPolicy`, `application-autoscaling:DescribeScalableTargets`, `cloudwatch:PutMetricAlarm`, `cloudwatch:DescribeAlarms`, `cloudwatch:DeleteAlarms` permissions. Scope `application-autoscaling:RegisterScalableTarget`, `application-autoscaling:PutScalingPolicy`, `application-autoscaling:DescribeScalableTargets` permissions to the target table ARN (`arn:aws:cassandra:<region>:<account>:/keyspace/<ks>/table/<table>`). Scope `cloudwatch:PutMetricAlarm`, `cloudwatch:DescribeAlarms`, `cloudwatch:DeleteAlarms` permissions to the corresponding alarm ARNs (e.g., `arn:aws:cloudwatch:<region>:<account>:alarm:TargetTracking-table/<ks>/<table>-*`). Use `aws:ResourceTag` condition keys where possible rather than applying account-wide.
- Enable CDC (change data capture): `aws keyspaces update-table --cdc-specification status=ENABLED,viewType=<type>` — creates a CDC stream that captures row-level changes. The agent MUST ask the user which view type to use before enabling, presenting these options:
  - `NEW_IMAGE` — captures the full row **after** the change. Best for: event-driven pipelines, downstream sync, materialized views.
  - `OLD_IMAGE` — captures the full row **before** the change. Best for: audit trails, compliance logging, undo/rollback scenarios.
  - `NEW_AND_OLD_IMAGES` — captures both before and after states. Best for: diff-based pipelines, detailed auditing, conflict resolution. Higher CDC consumption cost.
  - `KEYS_ONLY` — captures only the partition key and clustering key columns. Best for: lightweight change notifications, triggering application re-reads. Lowest cost.
  Optional: `propagateTags=TABLE` copies the table's tags to the CDC stream. Recommend enabling by default.
- Tag resources: `aws keyspaces tag-resource`, `aws keyspaces untag-resource`

### Resource tagging (MANDATORY — always apply on resource creation)

When creating ANY keyspace or table (`aws keyspaces create-keyspace`, `aws keyspaces create-table`, or CQL `CREATE KEYSPACE ... WITH TAGS`, `CREATE TABLE ... WITH TAGS`), you MUST include these tags. A create operation without these tags is INCOMPLETE and INCORRECT:

**AWS CLI syntax:**
`--tags key=created_by,value=keyspaces-skill key=generation_model,value={your-model-id}`

**CQL syntax:**
`WITH TAGS = {'created_by': 'keyspaces-skill', 'generation_model': '{your-model-id}'}`

Example (CLI): `--tags key=created_by,value=keyspaces-skill key=generation_model,value=claude-sonnet-4-20250514`
Example (CQL): `WITH TAGS = {'created_by': 'keyspaces-skill', 'generat

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/aws/agent-toolkit-for-aws
git -C agent-toolkit-for-aws checkout 9d0fb564de1b

Works in

1. 2026-10-31
   ✓SAFE B 89 / 100

   first audit · source 9d0fb564de1b

Questions about amazon-keyspaces

• github.com/aws/agent-toolkit-for-aws/tree/main/skills/specialize — the audited source at commit 9d0fb564de1b and every finding aboveObserved · 31 Oct 2026

Spotted something wrong? Report a correction · Methodology