AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
This skill provides a comprehensive, three-phase framework for migrating self-managed Apache Kafka clusters to Amazon MSK Express. It guides users through inventory discovery, compatibility assessment, and performance simulation to ensure a smooth transition. By analyzing existing infrastructure, the skill identifies potential configuration gaps, calculates target sizing, and provides cost projections, while also offering support for data replication using MSK Replicator.
What it does
- Inventories source Kafka clusters from IaC files, CLI output, or manual input.
- Assesses compatibility across topology, Kafka versions, configurations, auth, and quotas.
- Generates target MSK Express specifications, including broker counts and cost estimates.
- Facilitates optional load-testing via temporary MSK Express trial clusters.
- Provides guidance on using MSK Replicator for migration cutovers.
- Produces standardized artifacts for cluster configuration and compatibility findings.
When to use it
- When planning a migration from self-managed Kafka to Amazon MSK Express.
- When you need to assess the compatibility of your current Kafka setup with MSK Express.
- When you require an accurate sizing and cost projection for an MSK Express target.
- When you want to validate performance through a proof-of-concept load test before migrating.
- When you need a structured approach to inventorying your existing streaming infrastructure.
Advantages
- Reduces migration risk through automated compatibility and topology assessment.
- Provides data-driven cost and sizing recommendations based on actual workload metrics.
- Supports informed decision-making with optional pre-migration performance simulation.
- Standardizes the migration process across discovery, assessment, and execution phases.
- Integrates with existing IaC workflows for efficient inventory collection.
Usage examples
- “I need to migrate my on-premises Kafka cluster to MSK Express. Where do I start?”
- The agent will explain the three-phase migration process (Discovery, Assessment, Simulation) and ask for your infrastructure details or IaC files to begin the discovery phase.
- “Here is my Terraform directory for our Kafka cluster. Can you assess if it is compatible with MSK Express?”
- The agent will perform the discovery phase to generate a cluster configuration and then proceed to the assessment phase to validate compatibility and provide sizing recommendations.
- “I have a cluster-config.json file. How do I get a cost estimate for moving to MSK Express?”
- The agent will run the assessment phase using your configuration file to produce a compatibility report and a pricing summary for the recommended MSK Express setup.
- “How do I test MSK Express performance with my current workload?”
- The agent will guide you through the simulation phase, helping you deploy a temporary MSK Express cluster to run load tests and review performance metrics.
Install
Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/aws/migrate-to-msk/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip migrate-to-msk.zip -d .agents/skills
Documentation by AWS
Migrating to MSK Express
Overview
This skill helps customers migrate self-managed Apache Kafka workloads to Amazon MSK Express. It provides three phases — Discovery, Assessment, and an optional Simulation — that can be run end-to-end or individually depending on the customer's needs.
Scope
This skill covers migrations from self-managed Apache Kafka (on-premises, EC2, Docker, Kubernetes, or other non-MSK deployments) to MSK Express. Migrations from MSK Standard (Provisioned) to MSK Express are out of scope.
Prerequisites
The AWS MCP server is recommended for documentation lookups and informational questions, but is not required. The assessment scripts are pure file processors with no AWS API calls.
Intent Routing
Route the customer's request based on their intent:
1. Open/exploratory question ("How do I migrate to MSK?")
Explain what this skill offers:
This skill helps you migrate to MSK Express in three phases:
Phase 1 — Discovery: Inventory your source Kafka cluster — brokers, topics, partition counts, configs, authentication, and workload metrics — plus two target decisions that drive cost: consumer rack affinity and any negotiated AWS pricing. I can discover this from IaC files (Terraform, CDK, Docker Compose, Kubernetes manifests), provide commands for you to run on your cluster, or you can provide the information manually. Output:
migrate-to-msk-skill-artifacts/<cluster_name>/cluster-config.json.Phase 2 — Assessment: Validate your cluster against MSK Express across 5 compatibility pillars (topology, Kafka version, configs, auth, quotas) and produce a target Express specification using the managing-amazon-msk Skill's pricing logic. I'll flag what Express will refuse vs what Express will silently convert. Outputs:
compatibility.<cluster_name>.json, the pricing results in Markdownmsk_sizing_pricing.md, andmsk-sizing-inputs.<cluster_name>.json.Phase 3 — Simulation: Spin up an MSK Express cluster with load-testing infrastructure to see how Express performs on your own workload, then run a vended test (End-to-End Latency or Broker Restart Under Load) and review the results on a CloudWatch dashboard.
Data replication: For migrating data to your Express cluster, you can use MSK Replicator. I can provide guidance on setup and configuration.
Where would you like to start? I can begin with discovery if you point me to your infrastructure code or describe your cluster, or jump to assessment if you already have a
cluster-config.jsonfile, or go straight to simulation if you already know your target Express configuration.
Guardrails for this overview response:
This response is an overview and a routing question only. Do NOT begin, simulate, or pre-empt any phase.
Do NOT produce or estimate assessment output here — no verdicts, pillar findings, compatibility conclusions, broker counts, instance recommendations, or cost figures. Those values exist only after you run the Phase 2 scripts against a real
cluster-config.json.Do NOT open, read, or summarize the internals of
compatibility.py,simulation_load_test_config.py, or the reference files to explain how a phase works. Describe the phases at the level shown above; do not walk the customer through the implementation.When the customer chooses a phase, run that phase's scripts or flow to produce real results. Always operate the skill to answer — never answer from having read its source. For the exact commands, see "Running the assessment" in references/assessment-compatibility.md for Phase 2, and references/simulation.md for Phase 3.
2. Discovery intent (DEFAULT when IaC files are provided)
If the customer provides a directory path, IaC files, or says "here's our infra" —
this is discovery intent. Run ONLY Phase 1 (Discovery). Do NOT run assessment,
do NOT suggest migration steps, do NOT mention blockers or compatibility.
Produce the migrate-to-msk-skill-artifacts/<cluster_name>/cluster-config.json file and stop.
3. Assessment intent
Customer explicitly asks to assess or has a migrate-to-msk-skill-artifacts/<cluster_name>/cluster-config.json file
already produced. Run Phase 2 (Assessment) only.
4. Simulation intent
Customer wants to test MSK Express with their workload. They can provide cluster sizing directly (instance type, broker count, Kafka version) or reference an earlier assessment. Proceed directly to Phase 3 — Simulation. An assessment is helpful but not required — the simulation asks for sizing inputs directly.
5. Informational questions
Customer asks about Express capabilities, constraints, configuration differences,
authentication support, pricing, or compaction behavior without providing
cluster-specific data. Use AWS documentation tools (aws___search_documentation,
aws___read_documentation) if available to look up the answer from MSK Express
documentation. If MCP tools are not available, reference the
MSK Express documentation
and answer based on knowledge of AWS MSK.
6. Migration strategy questions
Customer asks about MSK Replicator compatibility, version upgrade paths, MirrorMaker 2,
or migration strategies. MSK Replicator is the native AWS-supported solution for data
replication and works for both MSK-to-MSK and non-MSK-to-MSK migrations. Use AWS
documentation tools (aws___search_documentation, aws___read_documentation) if
available to retrieve current requirements and supported configurations. If MCP tools
are not available, reference the
MSK Replicator documentation
and answer based on knowledge of AWS MSK.
Phase 1 — Discovery
Purpose: Inventory the source cluster to build a migration profile.
Input: One of:
A directory path containing IaC files (CDK, CloudFormation, Docker Compose, Kubernetes manifests, Terraform)
Output from Kafka CLI commands the customer runs on their cluster
Manual information provided by the customer in conversation
Output: migrate-to-msk-skill-artifacts/<cluster_name>/cluster-config.json — saved to the working directory.
Discovery rules
Before doing ANYTHING else in discovery, you MUST read references/discovery.md in full. It defines the input methods, the REQUIRED response template, the forbidden content, and the
cluster-config.jsonschema. Do NOT respond until you have read it, and follow its template EXACTLY.ALWAYS save
migrate-to-msk-skill-artifacts/<cluster_name>/cluster-config.jsonin the working directory.Do NOT proceed to Phase 2 without explicit customer confirmation.
Phase 2 — Assessment
Purpose: Assess the cluster against MSK Express requirements and produce a target Express specification (instance type, broker count, monthly cost projection).
Input: migrate-to-msk-skill-artifacts/<cluster_name>/cluster-config.json from Phase 1.
Outputs:
migrate-to-msk-skill-artifacts/<cluster_name>/compatibility.<cluster_name>.json— five-pillar verdict.migrate-to-msk-skill-artifacts/<cluster_name>/msk_sizing_pricing.md— the managing-amazon-msk Skill's pricing report with broker count and cost recommendations.migrate-to-msk-skill-artifacts/<cluster_name>/msk-sizing-inputs.<cluster_name>.json— a record of the six input values for sizing logic.
Assessment has two independent halves; run them in either order, and a failure in one does not block the other:
Compatibility —
scripts/compatibility.py, a pure file processor (no live AWS API calls) run viauv runwith PEP 723 inline dependencies. It validates the source across five pillars — topology, Kafka version, configs, auth, and quotas — and emits one verdict per pillar (INFO,ADVISORY, orACTION_REQUIRED, worst-of for the overall). Use those three strings verbatim.Sizing — not a script in this skill. Load the managing-amazon-msk Skill and run its
scripts/msk_sizing.pywith the workload inputs derived fromcluster-config.json, passing--broker-classes expressand--regionfor the target Region. The script prices from the live AWS Pricing API when credentials are available and from an embeddedus-east-1snapshot when they are not.
Assessment rules
Read references/assessment-compatibility.md before responding. It carries the invocation commands, the per-pillar thresholds and evidence codes, the verdict definitions, the full forbidden-behavior list, and the required response template covering both artifacts. Do not freestyle the post-script summary.
Read references/assessment-sizing.md before running sizing. It carries the input derivations (several are not one-to-one — getting them wrong silently produces a wrong broker count), the
target-block flags for rack affinity and negotiated discounts, the Region and pricing-source handling, the Express-only presentation rule, and the source-footprint comparison.Surface any
ACTION_REQUIREDevidence to the user for awareness, but do not gate further phases on it. Express may still accept the workload with mitigations.Do NOT pivot back into discovery. Assessment operates on the existing
cluster-config.jsonas-is. Partial data is fine — the scripts emit ADVISORY evidence (METRICS_MISSING,AZ_COUNT_UNKNOWN, etc.) for missing fields; surface those findings and stop. Do not propose Kafka CLI commands, IaC walks, scripts, or questionnaires to fill the gaps.Report broker counts and costs only as read verbatim from the sizing script output. Never round, re-derive, or estimate them. Report the
pricing sourcethe script used alongside the costs; when it isstatic, the rates are an embedded snapshot, not confirmed current pricing.
Phase 3 — Simulation (optional)
Deploy a temporary, isolated MSK Express cluster and client fleet in the customer's account so they can see how Express performs on their own workload, then run one of two vended tests (End-to-End Latency, Broker Restart Under Load) and hand over a CloudWatch dashboard. Follow the 12-step conversational flow and all deploy, sizing, and guardrail details in references/simulation.md; the deterministic artifacts it drives are scripts/simulation_load_test_config.py and the static assets/simulation-stack.yaml.
Execution model
Scripts run on the customer's local machine via uv run. They declare their own
dependencies (PEP 723) and are pure file processors — no AWS API calls, no
network access, and no third-party dependencies (standard library only).
Security Considerations
Apply these controls at every phase. For additional detail, see MSK Security best practices and MSK IAM access control.
Encryption in transit (mandatory). Enforce TLS for client-broker traffic on the MSK Express target (
EncryptionInTransit.ClientBroker = TLS).Encryption at rest (mandatory). Provision the target cluster with a customer-managed KMS key (or AWS-managed if your compliance posture allows).
Authentication — prefer IAM over long-lived credentials. Configure the MSK Express target with IAM authentication as the sole client auth method. This gives ephemeral, role-based credentials with full CloudTrail coverage.
Credential storage — use AWS Secrets Manager. Store SASL/SCRAM and TLS credentials for source cluster access in Secrets Manager. Never pass passwords as CLI arguments.
Network isolation. Deploy MSK clusters in private subnets. Use security groups scoped to specific CIDR ranges or security group references. Do NOT use 0.0.0.0/0 ingress rules.
CloudTrail logging and CloudWatch alarms. Ensure CloudTrail is enabled in the target account and covers
kafka.amazonaws.comAPI calls. Configure alarms:ClientAuthenticationFailure— surge indicates credential problems or attackConnectionCloseCount— abnormal spike may indicate connection-floodingCloudTrail metric filters for denied
kafka-cluster:*actionsConnection-rate alarms approaching the 100 conn/sec/broker IAM limit
Sensitive data handling. Discovery and assessment outputs contain broker addresses, auth hints, and broker config values. Treat these as sensitive — do not paste into public channels or ticketing systems without redaction.
Troubleshooting
Per-pillar findings, including the source topology and out-of-range config cases, are explained in references/assessment-compatibility.md.
Files
- ATTRIBUTION.mdAdded by AutoGineer908 B
- LICENSELicence file added by AutoGineer9.9 KiB
- NOTICELicence file added by AutoGineer67 B
- SKILL.md14.0 KiB
- assets/simulation-stack.yaml47.9 KiB
- references/assessment-compatibility.md23.1 KiB
- references/assessment-sizing.md14.8 KiB
- references/discovery.md14.8 KiB
- references/simulation.md38.6 KiB
- scripts/compatibility.pyScript46.7 KiB
- scripts/simulation_load_test_config.pyScript17.7 KiB
references/assessment-sizing.md
Assessment — Sizing
Sizing is delegated to the managing-amazon-msk Skill's pricing logic. This skill implements no sizing math and packages no sizing script of its own. Derive the workload inputs from the discovery contract, then use that skill's pricing logic to produce the recommended instance type, broker count, and monthly cost.
Response format: the assessment response template that covers both compatibility AND sizing artifacts lives in
assessment-compatibility.mdunder "Response Template". Do not invent a separate sizing-only response shape; the user gets one combined response with both artifact paths.
Using managing-amazon-msk Skill's pricing logic (agent flow)
Load the managing-amazon-msk Skill. How you reach its sizing script depends on how skills are available in this environment — the same MCP-vs-local split described in the guardrail section of assessment-compatibility.md, applied to the other skill:
AWS MCP available. Call
retrieve_skillfor themanaging-amazon-mskskill, then fetchscripts/msk_sizing.pythrough the same tool by passingfile="scripts/msk_sizing.py", and run the content it returns.Skills installed locally. Run the script from the local
managing-amazon-mskskill directory, for exampleuv run <path to skills>/managing-amazon-msk/scripts/msk_sizing.py .... Sibling skill directories live alongside this one (.claude/skills/,~/.claude/skills/,.kiro/skills/, etc.).
Read
target.rack_affined_consumersandtarget.pricing_discount_pctfrom the discovery contract. Ask the user only for the ones that arenullor absent. Both are covered in the next two sections.Derive the workload inputs from
cluster-config.jsonper "Deriving the sizing inputs" below. Two of the conversions are not one-to-one; getting them wrong produces a silently incorrect broker count.Run sizing with
--broker-classes expressto understand the options, sizing constraints, and cost explanations.--broker-classes expresskeeps Standard instance types out of the output entirely. Verify the script's "Sizing inputs" block matches the values you intended to pass before reading any broker count. Addstandardto the flag only in the comparison cases listed below. Add--discount-pctand--no-rack-affined-consumersper the answers from step 2. Pass--regionwhen the target is notus-east-1— see "Region and pricing source" below.Read the recommendations. Create an
msk_sizing_pricing.mdsummary explaining the recommendation, inputs, sizing scenario, constraints, and cost-optimization tradeoffs for the workload. Record the rack-affinity assumption, any discount applied, and thepricing sourcevalue from the script's "Sizing inputs" block that produced the figures.
Deriving the sizing inputs
cluster-config.json records throughput per broker and partitions as leader
counts. msk_sizing.py expects total cluster throughput and total partition
replicas. Apply these conversions — do not pass the contract values through
unchanged.
msk_sizing.py flag | Derivation from cluster-config.json |
|---|---|
--peak-data-in-mbs | metrics.peak_bytes_in_per_broker_mbps × topology.num_brokers |
--peak-data-out-mbs | metrics.peak_bytes_out_per_broker_mbps × topology.num_brokers |
--avg-data-in-mbs | metrics.avg_bytes_in_per_broker_mbps × topology.num_brokers. When the field is null, use peak_in / 2 and say so in msk_sizing_pricing.md. |
--avg-data-out-mbs | metrics.avg_bytes_out_per_broker_mbps × topology.num_brokers. When the field is null, use peak_out / 2 and say so in msk_sizing_pricing.md. |
--num-partitions | sum(topics[].num_partitions) × 3. The contract stores leader counts; the flag wants total replicas, and Express always uses RF=3. Never use the source cluster's own replication factor here. |
--retention-hours | ceil(max(topics[].configs["retention.ms"]) ÷ 3_600_000) — the flag takes an integer hour count, so round up so retention is never under-estimated. Default to 24 when no topic declares it. |
--primary-retention-hours | Same value as --retention-hours — equal values disable Tiered Storage, which is correct for an Express target. If customer asks to compare Standard, and uses Tiered Storage today, pass the customer's Tiered Storage configuration. Only relevant for when customer asks for Standard comparison. |
--replication-factor | Omit. The default of 3 matches Express. |
--broker-classes | express (see "Present Express only"). |
--discount-pct | target.pricing_discount_pct (see "Negotiated pricing"). |
--no-rack-affined-consumers | Pass when target.rack_affined_consumers is false (see "Consumer rack affinity"). |
--region | The Region the customer is migrating into. Omit only when that is us-east-1 (the script default). |
--pricing-source | Omit — the default handles both the credentialed and credential-free cases. See "Region and pricing source". |
Record the derived values — not the raw contract values — in
msk-sizing-inputs.<cluster_name>.json, so the sizing run is reproducible.
If metrics is absent entirely or topology.num_brokers is null, you cannot
derive total throughput. Report that sizing could not be produced and surface the
compatibility METRICS_MISSING advisory. Do not substitute guessed throughput
figures, and do not pivot back into discovery to collect them.
Negotiated pricing
Read target.pricing_discount_pct from cluster-config.json. A number is the
percentage the customer stated (0 means they confirmed no discount). When the field
is null or absent, ask — alongside the rack affinity question if that one is also
missing:
Does your organization have a Private Pricing Agreement (PPA), Enterprise Discount Program (EDP), or other negotiated AWS pricing? If so, what discount percentage should I apply? Without one I will report public on-demand pricing.
Pass it as --discount-pct N, which applies the discount uniformly to brokers,
storage, Express data-in, and cross-AZ transfer. Broker counts do not change.
Do not guess a percentage and do not apply one the customer did not state. When they
do not have a discount or do not know it, run at public pricing and include this note
in msk_sizing_pricing.md:
Note on pricing: All cost estimates are based on AWS public on-demand pricing. If your organization has a Private Pricing Agreement (PPA), Enterprise Discount Program (EDP), or other negotiated pricing, your actual costs will differ. Contact your AWS account team for pricing that reflects your agreements.
When a discount was applied, state the percentage in msk_sizing_pricing.md and tell
the customer to confirm it with their AWS account team before using the figures for
budgeting.
Region and pricing source
Pass --region for the Region the customer is migrating into; the script defaults to us-east-1 and rates differ per Region.
With AWS credentials the script fetches live rates. Without them it falls back to an embedded us-east-1 snapshot — expected here, since Assessment often has no credentials for the target account. Read the pricing source row in the "Sizing inputs" block and record it in msk_sizing_pricing.md; when it reads static, add this note:
Note on pricing source: These figures use
us-east-1rates embedded in the sizing script and captured on <date from the script banner>, not a live pricing lookup. Re-run with AWS credentials available to confirm against current published rates.
Pricing a non-us-east-1 Region needs credentials. Without them the script exits non-zero and prints nothing at all — not even a broker count, since pricing resolves before any broker math. Report that sizing could not be produced and ask the customer for credentials or a confirmed Region. Never re-run against us-east-1 and present the result as the target Region's cost.
Consumer rack affinity
Cross-AZ consumer fetch is often one of the largest line items in the estimate. Read
target.rack_affined_consumers from cluster-config.json. When it is null or
absent, ask before you run sizing — this and negotiated pricing are the only inputs
Assessment may request (see "Assessment scope — forbidden behavior" in
assessment-compatibility.md):
Will your consumers fetch from local-AZ replicas on the Express target — rack-aware fetching, with
client.rackset on each consumer andreplica.selector.class=RackAwareReplicaSelectoron the cluster — or will they fetch from partition leaders in any AZ?
Map the contract value (or the answer) to the sizing flags:
target.rack_affined_consumers | Answer | Flag |
|---|---|---|
true | Rack-aware / local-AZ fetching | Omit the flag — rack affinity is the script default |
false | Fetch from leaders in any AZ, or no rack configuration planned | --no-rack-affined-consumers |
null | Unknown | Run both ways |
For a self-managed source there may be no AZ topology to carry over, so treat this as a decision about the target rather than a fact about the source. Ask whether they intend to configure rack-aware fetching on the Express cluster.
When the answer is unknown, run sizing both ways, report the rack-affined figure as
the recommendation, and present the difference as avoidable cost. Recommend enabling
rack-aware fetching on the target either way — see
references/configure-clients.md in the managing-amazon-msk skill for
the client.rack and replica.selector.class settings.
This flag changes cost only, never broker count. State which assumption you used in
msk_sizing_pricing.md.
Present Express only
This skill migrates workloads to Express. Report the Express pick; do not put Standard instance types, broker counts, or costs in msk_sizing_pricing.md or in your response.
Run with --broker-classes standard,express only when the customer explicitly asks to compare classes, asks why not Standard, or hits a Standard-only condition. Refer to references/size-and-choose-cluster.md in the managing-amazon-msk skill, lead with the Express pick and present Standard as the alternative, giving the context from the decision framework on why Express is better than Standard even with cost differences.
Do not volunteer Standard as a cost-optimization path, including Tiered Storage. Express storage is billed per GB-hour on data actually retained, which is the cost-effective option for nearly all workloads.
If the workload exceeds the broker quota at every Express size, recommend a quota increase, not Standard (which would also exceed broker quotas).
Compare the recommendation against the source footprint
Source clusters are frequently over-provisioned — sized for peak plus a safety margin, then never scaled back. Recommend the smaller, lower-cost target when the workload supports it, and show the delta.
Pull the source footprint from
cluster-config.json:topology.num_brokers,topology.num_azs,topology.broker_instance_type.Compare it against the Express recommendation. Recommend the Express pick even when it is materially smaller than the source. The script already models peak throughput, 1-AZ-down headroom, and partition limits, so a smaller broker count is not a reduction in resilience.
Explain why the target is smaller in terms the customer can verify: up to 3x ingress per broker, storage billed on retained data instead of provisioned EBS, and capacity for replication and rebalancing reserved by the service rather than bought as spare nodes.
State what you could not verify. Node-for-node comparison needs
topology.broker_instance_type, which is optional in the discovery contract. Without it, compare broker counts only and say so.
Do not inflate the recommendation to match the source footprint. If the customer wants headroom beyond what the script models, name the recommended pick first and the larger option second, with the cost difference.
Caveats
Average throughput is optional in the discovery contract. The sizing script uses average throughput for storage volume and cost projection (e.g. cross-AZ data transfer). When
metrics.avg_bytes_*_per_broker_mbpsisnull, thepeak / 2fallback from the derivation table applies and the cost figures are correspondingly rough. Real average values give more accurate cost projections; broker count is driven by peak either way.Retention is per-topic in the discovery contract; the skill takes one number. The skill emits the max over topics as an upper-bound storage estimate. Override by passing a smaller
--retention-hours(derived per the table above) if the source has a small set of low-retention topics dominating the storage picture, and say so inmsk_sizing_pricing.md. Express storage is billed per GB-hour on retained data, so right-sizing per-topic retention is the storage cost lever — not a change of broker class.Pricing is public on-demand, and
us-east-1unless you pass--region. Apply a customer-stated Private Pricing Agreement (PPA) or Enterprise Discount Program (EDP) discount with--discount-pct— see "Negotiated pricing" above. Rates may also come from an embedded snapshot rather than a live lookup — see "Region and pricing source" below.
Key recommendations
Express recommendations: Broker instance size (express.m7g.large through express.m7g.16xlarge) and count
Bottleneck breakdown: per instance, which constraint (ingress / egress / partitions / storage) drives the broker count.
Refresh procedure
When new skill updates are released, pricing logic can be re-run with the managing-amazon-msk Skill's pricing logic.
Security considerations
Discovery input may contain credentials. The sizing inputs are derived from
cluster-config.json, whosesecurityblock may carry credential material (SASL passwords, API keys, TLS private keys) if discovery captured more than the authentication mechanism. Verify the input has none before deriving inputs or sharing the file; redact anything resembling a credential.Sizing inputs reveal capacity and topology details. The
msk-sizing-inputs.<cluster_name>.jsonandmsk_sizing_pricing.mdartifacts contain peak throughput, partition count, retention, and the recommended broker count and instance type for the workload. Treat them as sensitive — these details are useful inputs for targeted attacks. Do not share via unencrypted email, public channels, or public ticketing systems without redaction.Store with restrictive permissions. Keep the artifact inside
migrate-to-msk-skill-artifacts/<cluster_name>/and apply restrictive permissions (e.g.,chmod 600) appropriate for your environment.
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs an MCP server, Needs Python
Security
What our scanner noticed· Low risk
- Instructions that use the network
- Scripts that your agent may run
This skill includes scripts that your agent may run. Read them before you use it.
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- AWS
- Publisher
- AWS (Official)
- Source
- aws/agent-toolkit-for-aws · plugins/aws-data-analytics/skills/migrate-to-msk · commit 0a218f8
- Licence
- Apache License 2.0 (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- NOTICE (added by AutoGineer from NOTICE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
- Also distributed in
- aws/agent-toolkit-for-aws
AutoGineer is not affiliated with or endorsed by AWS.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download migrate-to-msk.zip