Generated banner for Migrate To Msk
Generated logo for Migrate To Msk

Migrate To Msk

AWSOfficialPublished by AWS

  • Skill
  • Workflow
  • Cloud and DevOps
  • Apache-2.0
  • Low risk
  • Has scripts

From the author

Helps migrate self-managed Apache Kafka workloads to Amazon MSK Express. Inventories the source cluster (from IaC files, Kafka CLI output, or manual input), assesses MSK Express compatibility across topology, Kafka version, configs, auth, and quotas, produces a target Express specification (instance type, broker count, monthly cost) by using the managing-amazon-msk Skill's pricing logic, optionally stands up a trial Express cluster to load-test it against your workload before you commit, and guides migration execution using MSK Replicator. Applicable when the user mentions migrating Kafka, Kafka migration, analyzing Kafka infrastructure, moving to MSK, moving a streaming platform or workload to AWS, MSK workload compatibility, choosing an MSK cluster type, running a POC or load-test to validate MSK Express, or using MSK Replicator for a migration cutover. Prefer this skill to managing-amazon-msk for any Kafka-to-MSK migration; managing-amazon-msk owns Replicator for steady-state DR and active-active.
— the description by AWS

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a comprehensive, three-phase framework for migrating self-managed Apache Kafka clusters to Amazon MSK Express. It guides users through inventory discovery, compatibility assessment, and performance simulation to ensure a smooth transition. By analyzing existing infrastructure, the skill identifies potential configuration gaps, calculates target sizing, and provides cost projections, while also offering support for data replication using MSK Replicator.

What it does

  • Inventories source Kafka clusters from IaC files, CLI output, or manual input.
  • Assesses compatibility across topology, Kafka versions, configurations, auth, and quotas.
  • Generates target MSK Express specifications, including broker counts and cost estimates.
  • Facilitates optional load-testing via temporary MSK Express trial clusters.
  • Provides guidance on using MSK Replicator for migration cutovers.
  • Produces standardized artifacts for cluster configuration and compatibility findings.

When to use it

  • When planning a migration from self-managed Kafka to Amazon MSK Express.
  • When you need to assess the compatibility of your current Kafka setup with MSK Express.
  • When you require an accurate sizing and cost projection for an MSK Express target.
  • When you want to validate performance through a proof-of-concept load test before migrating.
  • When you need a structured approach to inventorying your existing streaming infrastructure.

Advantages

  • Reduces migration risk through automated compatibility and topology assessment.
  • Provides data-driven cost and sizing recommendations based on actual workload metrics.
  • Supports informed decision-making with optional pre-migration performance simulation.
  • Standardizes the migration process across discovery, assessment, and execution phases.
  • Integrates with existing IaC workflows for efficient inventory collection.

Usage examples

“I need to migrate my on-premises Kafka cluster to MSK Express. Where do I start?”
The agent will explain the three-phase migration process (Discovery, Assessment, Simulation) and ask for your infrastructure details or IaC files to begin the discovery phase.
“Here is my Terraform directory for our Kafka cluster. Can you assess if it is compatible with MSK Express?”
The agent will perform the discovery phase to generate a cluster configuration and then proceed to the assessment phase to validate compatibility and provide sizing recommendations.
“I have a cluster-config.json file. How do I get a cost estimate for moving to MSK Express?”
The agent will run the assessment phase using your configuration file to produce a compatibility report and a pricing summary for the recommended MSK Express setup.
“How do I test MSK Express performance with my current workload?”
The agent will guide you through the simulation phase, helping you deploy a temporary MSK Express cluster to run load tests and review performance metrics.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/aws/migrate-to-msk/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip migrate-to-msk.zip -d .agents/skills

Documentation by AWS

Migrating to MSK Express

Overview

This skill helps customers migrate self-managed Apache Kafka workloads to Amazon MSK Express. It provides three phases — Discovery, Assessment, and an optional Simulation — that can be run end-to-end or individually depending on the customer's needs.

Scope

This skill covers migrations from self-managed Apache Kafka (on-premises, EC2, Docker, Kubernetes, or other non-MSK deployments) to MSK Express. Migrations from MSK Standard (Provisioned) to MSK Express are out of scope.

Prerequisites

The AWS MCP server is recommended for documentation lookups and informational questions, but is not required. The assessment scripts are pure file processors with no AWS API calls.

Intent Routing

Route the customer's request based on their intent:

1. Open/exploratory question ("How do I migrate to MSK?")

Explain what this skill offers:

This skill helps you migrate to MSK Express in three phases:

Phase 1 — Discovery: Inventory your source Kafka cluster — brokers, topics, partition counts, configs, authentication, and workload metrics — plus two target decisions that drive cost: consumer rack affinity and any negotiated AWS pricing. I can discover this from IaC files (Terraform, CDK, Docker Compose, Kubernetes manifests), provide commands for you to run on your cluster, or you can provide the information manually. Output: migrate-to-msk-skill-artifacts/<cluster_name>/cluster-config.json.

Phase 2 — Assessment: Validate your cluster against MSK Express across 5 compatibility pillars (topology, Kafka version, configs, auth, quotas) and produce a target Express specification using the managing-amazon-msk Skill's pricing logic. I'll flag what Express will refuse vs what Express will silently convert. Outputs: compatibility.<cluster_name>.json, the pricing results in Markdown msk_sizing_pricing.md, and msk-sizing-inputs.<cluster_name>.json.

Phase 3 — Simulation: Spin up an MSK Express cluster with load-testing infrastructure to see how Express performs on your own workload, then run a vended test (End-to-End Latency or Broker Restart Under Load) and review the results on a CloudWatch dashboard.

Data replication: For migrating data to your Express cluster, you can use MSK Replicator. I can provide guidance on setup and configuration.

Where would you like to start? I can begin with discovery if you point me to your infrastructure code or describe your cluster, or jump to assessment if you already have a cluster-config.json file, or go straight to simulation if you already know your target Express configuration.

Guardrails for this overview response:

  • This response is an overview and a routing question only. Do NOT begin, simulate, or pre-empt any phase.

  • Do NOT produce or estimate assessment output here — no verdicts, pillar findings, compatibility conclusions, broker counts, instance recommendations, or cost figures. Those values exist only after you run the Phase 2 scripts against a real cluster-config.json.

  • Do NOT open, read, or summarize the internals of compatibility.py, simulation_load_test_config.py, or the reference files to explain how a phase works. Describe the phases at the level shown above; do not walk the customer through the implementation.

  • When the customer chooses a phase, run that phase's scripts or flow to produce real results. Always operate the skill to answer — never answer from having read its source. For the exact commands, see "Running the assessment" in references/assessment-compatibility.md for Phase 2, and references/simulation.md for Phase 3.

2. Discovery intent (DEFAULT when IaC files are provided)

If the customer provides a directory path, IaC files, or says "here's our infra" — this is discovery intent. Run ONLY Phase 1 (Discovery). Do NOT run assessment, do NOT suggest migration steps, do NOT mention blockers or compatibility. Produce the migrate-to-msk-skill-artifacts/<cluster_name>/cluster-config.json file and stop.

3. Assessment intent

Customer explicitly asks to assess or has a migrate-to-msk-skill-artifacts/<cluster_name>/cluster-config.json file already produced. Run Phase 2 (Assessment) only.

4. Simulation intent

Customer wants to test MSK Express with their workload. They can provide cluster sizing directly (instance type, broker count, Kafka version) or reference an earlier assessment. Proceed directly to Phase 3 — Simulation. An assessment is helpful but not required — the simulation asks for sizing inputs directly.

5. Informational questions

Customer asks about Express capabilities, constraints, configuration differences, authentication support, pricing, or compaction behavior without providing cluster-specific data. Use AWS documentation tools (aws___search_documentation, aws___read_documentation) if available to look up the answer from MSK Express documentation. If MCP tools are not available, reference the MSK Express documentation and answer based on knowledge of AWS MSK.

6. Migration strategy questions

Customer asks about MSK Replicator compatibility, version upgrade paths, MirrorMaker 2, or migration strategies. MSK Replicator is the native AWS-supported solution for data replication and works for both MSK-to-MSK and non-MSK-to-MSK migrations. Use AWS documentation tools (aws___search_documentation, aws___read_documentation) if available to retrieve current requirements and supported configurations. If MCP tools are not available, reference the MSK Replicator documentation and answer based on knowledge of AWS MSK.


Phase 1 — Discovery

Purpose: Inventory the source cluster to build a migration profile.

Input: One of:

  • A directory path containing IaC files (CDK, CloudFormation, Docker Compose, Kubernetes manifests, Terraform)

  • Output from Kafka CLI commands the customer runs on their cluster

  • Manual information provided by the customer in conversation

Output: migrate-to-msk-skill-artifacts/<cluster_name>/cluster-config.json — saved to the working directory.

Discovery rules
  • Before doing ANYTHING else in discovery, you MUST read references/discovery.md in full. It defines the input methods, the REQUIRED response template, the forbidden content, and the cluster-config.json schema. Do NOT respond until you have read it, and follow its template EXACTLY.

  • ALWAYS save migrate-to-msk-skill-artifacts/<cluster_name>/cluster-config.json in the working directory.

  • Do NOT proceed to Phase 2 without explicit customer confirmation.


Phase 2 — Assessment

Purpose: Assess the cluster against MSK Express requirements and produce a target Express specification (instance type, broker count, monthly cost projection).

Input: migrate-to-msk-skill-artifacts/<cluster_name>/cluster-config.json from Phase 1.

Outputs:

  • migrate-to-msk-skill-artifacts/<cluster_name>/compatibility.<cluster_name>.json — five-pillar verdict.

  • migrate-to-msk-skill-artifacts/<cluster_name>/msk_sizing_pricing.md — the managing-amazon-msk Skill's pricing report with broker count and cost recommendations.

  • migrate-to-msk-skill-artifacts/<cluster_name>/msk-sizing-inputs.<cluster_name>.json — a record of the six input values for sizing logic.

Assessment has two independent halves; run them in either order, and a failure in one does not block the other:

  • Compatibility — scripts/compatibility.py, a pure file processor (no live AWS API calls) run via uv run with PEP 723 inline dependencies. It validates the source across five pillars — topology, Kafka version, configs, auth, and quotas — and emits one verdict per pillar (INFO, ADVISORY, or ACTION_REQUIRED, worst-of for the overall). Use those three strings verbatim.

  • Sizing — not a script in this skill. Load the managing-amazon-msk Skill and run its scripts/msk_sizing.py with the workload inputs derived from cluster-config.json, passing --broker-classes express and --region for the target Region. The script prices from the live AWS Pricing API when credentials are available and from an embedded us-east-1 snapshot when they are not.

Assessment rules
  • Read references/assessment-compatibility.md before responding. It carries the invocation commands, the per-pillar thresholds and evidence codes, the verdict definitions, the full forbidden-behavior list, and the required response template covering both artifacts. Do not freestyle the post-script summary.

  • Read references/assessment-sizing.md before running sizing. It carries the input derivations (several are not one-to-one — getting them wrong silently produces a wrong broker count), the target-block flags for rack affinity and negotiated discounts, the Region and pricing-source handling, the Express-only presentation rule, and the source-footprint comparison.

  • Surface any ACTION_REQUIRED evidence to the user for awareness, but do not gate further phases on it. Express may still accept the workload with mitigations.

  • Do NOT pivot back into discovery. Assessment operates on the existing cluster-config.json as-is. Partial data is fine — the scripts emit ADVISORY evidence (METRICS_MISSING, AZ_COUNT_UNKNOWN, etc.) for missing fields; surface those findings and stop. Do not propose Kafka CLI commands, IaC walks, scripts, or questionnaires to fill the gaps.

  • Report broker counts and costs only as read verbatim from the sizing script output. Never round, re-derive, or estimate them. Report the pricing source the script used alongside the costs; when it is static, the rates are an embedded snapshot, not confirmed current pricing.


Phase 3 — Simulation (optional)

Deploy a temporary, isolated MSK Express cluster and client fleet in the customer's account so they can see how Express performs on their own workload, then run one of two vended tests (End-to-End Latency, Broker Restart Under Load) and hand over a CloudWatch dashboard. Follow the 12-step conversational flow and all deploy, sizing, and guardrail details in references/simulation.md; the deterministic artifacts it drives are scripts/simulation_load_test_config.py and the static assets/simulation-stack.yaml.


Execution model

Scripts run on the customer's local machine via uv run. They declare their own dependencies (PEP 723) and are pure file processors — no AWS API calls, no network access, and no third-party dependencies (standard library only).

Security Considerations

Apply these controls at every phase. For additional detail, see MSK Security best practices and MSK IAM access control.

  1. Encryption in transit (mandatory). Enforce TLS for client-broker traffic on the MSK Express target (EncryptionInTransit.ClientBroker = TLS).

  2. Encryption at rest (mandatory). Provision the target cluster with a customer-managed KMS key (or AWS-managed if your compliance posture allows).

  3. Authentication — prefer IAM over long-lived credentials. Configure the MSK Express target with IAM authentication as the sole client auth method. This gives ephemeral, role-based credentials with full CloudTrail coverage.

  4. Credential storage — use AWS Secrets Manager. Store SASL/SCRAM and TLS credentials for source cluster access in Secrets Manager. Never pass passwords as CLI arguments.

  5. Network isolation. Deploy MSK clusters in private subnets. Use security groups scoped to specific CIDR ranges or security group references. Do NOT use 0.0.0.0/0 ingress rules.

  6. CloudTrail logging and CloudWatch alarms. Ensure CloudTrail is enabled in the target account and covers kafka.amazonaws.com API calls. Configure alarms:

    • ClientAuthenticationFailure — surge indicates credential problems or attack

    • ConnectionCloseCount — abnormal spike may indicate connection-flooding

    • CloudTrail metric filters for denied kafka-cluster:* actions

    • Connection-rate alarms approaching the 100 conn/sec/broker IAM limit

  7. Sensitive data handling. Discovery and assessment outputs contain broker addresses, auth hints, and broker config values. Treat these as sensitive — do not paste into public channels or ticketing systems without redaction.

Troubleshooting

Per-pillar findings, including the source topology and out-of-range config cases, are explained in references/assessment-compatibility.md.

Files

references/assessment-sizing.md

Assessment — Sizing

Sizing is delegated to the managing-amazon-msk Skill's pricing logic. This skill implements no sizing math and packages no sizing script of its own. Derive the workload inputs from the discovery contract, then use that skill's pricing logic to produce the recommended instance type, broker count, and monthly cost.

Response format: the assessment response template that covers both compatibility AND sizing artifacts lives in assessment-compatibility.md under "Response Template". Do not invent a separate sizing-only response shape; the user gets one combined response with both artifact paths.

Using managing-amazon-msk Skill's pricing logic (agent flow)

  1. Load the managing-amazon-msk Skill. How you reach its sizing script depends on how skills are available in this environment — the same MCP-vs-local split described in the guardrail section of assessment-compatibility.md, applied to the other skill:

    • AWS MCP available. Call retrieve_skill for the managing-amazon-msk skill, then fetch scripts/msk_sizing.py through the same tool by passing file="scripts/msk_sizing.py", and run the content it returns.

    • Skills installed locally. Run the script from the local managing-amazon-msk skill directory, for example uv run <path to skills>/managing-amazon-msk/scripts/msk_sizing.py .... Sibling skill directories live alongside this one (.claude/skills/, ~/.claude/skills/, .kiro/skills/, etc.).

  2. Read target.rack_affined_consumers and target.pricing_discount_pct from the discovery contract. Ask the user only for the ones that are null or absent. Both are covered in the next two sections.

  3. Derive the workload inputs from cluster-config.json per "Deriving the sizing inputs" below. Two of the conversions are not one-to-one; getting them wrong produces a silently incorrect broker count.

  4. Run sizing with --broker-classes express to understand the options, sizing constraints, and cost explanations. --broker-classes express keeps Standard instance types out of the output entirely. Verify the script's "Sizing inputs" block matches the values you intended to pass before reading any broker count. Add standard to the flag only in the comparison cases listed below. Add --discount-pct and --no-rack-affined-consumers per the answers from step 2. Pass --region when the target is not us-east-1 — see "Region and pricing source" below.

  5. Read the recommendations. Create an msk_sizing_pricing.md summary explaining the recommendation, inputs, sizing scenario, constraints, and cost-optimization tradeoffs for the workload. Record the rack-affinity assumption, any discount applied, and the pricing source value from the script's "Sizing inputs" block that produced the figures.

Deriving the sizing inputs

cluster-config.json records throughput per broker and partitions as leader counts. msk_sizing.py expects total cluster throughput and total partition replicas. Apply these conversions — do not pass the contract values through unchanged.

msk_sizing.py flagDerivation from cluster-config.json
--peak-data-in-mbsmetrics.peak_bytes_in_per_broker_mbps × topology.num_brokers
--peak-data-out-mbsmetrics.peak_bytes_out_per_broker_mbps × topology.num_brokers
--avg-data-in-mbsmetrics.avg_bytes_in_per_broker_mbps × topology.num_brokers. When the field is null, use peak_in / 2 and say so in msk_sizing_pricing.md.
--avg-data-out-mbsmetrics.avg_bytes_out_per_broker_mbps × topology.num_brokers. When the field is null, use peak_out / 2 and say so in msk_sizing_pricing.md.
--num-partitionssum(topics[].num_partitions) × 3. The contract stores leader counts; the flag wants total replicas, and Express always uses RF=3. Never use the source cluster's own replication factor here.
--retention-hoursceil(max(topics[].configs["retention.ms"]) ÷ 3_600_000) — the flag takes an integer hour count, so round up so retention is never under-estimated. Default to 24 when no topic declares it.
--primary-retention-hoursSame value as --retention-hours — equal values disable Tiered Storage, which is correct for an Express target. If customer asks to compare Standard, and uses Tiered Storage today, pass the customer's Tiered Storage configuration. Only relevant for when customer asks for Standard comparison.
--replication-factorOmit. The default of 3 matches Express.
--broker-classesexpress (see "Present Express only").
--discount-pcttarget.pricing_discount_pct (see "Negotiated pricing").
--no-rack-affined-consumersPass when target.rack_affined_consumers is false (see "Consumer rack affinity").
--regionThe Region the customer is migrating into. Omit only when that is us-east-1 (the script default).
--pricing-sourceOmit — the default handles both the credentialed and credential-free cases. See "Region and pricing source".

Record the derived values — not the raw contract values — in msk-sizing-inputs.<cluster_name>.json, so the sizing run is reproducible.

If metrics is absent entirely or topology.num_brokers is null, you cannot derive total throughput. Report that sizing could not be produced and surface the compatibility METRICS_MISSING advisory. Do not substitute guessed throughput figures, and do not pivot back into discovery to collect them.

Negotiated pricing

Read target.pricing_discount_pct from cluster-config.json. A number is the percentage the customer stated (0 means they confirmed no discount). When the field is null or absent, ask — alongside the rack affinity question if that one is also missing:

Does your organization have a Private Pricing Agreement (PPA), Enterprise Discount Program (EDP), or other negotiated AWS pricing? If so, what discount percentage should I apply? Without one I will report public on-demand pricing.

Pass it as --discount-pct N, which applies the discount uniformly to brokers, storage, Express data-in, and cross-AZ transfer. Broker counts do not change.

Do not guess a percentage and do not apply one the customer did not state. When they do not have a discount or do not know it, run at public pricing and include this note in msk_sizing_pricing.md:

Note on pricing: All cost estimates are based on AWS public on-demand pricing. If your organization has a Private Pricing Agreement (PPA), Enterprise Discount Program (EDP), or other negotiated pricing, your actual costs will differ. Contact your AWS account team for pricing that reflects your agreements.

When a discount was applied, state the percentage in msk_sizing_pricing.md and tell the customer to confirm it with their AWS account team before using the figures for budgeting.

Region and pricing source

Pass --region for the Region the customer is migrating into; the script defaults to us-east-1 and rates differ per Region.

With AWS credentials the script fetches live rates. Without them it falls back to an embedded us-east-1 snapshot — expected here, since Assessment often has no credentials for the target account. Read the pricing source row in the "Sizing inputs" block and record it in msk_sizing_pricing.md; when it reads static, add this note:

Note on pricing source: These figures use us-east-1 rates embedded in the sizing script and captured on <date from the script banner>, not a live pricing lookup. Re-run with AWS credentials available to confirm against current published rates.

Pricing a non-us-east-1 Region needs credentials. Without them the script exits non-zero and prints nothing at all — not even a broker count, since pricing resolves before any broker math. Report that sizing could not be produced and ask the customer for credentials or a confirmed Region. Never re-run against us-east-1 and present the result as the target Region's cost.

Consumer rack affinity

Cross-AZ consumer fetch is often one of the largest line items in the estimate. Read target.rack_affined_consumers from cluster-config.json. When it is null or absent, ask before you run sizing — this and negotiated pricing are the only inputs Assessment may request (see "Assessment scope — forbidden behavior" in assessment-compatibility.md):

Will your consumers fetch from local-AZ replicas on the Express target — rack-aware fetching, with client.rack set on each consumer and replica.selector.class=RackAwareReplicaSelector on the cluster — or will they fetch from partition leaders in any AZ?

Map the contract value (or the answer) to the sizing flags:

target.rack_affined_consumersAnswerFlag
trueRack-aware / local-AZ fetchingOmit the flag — rack affinity is the script default
falseFetch from leaders in any AZ, or no rack configuration planned--no-rack-affined-consumers
nullUnknownRun both ways

For a self-managed source there may be no AZ topology to carry over, so treat this as a decision about the target rather than a fact about the source. Ask whether they intend to configure rack-aware fetching on the Express cluster.

When the answer is unknown, run sizing both ways, report the rack-affined figure as the recommendation, and present the difference as avoidable cost. Recommend enabling rack-aware fetching on the target either way — see references/configure-clients.md in the managing-amazon-msk skill for the client.rack and replica.selector.class settings.

This flag changes cost only, never broker count. State which assumption you used in msk_sizing_pricing.md.

Present Express only

This skill migrates workloads to Express. Report the Express pick; do not put Standard instance types, broker counts, or costs in msk_sizing_pricing.md or in your response.

Run with --broker-classes standard,express only when the customer explicitly asks to compare classes, asks why not Standard, or hits a Standard-only condition. Refer to references/size-and-choose-cluster.md in the managing-amazon-msk skill, lead with the Express pick and present Standard as the alternative, giving the context from the decision framework on why Express is better than Standard even with cost differences.

Do not volunteer Standard as a cost-optimization path, including Tiered Storage. Express storage is billed per GB-hour on data actually retained, which is the cost-effective option for nearly all workloads.

If the workload exceeds the broker quota at every Express size, recommend a quota increase, not Standard (which would also exceed broker quotas).

Compare the recommendation against the source footprint

Source clusters are frequently over-provisioned — sized for peak plus a safety margin, then never scaled back. Recommend the smaller, lower-cost target when the workload supports it, and show the delta.

  1. Pull the source footprint from cluster-config.json: topology.num_brokers, topology.num_azs, topology.broker_instance_type.

  2. Compare it against the Express recommendation. Recommend the Express pick even when it is materially smaller than the source. The script already models peak throughput, 1-AZ-down headroom, and partition limits, so a smaller broker count is not a reduction in resilience.

  3. Explain why the target is smaller in terms the customer can verify: up to 3x ingress per broker, storage billed on retained data instead of provisioned EBS, and capacity for replication and rebalancing reserved by the service rather than bought as spare nodes.

  4. State what you could not verify. Node-for-node comparison needs topology.broker_instance_type, which is optional in the discovery contract. Without it, compare broker counts only and say so.

Do not inflate the recommendation to match the source footprint. If the customer wants headroom beyond what the script models, name the recommended pick first and the larger option second, with the cost difference.

Caveats

  1. Average throughput is optional in the discovery contract. The sizing script uses average throughput for storage volume and cost projection (e.g. cross-AZ data transfer). When metrics.avg_bytes_*_per_broker_mbps is null, the peak / 2 fallback from the derivation table applies and the cost figures are correspondingly rough. Real average values give more accurate cost projections; broker count is driven by peak either way.

  2. Retention is per-topic in the discovery contract; the skill takes one number. The skill emits the max over topics as an upper-bound storage estimate. Override by passing a smaller --retention-hours (derived per the table above) if the source has a small set of low-retention topics dominating the storage picture, and say so in msk_sizing_pricing.md. Express storage is billed per GB-hour on retained data, so right-sizing per-topic retention is the storage cost lever — not a change of broker class.

  3. Pricing is public on-demand, and us-east-1 unless you pass --region. Apply a customer-stated Private Pricing Agreement (PPA) or Enterprise Discount Program (EDP) discount with --discount-pct — see "Negotiated pricing" above. Rates may also come from an embedded snapshot rather than a live lookup — see "Region and pricing source" below.

Key recommendations

  • Express recommendations: Broker instance size (express.m7g.large through express.m7g.16xlarge) and count

  • Bottleneck breakdown: per instance, which constraint (ingress / egress / partitions / storage) drives the broker count.

Refresh procedure

When new skill updates are released, pricing logic can be re-run with the managing-amazon-msk Skill's pricing logic.

Security considerations

  • Discovery input may contain credentials. The sizing inputs are derived from cluster-config.json, whose security block may carry credential material (SASL passwords, API keys, TLS private keys) if discovery captured more than the authentication mechanism. Verify the input has none before deriving inputs or sharing the file; redact anything resembling a credential.

  • Sizing inputs reveal capacity and topology details. The msk-sizing-inputs.<cluster_name>.json and msk_sizing_pricing.md artifacts contain peak throughput, partition count, retention, and the recommended broker count and instance type for the workload. Treat them as sensitive — these details are useful inputs for targeted attacks. Do not share via unencrypted email, public channels, or public ticketing systems without redaction.

  • Store with restrictive permissions. Keep the artifact inside migrate-to-msk-skill-artifacts/<cluster_name>/ and apply restrictive permissions (e.g., chmod 600) appropriate for your environment.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server, Needs Python

Security

What our scanner noticed· Low risk

  • Instructions that use the network
  • Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
AWS
Publisher
AWS (Official)
Source
aws/agent-toolkit-for-aws · plugins/aws-data-analytics/skills/migrate-to-msk · commit 0a218f8
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • NOTICE (added by AutoGineer from NOTICE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Also distributed in
aws/agent-toolkit-for-aws

AutoGineer is not affiliated with or endorsed by AWS.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download migrate-to-msk.zip