Overview
This skill provides domain expertise for choosing among AWS storage services, selecting storage classes, optimizing cost, and routing to resources for operating storage services. It covers object storage (S3 General Purpose buckets and their storage classes, S3 Express One Zone on directory buckets, S3 Tables, S3 Vectors), file storage (Amazon EFS, S3 Files, FSx for Lustre, FSx for NetApp ONTAP, FSx for OpenZFS, and FSx for Windows File Server), block storage (EBS volume types and EC2 instance store), and the data-movement and protection services that connect them (DataSync, Storage Gateway, Transfer Family, and AWS Backup). It does not advise on databases or analytics query engines. It works with or without the AWS MCP server; when available, the
AWS MCP server is recommended for verifying current specifications and pricing, and all guidance also works with the standard AWS CLI. For deep single-service tasks, route to the specialized skills listed in the Routing section below.
How to Handle User Queries
When this skill is triggered, classify the user's request and follow the appropriate path.
Rules
These apply to all responses regardless of path:
- You MUST verify current numbers. When the AWS MCP server is available, use search_documentation and read_documentation to cross-check before citing specifics. When quoting costs, you MUST include a link to the relevant pricing page. When quoting performance metrics, you MUST include a link to the relevant product page. Otherwise, verify against linked AWS documentation pages or use the AWS CLI to confirm current values. Where a reference file directs you to documentation for a current value, you MUST retrieve that value from the linked page before answering. Do not substitute a remembered figure, and do not offer an approximation or a range in place of a retrieved value. If retrieval is not possible in the current environment, name the value you could not verify rather than citing one from memory.
- You MUST retrieve the relevant service reference file from the Routing section below before answering questions about that service. AWS storage specifications, limits, and service capabilities change frequently. You MUST NOT answer from memory alone. You MUST surface relevant troubleshooting guidance and 'gotchas' from reference files in your response. Justify recommendations by workload fit, not by mentioning that a reference file 'explicitly' mentions a workload for a given service.
- You MUST include cost implications when recommending services or approaches. Do not wait for the user to ask. Do not compare services on storage charges alone; per-object fees such as metadata charges can materially change TCO. For deep cost analysis, monitoring, or optimization beyond storage selection, route to the
billing-and-cost-management
- You MUST have clarity on the user's need when making a recommendation. Match the specificity of your response to the specificity of the request. When the query determines the storage category and the relevant services, retrieve information and recommend directly. When the query is not fully specified, YOU MUST mention the assumptions and limitations of your recommendation and include the additional questions that would confirm or change it. Ask follow up questions in place of a recommendation only when the query does not let you determine the storage category at all. Recommend the best-fit service for the workload even when it falls outside this skill's scope; add relevant in-scope options as alternatives.
Step 1: Classify Intent
Determine what the user needs:
| Intent | Example Triggers | What this means |
|---|
| SELECT | "What should I use?", "Which service?", "Compare Service A vs Service B", "Help me choose", "I want to migrate X to AWS" (workload description without a named service) | User needs help choosing a storage service or approach |
| INVESTIGATE | "How do I configure Service X?", "Why is Service Y failing?", "What are the limits of Service Z?", "How do I get started with Service X?" (names a specific service and asks an operational question) | User knows what they are using and needs getting started, troubleshooting, or operational help |
You MUST follow the interaction logic in the corresponding path instructions below.
Ambiguous cases: If the user's primary ask is a recommendation, it is SELECT regardless of context. If they need help executing a known plan, it is INVESTIGATE.
Step 2a: SELECT Path
The user needs help choosing. You MUST use the following decision factors to inform your recommendation, asking questions to fill gaps that would change the choice.
Decision Factors:
| # | Decision Factor | What to understand |
|---|
| 1 | Workload Context | Is this a new workload or a migration of an existing workload? If migrating, what is the source system (e.g., NetApp, ZFS, Windows File Server, Lustre, GPFS, etc.)? What application or workload will access this storage? How does it access data (API, file protocol, block device)? What OS or platform are clients running? What is the data model (structured/tabular, vector embeddings, unstructured objects, file system)? |
| 2 | Capacity and Access Patterns | How much data, how many files or objects, what are the typical sizes? Sequential or random access pattern? Read-heavy, write-heavy, or mixed? |
| 3 | Performance Requirements | Are there specific latency, throughput, or IOPS requirements? What is the expected concurrency (number of clients or compute nodes accessing simultaneously)? |
| 4 | Durability and Data Protection | What is the recovery time objective (RTO)? Recovery point objective (RPO)? Compliance retention mandates? Cross-region resilience? Immutability needs? |
| 5 | Availability | Multi-AZ or Single-AZ acceptable? Co-located with specific compute? |
Use the Storage Options table to identify candidate services, not to cut services; keyword matches against the Common Workloads column are not the only answers. You MUST retrieve the reference files for each of the candidate services using the Routing section below.
Considering these factors, recommend specific AWS storage service(s) and:
- You MUST include clear rationale tied to the user's stated requirements.
- You MUST present alternatives where the choice is close or dependent on unspecified information, explaining the tradeoff.
Step 2b: INVESTIGATE Path
The user knows their service or approach and needs operational help.
- Classify the Question Domain based on the table below to identify which context matters.
| Question Domain | Example Triggers | What to clarify |
|---|
| Migration and Data Transfer | "How do I move my data to AWS?", "Set up DataSync", "Sync from on-premises NFS to EFS", source-to-destination questions | Source system and protocol, destination service, data volume, network path to AWS (Direct Connect, VPN, internet) |
| Data Protection and Resiliency | "Set up backup", "Cross-region replication", "What's my DR strategy?", "RTO under 1 hour", failover, immutability | Failure scenario (deletion, corruption, AZ/region loss, compliance hold), RTO and RPO targets, replication scope (same-region, cross-region, cross-account) |
| Cost and Lifecycle | "Reduce my storage bill", "Right-size my volumes", "Cost optimize", lifecycle rules, tiering decisions, storage class selection | Current service and configuration, access frequency (daily, weekly, rarely), data volume and growth trajectory |
| Performance | "My reads are slow", "Throughput bottleneck", "Need more IOPS", sizing | Observed vs. required (latency, IOPS, or throughput), access pattern (random/sequential, read/write mix), whether storage or compute/network is the suspected bottleneck |
| Security and Compliance | "Encrypt at rest", "Restrict bucket access", "Meet HIPAA", access control, compliance frameworks | Security objective (restrict access, audit access, encrypt, isolate network, meet compliance mandate), compliance framework if any |
| Configuration and Guidance | "Mount EFS on EKS", "Set up replication", "Does Service X support Y?", deployment steps, best practices | Client environment (OS, compute type, VPC/on-premises), target operation or feature |
| Troubleshooting | "Getting AccessDenied errors", "Mount is hanging", "Unexpected latency spike", "Why is my lifecycle rule not transitioning?" | Error message or symptom, what changed recently, what they have attempted |
- Ask scoping questions per the "What to clarify" column for information not already in the query. Where the missing detail would not change the guidance, answer under a stated assumption instead of waiting to ask more questions.
- You MUST retrieve the reference files from the Routing section below for all candidate services.
- Provide the answer with specific, actionable guidance, gotchas, and documentation links.
- When answering Configuration or Security questions, you MUST recommend enabling access logging, CloudTrail data events, and CloudWatch metrics for observability.
Storage Options
AWS storage services covered by this skill, grouped by storage category. For more information on storage categories, see
Block, file, and object storage compared.
Object Storage
| Service | Key Characteristics | Common Workloads |
|---|
| S3 General Purpose | Virtually unlimited-scale object storage with multiple storage classes spanning frequent-access to low-cost archive; lifecycle rules move data to lower-cost storage classes optimized for less-frequently accessed data. Regional availability. Accessed over a REST/HTTP API from anywhere. | Data lakes and analytics, backup and archive targets, ML training data, media storage and content distribution, log and event data, static website and application assets, regulatory and compliance archives |
| S3 Express One Zone | Single-AZ directory buckets optimized for single-digit millisecond latency on frequently accessed, latency-sensitive data. | large-scale ML training and inference, Spark and EMR shuffle, ML checkpoints, scratch, and model loading, ETL intermediate data, interactive analytics on hot partitions, observability and log analytics (hot tier), Kafka tiered storage, media and video editing, high-frequency transactional access, caching for machine learning inference |
| S3 Tables | Managed Apache Iceberg tables on S3 with automatic compaction and query optimization. Regional availability. Built for structured, tabular data queried with SQL engines. | Data lake tables, structured analytics data, ETL pipeline outputs, streaming into tables for SQL analysis, migration of open table format data outside of S3 or self-managed Iceberg on S3 |
| S3 Vectors | Vector storage and similarity search on S3 with native support to cost-effectively store and query vector embeddings. Provides the same elasticity, durability and availability as S3 General Purpose buckets. Regional availability. | RAG pipelines, semantic search, recommendation systems, vector deduplication and matching, anomaly and fraud detection, AI agent memory, cost-effective storage of large vector datasets |
| S3 Metadata | Queryable object metadata in fully managed, read-only Apache Iceberg tables including system-defined details, user-defined metadata, object tags, and annotations | Business analytics, content cataloging, data governance and compliance, storage optimization, real-time inference applications, AI agents |
File Storage
When naming a service, you MUST always specify the full name (FSx for Lustre, FSx for Windows File Server, FSx for NetApp ONTAP, or FSx for OpenZFS). EFS and S3 Files can be mounted by Lambda and Fargate. Verify additional services mountable from serverless compute with the latest AWS documentation. FSx for NetApp ONTAP and FSx for OpenZFS data is accessible from serverless compute and S3-based pipelines via S3 Access Points for FSx (exposes file data through the S3 API without copying; surface this when a user needs to read FSx-resident data from S3-native consumers or analytics services).
| Service | Key Characteristics | Common Workloads |
|---|
| EFS | EFS Standard, EFS Infrequent Access (EFS IA), and EFS Archive storage classes, managed by EFS Lifecycle Management for automatic cost optimization. Serverless elastic NFS with no capacity planning or provisioning, mountable by Lambda, Fargate, EC2, ECS, and EKS. Multi-AZ by default (Regional) or One Zone. Simplest path for shared Linux file access with high aggregate throughput across many concurrent clients. | Containers (ECS, EKS, Fargate), cloud-native Linux applications, serverless persistent storage, analytics and ML training data (including SageMaker), big data, media processing, content management, shared home directories, web serving, dev/test, infrequently accessed file data |
| FSx for Lustre | SSD and Intelligent-Tiering storage classes, where Intelligent-Tiering is fully elastic and SSD is fixed-capacity. Parallel file system delivering very high aggregate throughput for massively parallel access across many compute nodes. | ML and GPU training and inference at scale, HPC, genomics and seismic processing, financial modeling, media rendering, back-end EDA |
| FSx for OpenZFS | Intelligent-Tiering alongside SSD, with ZFS data management (instant writable clones, snapshots, compression, on-demand replication). Very low latency with high IOPS, simple to operate and cost-effective for performance-sensitive workloads and fast dev/test cycles. Single-AZ and Multi-AZ deployment model. S3-API access via S3 Access Points for FSx. | Databases (including on EC2), dev/test with fast clones, ZFS or Linux-NFS migrations, front-end EDA, financial modeling, media processing, latency-sensitive line-of-business applications |
| FSx for NetApp ONTAP | Full ONTAP data management (SnapMirror replication, FlexClone, dedup, compression, SnapLock WORM, QoS, vscan antivirus, file-access auditing). Multi-protocol: NFS, SMB, iSCSI, NVMe-over-TCP, and S3-API access via S3 Access Points for FSx. Scales to high aggregate throughput and IOPS. Single-AZ and Multi-AZ deployment model. | Enterprise network-attached storage (NAS) migrations, multi-protocol environments, general-purpose file shares and home directories, business-critical databases including on EC2 (SAP HANA, Oracle, SQL Server), VMware datastores, line-of-business applications (medical imaging, product lifecycle management), front-end EDA (chip design and verification), hybrid and DR |
| FSx for Windows File Server | Fully managed SMB file storage built on Windows Server with Active Directory identity (Kerberos, NTFS ACLs), DFS namespaces, shadow copies, and FSRM quotas; shares are also accessible from Linux and macOS clients. Single-AZ and Multi-AZ deployment model. | Windows file, home, and department shares, .NET applications, Microsoft SQL Server, Windows Server migrations |
Block Storage
| Service | Key Characteristics | Common Workloads |
|---|
| EBS | High-performance virtual disk that attaches to an EC2 instance over the network. Durable, resizable SSD or HDD that persists independently of the instance, supports snapshots for backup, time-based snapshot copy, and provisions performance independently of capacity on gp3 (confirm latest volume limits). Supports instant volume clones. AZ-scoped. | Databases, transactional applications and file systems, boot volumes, dev/test environments, sequential batch processing, log and data warehouse scans |
| EC2 Instance Store | Physically local SSD storage built into the host server, delivering the lowest latency and highest throughput. Ephemeral: data is lost if the instance stops or the hardware fails. | Temporary scratch data, caches, and buffers you can afford to lose |
Cross-Service Overlap
Some storage features cross category boundaries, giving a service from one storage category an interface normally associated with another. Surface these when a workload needs access to shared data from multiple protocols or interfaces.
| Feature | What it enables | What it is | Additional sources |
|---|
| S3 Files | Makes S3 data accessible to file-based applications | Fully managed NFS file access over an S3 bucket, built on EFS infrastructure. Data stays in S3 as the system of record. File locking, POSIX permissions, and full read-write. Choose over EFS when data already lives in S3 and needs file-path access alongside object access. | references/s3-files-knowledge.md
references/efs-knowledge.md
|
| S3 Access Points for FSx | Makes FSx-resident data accessible to S3-based applications and services | Exposes FSx for NetApp ONTAP or FSx for OpenZFS data through the S3 API without copying it to a bucket. Surface when file data must reach S3-native consumers, or when serverless or S3-based applications need to access data that lives on FSx for NetApp ONTAP or FSx for OpenZFS. | references/fsx-ontap-knowledge.md
references/fsx-openzfs-knowledge.md
|
Security
Cloud security at AWS is the highest priority and is a shared responsibility between AWS and the customer. You MUST include security guidance when recommending or configuring storage resources. You MUST always recommend enabling encryption at rest and encryption in transit. Where encryption at rest is optional or not the default, explicitly advise enabling it at creation time, because it is often immutable after creation. You MUST recommend scoping IAM policies to the authorized principals with least-privileged permissions. You MUST recommend adding condition keys (e.g., aws:SourceArn, aws:SourceAccount, aws:SourceVpc) to resource policies to prevent cross-service confused deputy attacks. You MUST recommend encrypting log destinations: AWS KMS for CloudTrail trails and CloudWatch Logs groups, server-side encryption for server access log buckets, and AWS KMS for SNS topics. Prefer short-lived credentials or IAM-based authentication (e.g., via custom IdP with temporary tokens) over long-lived SSH keys. Where SSH keys are required, enforce rotation policies and store private keys in AWS Secrets Manager for supported services. You MUST recommend restricting security group inbound rules to the narrowest applicable source (specific client security group or minimal CIDR). Service-specific security controls, encryption models, and documentation links are in the Security row of each reference's Service Information table; you MUST read it before advising on that service.
Routing
When loaded through the AWS MCP server's retrieve_skill tool: the skill is not installed on the local filesystem. You MUST retrieve each reference via retrieve_skill with the file parameter (e.g. file="references/s3-general-purpose-knowledge.md"). Do NOT file_read these paths locally. When loaded outside the AWS MCP server (for example from the local filesystem in the Agent Toolkit), read the reference files directly from their relative paths in the skill directory.
Reference files
| Topic | Reference |
|---|
| S3 (General Purpose) | references/s3-general-purpose-knowledge.md
|
| S3 Metadata | references/s3-general-purpose-knowledge.md
|
| S3 Tables | references/s3-tables-knowledge.md
|
| S3 Vectors | references/s3-vectors-knowledge.md
|
| S3 Express One Zone | references/s3-express-knowledge.md
|
| S3 Files | references/s3-files-knowledge.md
|
| Amazon EFS | references/efs-knowledge.md
|
| FSx for Lustre | references/fsx-lustre-knowledge.md
|
| FSx for NetApp ONTAP | references/fsx-ontap-knowledge.md
|
| FSx for OpenZFS | references/fsx-openzfs-knowledge.md
|
| FSx for Windows File Server | references/fsx-windows-knowledge.md
|
| Amazon EBS | references/ebs-knowledge.md
|
| Data Movement and Protection (DataSync, Transfer Family, Storage Gateway, AWS Backup) | references/data-movement-and-protection-knowledge.md
|
Specialized skills
| Topic | Reference |
|---|
| Security on S3 | |
| Using S3 Tables | |
| Using S3 Vectors | storing-and-querying-vectors
|
| Troubleshooting S3 Files | |
| Troubleshooting EFS | |
| Querying S3 System Tables | |
| Ingesting data into a data lake | |
| Finding data lake assets | |
| Querying data lakes | |