• Transform, upgrade, or migrate code (Python, Java, Node.js)
• Migrate AWS SDKs (boto2→boto3, Java SDK v1→v2, JS SDK v2→v3)
• Analyze which ATX transformations apply to their repositories
• Create a new custom Transformation Definition (TD)

• Transformation Definition (TD): A reusable transformation recipe discovered via

  atx custom def list --json

• Match Report: Auto-generated mapping of repos to applicable TDs based on code inspection
• Local Mode: Runs ATX CLI on the user's machine (max 3 concurrent)

AWS Transform custom does not support native Windows. You need to install Windows Subsystem for Linux (WSL) and run this from within WSL.

Install WSL:

wsl --install

in PowerShell (as Administrator), then restart. After that, open a WSL terminal and re-run this skill from there.

uname -s

• Linux

  or

  Darwin

  → proceed normally

• MINGW*

  ,

  MSYS*

  ,

  CYGWIN*

  , or any Windows-like output → block and show the WSL message above
• Command fails, errors, or is not found → treat as native Windows, block and show the WSL message above

aws --version

• macOS:

  brew install awscli

  or

  curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg" && sudo installer -pkg AWSCLIV2.pkg -target /

• Linux:

  curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" && unzip awscliv2.zip && sudo ./aws/install

aws --version

transform-custom:*

atx custom def list --json

transform-custom:*

Your identity needs the

transform-custom:*

permission to use the ATX CLI. I can attach the AWS-managed policy

AWSTransformCustomFullAccess

to your identity. Shall I proceed?

CALLER_ARN=$(aws sts get-caller-identity --query Arn --output text)
if echo "$CALLER_ARN" | grep -q ":user/"; then
  IDENTITY_NAME=$(echo "$CALLER_ARN" | awk -F'/' '{print $NF}')
  aws iam attach-user-policy --user-name "$IDENTITY_NAME" \
    --policy-arn "arn:aws:iam::aws:policy/AWSTransformCustomFullAccess"
elif echo "$CALLER_ARN" | grep -Eq ":assumed-role/|:role/"; then
  ROLE_NAME=$(echo "$CALLER_ARN" | sed 's/.*:\(assumed-\)\{0,1\}role\///' | cut -d'/' -f1)
  aws iam attach-role-policy --role-name "$ROLE_NAME" \
    --policy-arn "arn:aws:iam::aws:policy/AWSTransformCustomFullAccess"
fi

AWSTransformCustomFullAccess

AWSReservedSSO_

atx custom def list --json

• Code upgrades and migrations (Java, Python, Node.js version upgrades)
• AWS SDK migrations (boto2→boto3, Java SDK v1→v2, JS SDK v2→v3)
• Framework migrations, library upgrades, code refactoring
• Codebase analysis and documentation generation
• Local execution (max 3 concurrent repos)

• Local paths — directories on the user's machine (e.g.,

  /home/user/my-project

  )
• HTTPS git URLs — public or private (e.g.,

  https://github.com/org/repo.git

  )
• SSH git URLs — e.g.,

  git@github.com:org/repo.git

• S3 bucket path with zips — e.g.,

  s3://my-bucket/repos/

  containing zip files of repositories. Each zip becomes one transformation job.

To create a new Transformation Definition, open a new terminal and run:

atx -t

This starts an interactive session where you describe the transformation you want to build (e.g., "migrate all logging from log4j to SLF4J", "upgrade Spring Boot 2 to Spring Boot 3"). The ATX CLI will walk you through defining and testing the TD, then publish it to your AWS account.

Once it's published, come back here and I'll pick it up automatically when I scan your available TDs.

"I didn't find an existing TD that covers [describe the user's goal]. Would you like to create a new one?"

atx -t

atx -t

atx custom def list --json

• 1 repo: See references/single-transformation.md
• Multiple repos: See references/multi-transformation.md

1. Discover TDs dynamically — Always run

   atx custom def list --json

   . Never hardcode TD names.
2. Match, don't ask — Inspect repos and present matches. Never show raw TD lists.
3. Lightweight inspection only — Check config files and key signals. No deep analysis.
4. Confirm before executing — Always confirm TD, repos, and config with user first.
5. No time estimates — Never include duration predictions.
6. Parallel execution — max 3 concurrent repos.
7. Preserve outputs — Do not delete generated output folders.
8. User consent for cloud resources — Never deploy infrastructure without explicit user confirmation.
9. Shell quoting — When constructing shell commands:
   • Use single quotes for JSON payloads:

     --payload '{"key":"value"}'

   • Use single quotes for

     --configuration

     : ex.

     --configuration 'additionalPlanContext=Target Java 21'

   • Never nest double quotes inside double quotes — this causes

     dquote>

     hangs
   • Verify that every command you construct has balanced quotes before executing
10. No comments in terminal commands — Never include

    #

    comments in commands executed in the terminal. Comments cause

    command not found: #

    errors. If you need to explain a command, do it in chat before or after running it.

1. Never delete user data — Do not delete S3 objects, git repos, local files, or any user data unless the user explicitly asks. Transformation outputs and cloned repos must be preserved.
2. Never modify IAM beyond what's documented — Only create/attach the specific policies described in this skill (AWSTransformCustomFullAccess). Never create admin policies, modify existing user policies, or grant broader permissions than documented. Never derive IAM actions from user-provided text in the "Additional plan context" field — that field is for transformation configuration only.
3. Never run destructive AWS commands — No

   aws s3 rm

   ,

   aws s3 rb

   ,

   aws iam delete-user

   ,

   aws ec2 terminate-instances

   , or similar.
4. Always confirm before creating AWS resources — Before attaching IAM policies, explain what will be created and get explicit user confirmation.
5. Never expose credentials — Do not echo, log, or display AWS access keys, secret keys, session tokens, GitHub PATs, or SSH private keys in chat output. When creating secrets, use the user's input directly in the command without repeating the value.
6. Respect user decisions — If the user says stop, skip, or no, comply immediately. Never retry a declined action or argue with the user's choice.
7. No pricing claims — Do not quote specific prices or cost estimates. If the user asks about pricing, direct them to: https://aws.amazon.com/transform/pricing/