aws-network-monitoring — Claude Code skill: Network Flow agents
Installs and troubleshoots CloudWatch Network Flow Monitor agents on EC2: IAM policy, the SSM Distributor route, metric checks, and the errors that follow.
npx skills add aws/agent-toolkit-for-aws --skill aws-network-monitoring -a claude-codeWhat aws-network-monitoring does
The skill gives an agent working knowledge of Amazon CloudWatch Network Flow Monitor agents on EC2: install through SSM Distributor or from the command line, activate, verify, then debug. The agent itself is lightweight software that ships latency and packet-loss metrics to the Network Flow Monitor backend. Those metrics are how you see path health between workloads.
Inside there is a routing table in SKILL.md and three references. agent-install-ec2.md walks the install end to end, agent-permissions.md covers the IAM policies, and troubleshooting.md maps error to cause to fix for HTTP 403, missing metrics and connectivity failures. With the AWS MCP server the agent runs the SSM commands itself, attaches policies and reads back status. Plain AWS CLI access works too. You just run the steps yourself.
Sort the prerequisites first. The instance role needs CloudWatchNetworkFlowMonitorAgentPublishPolicy and AmazonSSMManagedInstanceCore; skip the *FullAccess policies and never put static keys on the box. Windows is not supported, so check the OS before you start. On a private subnet the skill points at SSM VPC endpoints rather than a NAT gateway, which keeps traffic inside the AWS network.
What it helps with
- install a Network Flow Monitor agent on EC2 through SSM Distributor
- give an instance the minimum IAM rights to publish metrics
- diagnose an HTTP 403 coming back from the agent
- find out why an agent reports no metrics
- set up agent install in a private subnet with SSM VPC endpoints
Example prompts for the agent
- Install the Network Flow Monitor agent on our EC2 instance through SSM Distributor and show me how to confirm metrics are publishing.
- The agent returns HTTP 403 — work out which permission the instance role is missing.
- Write the IAM policy for the Network Flow Monitor agent with least privilege and no static keys.
How to install aws-network-monitoring
1Skills CLI (Vercel)
npx skills add aws/agent-toolkit-for-aws --skill aws-network-monitoring -a claude-code2Manually: put the files in place
~/.claude/skills/aws-network-monitoring/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/aws-network-monitoring/
1Skills CLI (Vercel)
npx skills add aws/agent-toolkit-for-aws --skill aws-network-monitoring -a codex2Manually: put the files in place
.agents/skills/aws-network-monitoring/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add aws/agent-toolkit-for-aws --skill aws-network-monitoring -a cursor2Manually: put the files in place
.cursor/skills/aws-network-monitoring/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install aws/agent-toolkit-for-aws aws-network-monitoring2Manually: put the files in place
.github/skills/aws-network-monitoring/SKILL.md1Skills CLI (Vercel)
npx skills add aws/agent-toolkit-for-aws --skill aws-network-monitoring -a gemini-cli2Platform CLI
gemini skills install https://github.com/aws/agent-toolkit-for-aws --path skills/specialized-skills/operations-skills/aws-network-monitoringManually: put the files in place
.devin/skills/aws-network-monitoring/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add aws/agent-toolkit-for-aws --skill aws-network-monitoring -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about aws-network-monitoring
How do I install aws-network-monitoring in Claude Code?
Run npx skills add aws/agent-toolkit-for-aws --skill aws-network-monitoring -a claude-code. The skill lands at ~/.claude/skills/aws-network-monitoring/SKILL.md.
What does aws-network-monitoring do?
It walks an agent through installing, configuring and debugging CloudWatch Network Flow Monitor agents on EC2, from the IAM side to verifying that metrics reach the backend.
Do I need the AWS MCP server for it?
No, the guidance works with standard AWS CLI access. With the MCP server the agent can run SSM commands, attach policies and check agent status on its own.
Source text
SKILL.md · Apache-2.0
--- name: aws-network-monitoring description: >- Installs, configures, and troubleshoots Network Flow Monitor agents on EC2 instances to monitor network path health. Covers agent installation, IAM permissions, monitoring network paths, and troubleshooting agents reporting no metrics, HTTP 403 errors, or connectivity failures. version: 1 --- # AWS Network Monitoring ## Overview Domain expertise for installing and configuring Amazon CloudWatch Network Flow Monitor agents on EC2 instances. Covers IAM permission setup, agent installation via SSM Distributor or command-line install, agent activation, verification, and troubleshooting. Network Flow Monitor agents are lightweight software that publish performance metrics (latency, packet loss) to the Network Flow Monitor backend, enabling monitoring of network path health between workloads. **Works best with** the [AWS MCP server](https://docs.aws.amazon.com/aws-mcp/) — enables running SSM commands, attaching IAM policies, and validating agent status directly. All guidance also works with standard AWS CLI access. ## Routing | User need | Action | |-----------|--------| | Installing Network Flow Monitor agents on EC2 | Read [agent-install-ec2.md](references/agent-install-ec2.md) | | Configuring IAM for Network Flow Monitor agents | Read [agent-permissions.md](references/agent-permissions.md) | | Troubleshooting Network Flow Monitor agents (403, no metrics, connectivity) | Read [troubleshooting.md](references/troubleshooting.md) | | Spans multiple areas | Read the most specific reference first, then consult others as needed | ## Files | File | Content | |------|---------| | [agent-install-ec2.md](references/agent-install-ec2.md) | End-to-end Network Flow Monitor agent installation via SSM Distributor, activation, verification | | [agent-permissions.md](references/agent-permissions.md) | IAM policy setup for Network Flow Monitor agent metric publishing | | [troubleshooting.md](references/troubleshooting.md) | Error → cause → fix for Network Flow Monitor agent issues (HTTP 403, missing metrics, connectivity) | ## Supported versions For supported Linux distributions, kernel versions, and architectures, see the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-agents-versions.html). Windows is not supported. ## Security Considerations - **Least-privilege IAM**: Attach only `CloudWatchNetworkFlowMonitorAgentPublishPolicy` for publishing metrics and `AmazonSSMManagedInstanceCore` for SSM management. Do not use `*FullAccess` policies. - **Private subnets**: When the instance is in a private subnet, prefer VPC endpoints for SSM (`com.amazonaws.<region>.ssm`, `.ssmmessages`, `.ec2messages`) over a NAT gateway to keep traffic on the AWS network. - **Credential storage**: Never embed AWS credentials on the instance; the publish policy MUST be attached to the instance role, not configured as static keys. - **Audit trail**: Ensure CloudTrail is enabled in the account so SSM `SendCommand` invocations and IAM `AttachRolePolicy` actions performed during agent setup are logged for security investigations. - **References**: [CloudWatch Network Flow Monitor security](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-NetworkFlowMonitor-security.html), [IAM best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)
© aws · Apache-2.0 · aws/agent-toolkit-for-aws
