[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7A6K5PDXWSX8TN2SPNFS5AT":3,"skill-same:01M7A6K5PDXWSX8TN2SPNFS5AT":151},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":6,"ownerHtmlUrl":48,"ownerBlogUrl":6,"ownerDescription":49,"updatedAt":50,"install":51,"resources":64},"01M7A6K5PDXWSX8TN2SPNFS5AT","datasync-task-operator",null,"Operates AWS DataSync task end-to-end — agent deployment (on-prem VM, EC2), location configuration for every supported source (NFS, SMB, S3, HDFS, Object Storage) and destination (S3, EFS, FSx for Windows, FSx for Lustre, FSx for OpenZFS, FSx for NetApp ONTAP, Snowball Edge), task creation with the full Options surface (VerifyMode POINT_IN_TIME_CONSISTENT | ONLY_FILES_TRANSFERRED | NONE, OverwriteMode ALWAYS | NEVER, PosixPermissions PRESERVE | PRESERVE_TRY | BEST_EFFORT | NONE, Acl PRESERVE | NONE, TransferMode CHANGED | ALL, Gid PRESERVE | NONE, Uid PRESERVE | NONE, Mtime PRESERVE | NONE, SecurityDescriptorCopyFlags OWNER_DACL_SACL | OWNER_DACL | NONE, TaskQueueing ENABLED | DISABLED), scheduling (cron-like ScheduleExpression with up to 1-year horizon), bandwidth throttling (BandwidthLimitInMb), Task Reports with report-level and report-code filters, DataSync Discovery for on-prem capacity assessment, and FSx for NetApp ONTAP destination support. Runs deterministic pre-checks behind a CONFIRM gate and.","jhkchan\u002Faws-agent-skills","jhkchan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1083902?v=4","01M7A2SVQYP9GQTPTDXP5JKYQ4","Jacky Chan","01M7A2SVS117YWCTZABB75HZR1",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: datasync-task-operator\ndescription: Operates AWS DataSync task end-to-end — agent deployment (on-prem VM, EC2), location configuration for every supported source (NFS, SMB, S3, HDFS, Object Storage) and destination (S3, EFS, FSx for Windows, FSx for Lustre, FSx for OpenZFS, FSx for NetApp ONTAP, Snowball Edge), task creation with the full Options surface (VerifyMode POINT_IN_TIME_CONSISTENT | ONLY_FILES_TRANSFERRED | NONE, OverwriteMode ALWAYS | NEVER, PosixPermissions PRESERVE | PRESERVE_TRY | BEST_EFFORT | NONE, Acl PRESERVE | NONE, TransferMode CHANGED | ALL, Gid PRESERVE | NONE, Uid PRESERVE | NONE, Mtime PRESERVE | NONE, SecurityDescriptorCopyFlags OWNER_DACL_SACL | OWNER_DACL | NONE, TaskQueueing ENABLED | DISABLED), scheduling (cron-like ScheduleExpression with up to 1-year horizon), bandwidth throttling (BandwidthLimitInMb), Task Reports with report-level and report-code filters, DataSync Discovery for on-prem capacity assessment, and FSx for NetApp ONTAP destination support. Runs deterministic pre-checks behind a CONFIRM gate and.\nlicense: Apache-2.0\ncompatibility: Agent runtime that reads SKILL.md (Claude Code, Cursor, Windsurf, Codex, Gemini). No AWS CLI required for offline plan classification. Live-account operations use aws datasync create-agent, create-location-nfs | create-location-smb | create-location-s3 | create-location-hdfs | create-location-object-storage | create-location-efs | create-location-fsx-windows | create-location-fsx-lustre | create-location-fsx-openzfs | create-location-fsx-ontap, create-task, update-task, start-task-execution...\nmetadata:\n  domain: aws-cloudops\n  complexity: high\n  requires_llm: 'true'\n  phase: '4'\n  supports_pipeline: 'true'\n  entry_point: 'false'\n  family: Storage\n  task_type: operate\n  skill_class: capability\n  lifecycle_status: active\n  verdict_shape: READY | BLOCKED | COMPLETED\n  when_to_use: Creating or modifying a DataSync task, deploying or activating a DataSync agent (on-prem VM or EC2), configuring source\u002Fdestination locations for NFS, SMB, S3, HDFS, Object Storage, EFS, or FSx family destinations, setting task Options (VerifyMode, OverwriteMode, TransferMode, PosixPermissions, ACLs), creating a task Schedule with bandwidth throttling, diagnosing a failed or partial task execution, configuring Task Reports, planning an on-prem assessment with DataSync Discovery, or transferring to FSx for NetApp ONTAP.\n  activation_triggers: create DataSync task, deploy DataSync agent, activate DataSync agent, DataSync NFS to S3, DataSync SMB to FSx, DataSync HDFS migration, DataSync schedule, DataSync bandwidth throttle, verify data integrity DataSync, POINT_IN_TIME_CONSISTENT, ONLY_FILES_TRANSFERRED, DataSync task failing, DataSync task execution error, DataSync Discovery, DataSync FSx for NetApp ONTAP, DataSync Task Reports, DataSync Snowball Edge, DataSync overwrite mode\n  invocation_schema: 'Input: either (a) a DataSync task configuration (describe-task, describe-task-execution, describe-agent, list-locations) plus the intended operation (create-task, deploy-agent, update-task-options, create-schedule, diagnose-failing-execution, run-discovery, transfer-to-fsx-ontap, configure-task-reports), OR (b) a source + destination location pair for live-account execution. Output: deterministic OPERATION \u002F VERDICT \u002F PRE_CHECKS \u002F STEPS \u002F POST_VERIFY \u002F NOTES block per operation, where VERDICT is one of READY, BLOCKED, COMPLETED.'\n  version: 0.1.0\n  author: Jacky Chan — AWS Community Builder\n  keywords: AWS DataSync, DataSync task, DataSync agent, DataSync Discovery, NFS migration, SMB migration, HDFS migration, Object Storage migration, S3 transfer, EFS transfer, FSx transfer, FSx for NetApp ONTAP, verify data integrity, POINT_IN_TIME_CONSISTENT, ONLY_FILES_TRANSFERRED, bandwidth throttling, BandwidthLimitInMb, task schedule, Task Reports, overwrite mode, PosixPermissions preserve, on-prem to AWS migration, Snowball Edge, activation key\n  tags: aws, datasync, storage, migration, nfs, smb, hdfs, s3, efs, fsx, operate\n---\n\n# AWS DataSync Task Operator\n\n## What this skill does\n\nExecutes AWS DataSync operations correctly and safely across the full\nsource\u002Fdestination matrix. Runs deterministic pre-checks before any\nstate-changing CLI — agent activation key validity and reachability,\nsource location readability, destination location writeability, IAM\ntask role trust + permissions chain (including the KMS encrypt path\nfor SSE-KMS destinations, the cross-account bucket policy for\ndestinations in another account, and the EFS\u002FFSx file system policy\nallowing the DataSync service principal), task Options consistency\n(e.g. `PosixPermissions PRESERVE` requires a destination that\npreserves POSIX metadata; SMB sources need\n`SecurityDescriptorCopyFlags` configured explicitly), schedule\nexpression validity (max 1-year horizon, required for\n`update-task-schedule`), and bandwidth-throttle feasibility against\nthe agent's provisioned uplink. Executes the task change behind a\nCONFIRM gate, then verifies the result by tailing\n`describe-task-execution` until `Status` reaches `SUCCESS` (with\n`BytesTransferred`, `BytesWritten`, `EstimatedFilesToTransfer`,\n`FilesTransferred`, `VerifiedFilesCount`, `TransferDurationBytesPerSecond`\nsurfaced), and for `VerifyMode != NONE` confirming the verify pass\nproduced zero files failing the integrity check.\n\n## Quick navigation\n\n| Section | What it covers | When to read it |\n|---|---|---|\n| **§ Quick reference** | Verdict thresholds (BLOCKED\u002FREADY\u002FCOMPLETED) + pre-check priority | Before any operation |\n| **§ Mindset** | Why DataSync is an agent-mediated async pipeline; the false-green-task trap; the verify-mode contract | Understanding the safety model |\n| **§ Pre-flight** | Source + destination metadata gate — agent reachability, location readability, IAM role chain | Before executing any CLI |\n| **§ Process** | Per-operation planning: create-task, deploy-agent, update-options, create-schedule, diagnose-failing-execution, run-discovery, transfer-to-fsx-ontap, configure-task-reports | When choosing which operation to run |\n| **§ Output format** | STRICT output contract — OPERATION\u002FVERDICT\u002FPRE_CHECKS\u002FSTEPS\u002FPOST_VERIFY\u002FNOTES template | Formatting the response |\n| **§ Anti-Patterns** | NEVER list — common mistakes that strand data or break transfers silently | Review before risky operations |\n| **§ Pre-flight safety** | Capture pre-state, IAM role policy, KMS key policy, destination bucket policy | Defense-in-depth |\n| **§ Expert heuristic** | DataSync is async + eventually-consistent — never assume success from the API alone | Avoiding the false-green trap |\n\n## STRICT output contract\n\nEVERY response MUST end with a single fenced text block in this exact\nshape (the operator's downstream tooling greps for it). No deviations:\n\n```text\nOPERATION: \u003Ccreate-task | deploy-agent | update-task-options | create-schedule | diagnose-failing-execution | run-discovery | transfer-to-fsx-ontap | configure-task-reports>\nVERDICT: READY | BLOCKED | COMPLETED\nTARGET: \u003Csource-location-uri> -> \u003Cdestination-location-uri> (task: \u003Cid-or-\"new\">)\nPRE_CHECKS:\n  - [PASS] \u003Ccheck description>\n  - [FAIL] \u003Ccheck description> — \u003Creason>\nSTEPS:\n  1. \u003CCLI command with flags populated, or \"(none — pre-checks failed)\">\n  2. \u003Cwait \u002F monitoring command>\nPOST_VERIFY:\n  - [PASS] \u003Cverification description> | (pending execution)\n  - [FAIL] \u003Cverification description> — \u003Creason>\nNOTES: \u003Cschedule, monitoring, caveats>\n```\n\nRules of the contract:\n\n- VERDICT is exactly one of `READY`, `BLOCKED`, `COMPLETED`. No other\n  values. `READY` means pre-checks passed and a CONFIRM gate is\n  pending; `BLOCKED` means at least one pre-check failed — do NOT\n  emit STEPS that mutate state; `COMPLETED` means post-verification\n  passed after execution.\n- If PRE_CHECKS has any `[FAIL]`, VERDICT MUST be `BLOCKED` and STEPS\n  MUST be `(none — pre-checks failed)`.\n- If VERDICT is `READY`, STEPS[1] MUST be the CONFIRM prompt and\n  STEPS[2] MUST be the actual CLI.\n- If VERDICT is `COMPLETED`, POST_VERIFY MUST contain at least one\n  `[PASS]` and no `[FAIL]`.\n- Never wrap the block in JSON, never abbreviate the field names,\n  never omit a section. If a section is empty, write `(none)`.\n\n## Quick reference — verdict thresholds\n\n| Verdict | Trigger condition | Action |\n|---|---|---|\n| `BLOCKED` | One or more pre-checks failed (agent activation key missing\u002Ffailed, source unreachable from agent, destination write-denied, IAM task role missing source-read or destination-write, KMS encrypt gap on SSE-KMS destination, cross-account destination bucket policy missing DataSync principal, Options mismatch like `PosixPermissions PRESERVE` on SMB destination, `ScheduleExpression` past 1-year horizon, bandwidth-throttle value exceeds agent uplink, destination EFS\u002FFSx in WRONG AZ vs agent subnet) | List failures, do NOT execute |\n| `READY` | All pre-checks passed; awaiting CONFIRM gate | Emit exact CLI sequence, wait for operator yes |\n| `COMPLETED` | Task execution reached `Status: SUCCESS` AND post-verification passed (`FilesTransferred == EstimatedFilesToTransfer`, `VerificationFilesFailed == 0` when `VerifyMode != NONE`, destination spot-check object exists with expected size and mtime) | Emit verification results, monitoring plan |\n\n**Priority order for pre-checks (apply in this sequence, all must pass\nfor READY):**\n\n1. **Agent activation + reachability.** Agent ARN exists,\n   `LastConnectionTime` recent (\u003C 5 min), `Status: ONLINE`.\n2. **Source location readable by agent.** Self-managed sources\n   (NFS\u002FSMB\u002FHDFS\u002FObject Storage): agent subnet\u002FSG can reach source\n   server's IP\u002FFQDN on the right port (2049 NFS, 445 SMB, 8020\u002F50070\n   HDFS NameNode, 443\u002F80 object storage). AWS sources (S3): IAM role\n   has `s3:GetObject` + `s3:ListBucket`.\n3. **Destination location writable.** S3: IAM role has\n   `s3:PutObject`, `s3:ListBucketMultipartUploads`,\n   `s3:AbortMultipartUpload`, `s3:GetObject` (for verify). EFS\u002FFSx:\n   file-system-specific write permissions and file system policy\n   allows DataSync service principal.\n4. **IAM task role trust + permissions.** Role trusts\n   `datasync.amazonaws.com` and has the read-on-source +\n   write-on-destination chain. Cross-account destinations need the\n   destination bucket policy to allow the source account's role.\n5. **KMS encrypt path on destination.** SSE-KMS destinations require\n   `kms:Encrypt` + `kms:GenerateDataKey` on the destination key AND\n   the destination key policy must grant the role.\n6. **Options consistency.** `PosixPermissions: PRESERVE` requires a\n   POSIX-preserving destination (EFS, FSx for OpenZFS, FSx for\n   Lustre, S3 with bucket-owner-enforced). SMB sources need\n   `SecurityDescriptorCopyFlags` set. SMB destinations cannot\n   preserve POSIX.\n7. **Schedule expression validity.** `ScheduleExpression` is a valid\n   `at(...)` or `rate(...)` within the 1-year task-schedule horizon.\n   `ScheduleStatus: ENABLED` requires the expression be set.\n8. **Bandwidth-throttle feasibility.** `BandwidthLimitInMb` does not\n   exceed the agent's provisioned uplink (typical VM agent ~10 Gbps;\n   EC2 agents bounded by instance-type network caps).\n9. **Destination file system state.** EFS: `available`, not\n   `updating`. FSx: `AVAILABLE`, agent subnet has a mount target or\n   reachable route.\n10. **Task Reports configuration.** If reports requested,\n    `S3BucketArn` for reports exists and task role has\n    `s3:PutObject` on the report bucket.\n\nCost\u002Ftime baselines (per-agent throughput ~10 Gbps, verify-pass overhead 5-15%, $0.0125\u002FGB pricing, 14\u002F28-day discovery windows) moved verbatim to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\nLoad on demand when estimating transfer duration and cost.\n\n## Mindset\n\nMindset framing (agent-mediated async pipeline, VerifyMode as a separate pass, destination must be writable AS the DataSync service) moved verbatim to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\nLoad on demand to internalize why execution status — not task status — proves delivery.\n\n## Pre-flight: source + destination metadata gate\n\nRun before classification. Misclassifying these produces wrong plans.\n\n**Pagination:** `list-locations` paginates at 100.\n`list-task-executions` paginates at 100 by default, sorted descending\nby `StartTime`. `describe-task-execution` returns the full execution\ndetail.\n\nLive-account pre-flight listing (list-agents, list-locations, S3\u002FEFS\u002FFSx describes, IAM policy checks, KMS describe-key, describe-task, describe-task-execution, list-discovery-jobs) moved verbatim to [references\u002Fdiagnostic-commands.md](references\u002Fdiagnostic-commands.md).\nLoad on demand before planning against a live account.\n\n**Malformed input:** if the input JSON is invalid or missing required\nfields, emit `VERDICT: ERROR` with `REASON: Task\u002Flocation configuration\nis not valid JSON or is missing required fields — cannot plan.` and\n`REMEDIATION: Re-fetch with aws datasync describe-task --task-arn\n\u003Ctask> --output json and re-plan.`\n\n| Location attribute | Effect on operation |\n|---|---|\n| Agent `Status: OFFLINE` | create-task BLOCKED. Existing tasks fail execution. |\n| Agent `LastConnectionTime` > 5 min ago | Activation may have expired or network is broken. |\n| Source `LocationType: NFS` but server unreachable from agent subnet | BLOCKED; verify security group + route table. |\n| SMB source missing `SMBUser`\u002F`SMBPassword` secret ARN | BLOCKED; create AWS Secrets Manager secret and re-create location. |\n| HDFS source missing `NameNodes` list | BLOCKED; re-create `create-location-hdfs` with valid NameNodes. |\n| Object Storage missing `ServerHostname`\u002F`BucketName`\u002F`AccessKey`\u002F`SecretKey` | BLOCKED; re-create with valid endpoint. |\n| S3 destination SSE-KMS but role missing `kms:GenerateDataKey` | BLOCKED; attach KMS permissions to task role. |\n| Destination EFS `LifeCycle: DELETING` | BLOCKED; pick a new destination. |\n| Destination FSx `Lifecycle: MISCONFIGURED` | BLOCKED; resolve FSx config first. |\n| Destination FSx for NetApp ONTAP SVM not reachable via agent subnet | BLOCKED; verify mount target or VPC peering. |\n| Destination S3 `ObjectOwnership: ObjectWriter` (legacy) with cross-account task | Replicas owned by source account; update to `BucketOwnerEnforced`. |\n| `Options.PosixPermissions: PRESERVE` on SMB destination | BLOCKED; SMB does not preserve POSIX. Use `BEST_EFFORT` or `NONE`. |\n| `Options.Atime: BEST_EFFORT` on S3 destination | S3 does not track atime; field silently ignored. |\n| `at(...)` past 1 year | BLOCKED; schedule horizon is 1 year. |\n| `BandwidthLimitInMb: 50000` exceeds agent uplink | BLOCKED; throttle must be \u003C= agent uplink capacity. |\n| Task `Status: RUNNING` with new `start-task-execution` | BLOCKED; only one execution per task concurrently. Queue or wait. |\n| `VerifyMode: NONE` on compliance migration | Surface as a WARNING; never silently allow. |\n| `TransferMode: ALL` on a delta sync task | Forces re-copy of all matching objects; cost\u002Ftime impact. |\n\n## Process — operation planning (apply in order)\n\n### Step 0: Expert knowledge — non-obvious DataSync behaviors\n\nStep 0 expert knowledge (agent mandatory for self-managed sources, VerifyMode re-read semantics, TransferMode delta behavior, OverwriteMode interplay, PosixPermissions per destination, SMB Secrets Manager requirement, per-agent bandwidth, 1-year schedule auto-disable, EFS same-AZ, FSx ONTAP SVM, read-only Discovery, Task Reports, single in-flight execution, DeleteOnDelete, non-persistent start overrides) moved verbatim to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\nLoad on demand — each behavior changes a plan if ignored.\n\n### Step 1: Pre-check gate — BLOCKED if any check fails\n\nRun ALL pre-checks for the chosen operation. If ANY fails, the verdict\nis BLOCKED with the failed checks in PRE_CHECKS. Do NOT execute.\n\n**For ALL operations:**\n1. Task ARN exists (or operator is creating new) in the expected\n   account\u002FRegion.\n2. Agent ARN exists, `Status: ONLINE`, `LastConnectionTime` \u003C 5 min\n   ago (skip for S3-to-S3 in same Region without agent).\n3. Source and destination locations exist and match the operator's\n   intended URIs.\n4. Task IAM role trusts `datasync.amazonaws.com` and has the\n   read-on-source + write-on-destination permission chain.\n\n**For create-task (new `create-task`):**\n5. Source location `LocationArn` exists, `LocationType` matches\n   operator's claim.\n6. Destination location `LocationArn` exists, `LocationType` matches.\n7. IAM task role has source-side read (e.g., `s3:GetObject` for S3\n   source, agent-credential-derived access for self-managed).\n8. IAM task role has destination-side write (e.g., `s3:PutObject`\n   for S3, `elasticfilesystem:ClientWrite` for EFS).\n9. (SSE-KMS destination) IAM role has `kms:Encrypt`,\n   `kms:GenerateDataKey`; destination key policy grants the role.\n10. (Cross-account S3 destination) Destination bucket policy allows\n    the source account's task role.\n11. Options consistency: `PosixPermissions: PRESERVE` only on POSIX\n    destinations; `SecurityDescriptorCopyFlags` set for SMB;\n    `VerifyMode != NONE` for compliance migrations.\n12. (Task Reports) Report bucket exists and the task role has\n    `s3:PutObject` on it.\n\n**For deploy-agent:** activation key non-empty and \u003C 24h old; agent\nVM\u002FEC2 has outbound HTTPS (443) to DataSync endpoints; agent\nsubnet\u002FSG can reach source location or destination VPC; (cross-Region\nor cross-account) VPC peering\u002FTGW\u002FPrivateLink to destination subnet;\nIAM role for the agent has `datasync:*` and source-reading\npermissions.\n\n**For update-task-options:** task `Status: AVAILABLE` (not RUNNING);\nnew `Options` block is internally consistent (see Step 0); pre-state\ncaptured (full prior `Options`).\n\n**For create-schedule:** task ARN exists; `ScheduleExpression` is\nvalid EventBridge `rate`\u002F`at` syntax within 1-year horizon;\n(bandwidth throttle) `BandwidthLimitInMb` \u003C= agent uplink.\n\n**For diagnose-failing-execution (read-only, no BLOCKED gate):** read\nthe failure-mode table to identify the root cause from `ErrorCode` +\n`ErrorDetail`.\n\n**For run-discovery:** on-prem storage reachable from the discovery\nagent; no in-flight discovery job covers the same storage system;\ncollection window (14 or 28 days) set explicitly.\n\n**For transfer-to-fsx-ontap:** FSx for NetApp ONTAP file system\n`AVAILABLE`; SVM exists and inter-cluster endpoint reachable from\nagent; agent subnet has route to SVM endpoint; task role has\n`fsx:CreateMountTarget`, `fsx:DescribeFileSystems`, plus the\nONTAP-specific permissions.\n\n**For configure-task-reports:** reports S3 bucket exists in same\nRegion; task role has `s3:PutObject` on the reports bucket;\n`ReportLevel` is one of `ERRORS_ONLY`, `SUCCESSES_AND_ERRORS`.\n\nFailure-mode table (agent offline, s3:PutObject denied, mount target AZ mismatch, SMB login failed, KMS key policy, VerificationFilesFailed, flat BytesTransferred, skipped files, LAUNCHING > 30 min) moved verbatim to [references\u002Ferror-handling.md](references\u002Ferror-handling.md).\nLoad on demand when diagnosing a failing execution from ErrorCode + ErrorDetail.\n\n### Step 2: READY — emit operation plan\n\nIf all pre-checks pass, emit `VERDICT: READY` with the exact CLI\nsequence and the CONFIRM gate. The plan includes:\n\n- The exact AWS CLI command with all flags populated from the source\n  + destination configuration. For `create-task` this includes the\n  full `--options` JSON and the `--cloud-watch-log-group-arn` if\n  specified.\n- Expected throughput (10 Gbps ceiling for a single VM agent;\n  c5.2xlarge ~2 Gbps typical).\n- Expected verify-mode overhead (5-15% extra wall time for\n  POINT_IN_TIME_CONSISTENT).\n- The CONFIRM gate prompt.\n- The monitoring step (describe-task-execution poll until Status\n  reaches SUCCESS or ERROR).\n\n### Step 3: Execute behind CONFIRM gate\n\n- **MANDATORY CONFIRMATION GATE.** Before any state-changing CLI\n  (`create-task`, `update-task`, `start-task-execution`,\n  `update-task-schedule`, `create-agent`, `delete-task`), emit:\n  `CONFIRM: About to \u003Coperation> on task \u003Ctask> in account \u003Caccount>\n  region \u003Cregion>. This will \u003Cconsequence>. Proceed? (yes\u002Fno)`. Do\n  NOT execute until the operator confirms.\n- Capture pre-state for rollback: `aws datasync describe-task\n  --task-arn \u003Ctask> --output json > \u002Ftmp\u002F\u003Ctask>-pre-$(date +%s).json`.\n- Execute the CLI. For `start-task-execution`, the API returns a\n  `TaskExecutionArn` immediately; the transfer runs asynchronously\n  on the agent.\n- Poll the execution:\n  `aws datasync describe-task-execution --task-execution-arn \u003Carn>`\n  every 60 seconds (or longer for big transfers). Surface\n  `BytesTransferred`, `BytesWritten`, `EstimatedFilesToTransfer`,\n  `FilesTransferred`, `VerificationFilesFailed`.\n\n### Step 4: Post-verification — COMPLETED\n\nAfter execution reaches `Status: SUCCESS`, run post-verification. ALL\nchecks must pass for `COMPLETED`.\n\n1. Confirm `FilesTransferred == EstimatedFilesToTransfer` (unless\n   `Includes`\u002F`Excludes` filters intentionally subset the scope).\n2. For `VerifyMode != NONE`: confirm `VerificationFilesFailed == 0`\n   and `VerificationFilesTransferred == FilesTransferred`.\n3. Spot-check 3 random files on the destination via `head-object` \u002F\n   `ls` on the file system. Compare size and mtime to source.\n4. For S3 destination: confirm `ETag` matches (or differs only by\n   multipart-ETag format).\n5. For EFS\u002FFSx destination: confirm POSIX permissions preserved when\n   `PosixPermissions: PRESERVE` was set.\n6. For scheduled tasks: confirm next-run `NextRunTime` is set under\n   `Schedule`.\n7. For Task Reports: confirm the report object exists at\n   `\u003Creport-bucket>\u002F\u003Ctask-id>\u002F\u003Cexecution-id>\u002Freports\u002F`.\n\nIf ANY verification fails, emit `VERDICT: ERROR` with the failure\ndetails — do not claim COMPLETED. Route the failure back to\ndiagnose-failing-execution.\n\n## Output format (per operation)\n\nSee § STRICT output contract above. The block MUST appear exactly in\nthat shape.\n\n### Worked example — create-task (NFS -> S3, VERIFY + schedule)\n\n```text\nOPERATION: create-task\nVERDICT: READY\nTARGET: nfs:\u002F\u002F10.0.10.20\u002Fvol\u002Fdata -> s3:\u002F\u002Fprod-migration-archive-2026\n        (task: new — \"nfs-to-s3-archive\")\nPRE_CHECKS:\n  - [PASS] Agent arn:aws:datasync:us-east-1:111111111111:agent\u002Fagent-001\n    Status: ONLINE, LastConnectionTime: 2026-08-10T22:00:00Z\n  - [PASS] Source location LocationType: NFS, URI: nfs:\u002F\u002F10.0.10.20\u002Fvol\u002Fdata\n  - [PASS] Destination location LocationType: S3, URI: s3:\u002F\u002Fprod-migration-archive-2026\n  - [PASS] IAM role arn:aws:iam::111111111111:role\u002Fdatasync-task-role\n    trusts datasync.amazonaws.com\n  - [PASS] Task role has s3:PutObject, s3:GetObject, s3:ListBucket,\n    s3:AbortMultipartUpload on prod-migration-archive-2026\n  - [PASS] Task role has kms:Encrypt, kms:GenerateDataKey on\n    arn:aws:kms:us-east-1:111111111111:key\u002Fdest-cmk\n  - [PASS] Destination key policy grants role\n  - [PASS] Options.VerifyMode: POINT_IN_TIME_CONSISTENT\n    Options.PosixPermissions: PRESERVE (S3 destination stores POSIX\n    metadata in object metadata)\n  - [PASS] ScheduleExpression: rate(1 day) within 1-year horizon\n  - [PASS] BandwidthLimitInMb: 1000 \u003C= agent uplink (10 Gbps)\nSTEPS:\n  1. CONFIRM: About to create DataSync task \"nfs-to-s3-archive\"\n     in account 111111111111 region us-east-1. Source:\n     nfs:\u002F\u002F10.0.10.20\u002Fvol\u002Fdata. Destination:\n     s3:\u002F\u002Fprod-migration-archive-2026 (SSE-KMS, key dest-cmk).\n     VerifyMode: POINT_IN_TIME_CONSISTENT. Schedule: daily.\n     Bandwidth throttle: 1000 Mb\u002Fs. First execution transfers\n     ~12 TB. Proceed? (yes\u002Fno)\n  2. aws datasync create-task \\\n       --source-location-arn arn:aws:datasync:us-east-1:111111111111:location\u002Floc-001 \\\n       --destination-location-arn arn:aws:datasync:us-east-1:111111111111:location\u002Floc-042 \\\n       --name nfs-to-s3-archive \\\n       --cloud-watch-log-group-arn arn:aws:logs:us-east-1:111111111111:log-group:\u002Faws\u002Fdatasync\u002Fnfs-to-s3 \\\n       --options file:\u002F\u002F\u002Ftmp\u002Fdatasync-options.json \\\n       --schedule-expression \"rate(1 day)\" \\\n       --tags Key=env,Value=prod Key=pipeline,Value=migration\n  3. aws datasync start-task-execution --task-arn \u003Cnew-task-arn>\n  4. aws datasync describe-task-execution --task-execution-arn \u003Cexec-arn>\nPOST_VERIFY: (pending execution)\nNOTES:\n  - First execution performs a FULL transfer (TransferMode: CHANGED\n    with no prior baseline). Subsequent executions on the daily\n    schedule are delta-only.\n  - VerifyMode POINT_IN_TIME_CONSISTENT adds 5-15% wall time after\n    the transfer phase. For 12 TB expect ~24-36h on a 1 Gbps throttle.\n  - Task Reports NOT configured — recommend update-task with reports\n    bucket for compliance evidence.\n  - Destination KMS key policy MUST list the task role; verify with\n    aws kms get-key-policy --key-id dest-cmk --policy-name default\n    before the first execution.\n```\n\n### Worked example — diagnose-failing-execution (BLOCKED with fix)\n\nWorked example (diagnose-failing-execution: AccessDenied on s3:PutObject, partial 2.1TB transfer, IAM attach + TransferMode CHANGED re-run) moved verbatim to [references\u002Fworked-examples.md](references\u002Fworked-examples.md).\nLoad on demand for the shape of a BLOCKED diagnosis with fix.\n\n### Worked example — transfer-to-fsx-ontap (COMPLETED)\n\nWorked example (transfer-to-fsx-ontap COMPLETED: SMB → FSx ONTAP, OWNER_DACL, 48,231 files, zero verify failures) moved verbatim to [references\u002Fworked-examples.md](references\u002Fworked-examples.md).\nLoad on demand for the shape of a COMPLETED FSx ONTAP transfer.\n\n## Anti-Patterns — NEVER\n\n- NEVER assume `Status: AVAILABLE` on a DataSync task means data is\n  transferred. The task only declares it is ready to execute; the\n  only proof of transfer is a `describe-task-execution` returning\n  `Status: SUCCESS` and `FilesTransferred == EstimatedFilesToTransfer`.\n  Always verify with an explicit execution result check.\n\n- NEVER use `VerifyMode: NONE` for compliance-driven migrations. The\n  speed gain is not worth the loss of integrity verification.\n  Compliance audits require `POINT_IN_TIME_CONSISTENT` or\n  `ONLY_FILES_TRANSFERRED`.\n\n- NEVER set `PosixPermissions: PRESERVE` on an SMB destination. SMB\n  does not preserve POSIX metadata; the execution will fail or\n  silently drop the metadata. Use `BEST_EFFORT` or `NONE`, or pick\n  a POSIX-preserving destination (EFS, FSx for OpenZFS).\n\n- NEVER share an agent across more tasks than its throughput can\n  sustain. Bandwidth throttle is per-agent, not per-task; scheduling\n  three concurrent 1 Gbps tasks on a 1 Gbps-throttled agent starves\n  them all.\n\n- NEVER assume a `rate(2 days)` schedule survives forever. DataSync\n  schedules auto-disable after 1 year. Re-arm annually or move the\n  trigger to EventBridge calling `start-task-execution`.\n\n- NEVER set `BandwidthLimitInMb` higher than the agent's provisioned\n  uplink. The cap is enforced on the agent; setting it higher does\n  not buy throughput, it just removes the throttle.\n\n- NEVER call `start-task-execution` on a task that is already\n  `Status: RUNNING`. The API errors with a \"task already running\"\n  condition. Use `Includes`\u002F`Excludes` filters on multiple tasks to\n  parallelize instead.\n\n- NEVER assume `TransferMode: CHANGED` does a full copy on every\n  run. It copies everything on the first run (no baseline) but\n  subsequent runs only copy new\u002Fmodified files. For a forced re-copy,\n  use `TransferMode: ALL`.\n\n- NEVER use a single cross-account destination S3 bucket without a\n  bucket policy explicitly granting the source account's task role.\n  IAM identity-based policy on the task role is necessary but not\n  sufficient.\n\n- NEVER forget the SMB secret. `create-location-smb` requires an\n  AWS Secrets Manager secret ARN for the SMB password. Hard-coded\n  passwords are not supported.\n\n- NEVER re-create a discovery job for the same on-prem storage\n  system while one is in flight. The two jobs will compete for\n  metrics collection and produce inconsistent recommendations.\n\n- NEVER auto-execute a state-changing DataSync CLI without the\n  CONFIRM gate. `delete-task`, `update-task`, and\n  `start-task-execution` all have irreversible side effects.\n\n- NEVER skip capturing pre-state before `update-task` or\n  `update-task-schedule`. The prior Options and Schedule are\n  overwritten with no undo.\n\n- NEVER assume destination EFS is in the same AZ as the agent.\n  Cross-AZ EFS access works but incurs cross-AZ charges; Single-AZ\n  EFS requires same-AZ mount target.\n\n- NEVER rely solely on the task's `Status` field for migration\n  completeness. Read `describe-task-execution` for every execution.\n\n- NEVER deploy an on-prem agent without verifying outbound HTTPS\n  (443) to DataSync endpoints. The activation key fetch succeeds\n  locally but the agent will not be able to register with DataSync\n  control plane.\n\n## Pre-flight safety checks (run before any remediation CLI)\n\nPre-flight safety checks (CONFIRM gate, pre-state capture, agent health, KMS key policies, cross-account bucket policy, additive-over-destructive, Includes\u002FExcludes scope validation) moved verbatim to [references\u002Fdiagnostic-commands.md](references\u002Fdiagnostic-commands.md).\nLoad on demand before executing any remediation CLI.\n\n## Expert heuristic: the false-green task\n\nFalse-green-task heuristic (registration vs delivery claim, verification-techniques table, three-point verification protocol, DELIVERY_STATUS surfacing, post-deploy silent-failure detection) moved verbatim to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\nLoad on demand before trusting a task's AVAILABLE status.\n\n## Recent AWS features (2024-2026)\n\nRecent AWS features (FSx ONTAP destinations, Discovery, Task Reports, DeleteOnDelete, Object Storage locations, per-task bandwidth override, HDFS Kerberos, Snowball Edge, multi-agent tasks, CloudWatch metrics) moved verbatim to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\nLoad on demand before recommending 2024-2026 capabilities.\n\n## References (load on demand)\n\n- [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md) — Mindset, cost\u002Ftime baselines, Step 0 non-obvious behaviors, false-green heuristic, and Recent AWS features moved from SKILL.md\n- [references\u002Fdiagnostic-commands.md](references\u002Fdiagnostic-commands.md) — live-account pre-flight listing and pre-flight safety checks moved from SKILL.md\n- [references\u002Ferror-handling.md](references\u002Ferror-handling.md) — DataSync failure-mode table moved from SKILL.md\n- [references\u002Fworked-examples.md](references\u002Fworked-examples.md) — secondary worked examples moved from SKILL.md\n- [references\u002Fagent-deployment-and-discovery.md](references\u002Fagent-deployment-and-discovery.md) and [references\u002Ftask-options-and-failure-modes.md](references\u002Ftask-options-and-failure-modes.md) — agent lifecycle, full Options reference, per-source-type setup, and pre-operation checklists (pre-existing)\n\n## Domain\n\nAWS CloudOps \u002F DataSync, on-prem-to-AWS migration, AWS-to-AWS\nlarge-scale transfer, and FSx family destination support.\n\n## AWS documentation\n\n- **DataSync User Guide** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fwhat-is-datasync.html\n- **Working with AWS DataSync agents** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fworking-with-agents.html\n- **Creating a DataSync task** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fcreate-task.html\n- **Task options** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fapi-reference.html#API_TaskOptions\n- **Scheduling a task** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fconfigure-task-schedule.html\n- **DataSync Task Reports** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Ftask-reports.html\n- **DataSync Discovery** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fdiscovering-your-storage.html\n- **FSx for NetApp ONTAP as a destination** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fdestination-fsx-ontap.html\n- **DataSync on Snowball Edge** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fsnowball-edge.html\n- **DataSync CLI Reference** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fcli\u002Flatest\u002Freference\u002Fdatasync\u002F\n- **DataSync API Reference** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002FAPI_Reference.html\n","# AWS DataSync Task Operator\n\n## What this skill does\n\nExecutes AWS DataSync operations correctly and safely across the full\nsource\u002Fdestination matrix. Runs deterministic pre-checks before any\nstate-changing CLI — agent activation key validity and reachability,\nsource location readability, destination location writeability, IAM\ntask role trust + permissions chain (including the KMS encrypt path\nfor SSE-KMS destinations, the cross-account bucket policy for\ndestinations in another account, and the EFS\u002FFSx file system policy\nallowing the DataSync service principal), task Options consistency\n(e.g. `PosixPermissions PRESERVE` requires a destination that\npreserves POSIX metadata; SMB sources need\n`SecurityDescriptorCopyFlags` configured explicitly), schedule\nexpression validity (max 1-year horizon, required for\n`update-task-schedule`), and bandwidth-throttle feasibility against\nthe agent's provisioned uplink. Executes the task change behind a\nCONFIRM gate, then verifies the result by tailing\n`describe-task-execution` until `Status` reaches `SUCCESS` (with\n`BytesTransferred`, `BytesWritten`, `EstimatedFilesToTransfer`,\n`FilesTransferred`, `VerifiedFilesCount`, `TransferDurationBytesPerSecond`\nsurfaced), and for `VerifyMode != NONE` confirming the verify pass\nproduced zero files failing the integrity check.\n\n## Quick navigation\n\n| Section | What it covers | When to read it |\n|---|---|---|\n| **§ Quick reference** | Verdict thresholds (BLOCKED\u002FREADY\u002FCOMPLETED) + pre-check priority | Before any operation |\n| **§ Mindset** | Why DataSync is an agent-mediated async pipeline; the false-green-task trap; the verify-mode contract | Understanding the safety model |\n| **§ Pre-flight** | Source + destination metadata gate — agent reachability, location readability, IAM role chain | Before executing any CLI |\n| **§ Process** | Per-operation planning: create-task, deploy-agent, update-options, create-schedule, diagnose-failing-execution, run-discovery, transfer-to-fsx-ontap, configure-task-reports | When choosing which operation to run |\n| **§ Output format** | STRICT output contract — OPERATION\u002FVERDICT\u002FPRE_CHECKS\u002FSTEPS\u002FPOST_VERIFY\u002FNOTES template | Formatting the response |\n| **§ Anti-Patterns** | NEVER list — common mistakes that strand data or break transfers silently | Review before risky operations |\n| **§ Pre-flight safety** | Capture pre-state, IAM role policy, KMS key policy, destination bucket policy | Defense-in-depth |\n| **§ Expert heuristic** | DataSync is async + eventually-consistent — never assume success from the API alone | Avoiding the false-green trap |\n\n## STRICT output contract\n\nEVERY response MUST end with a single fenced text block in this exact\nshape (the operator's downstream tooling greps for it). No deviations:\n\n```text\nOPERATION: \u003Ccreate-task | deploy-agent | update-task-options | create-schedule | diagnose-failing-execution | run-discovery | transfer-to-fsx-ontap | configure-task-reports>\nVERDICT: READY | BLOCKED | COMPLETED\nTARGET: \u003Csource-location-uri> -> \u003Cdestination-location-uri> (task: \u003Cid-or-\"new\">)\nPRE_CHECKS:\n  - [PASS] \u003Ccheck description>\n  - [FAIL] \u003Ccheck description> — \u003Creason>\nSTEPS:\n  1. \u003CCLI command with flags populated, or \"(none — pre-checks failed)\">\n  2. \u003Cwait \u002F monitoring command>\nPOST_VERIFY:\n  - [PASS] \u003Cverification description> | (pending execution)\n  - [FAIL] \u003Cverification description> — \u003Creason>\nNOTES: \u003Cschedule, monitoring, caveats>\n```\n\nRules of the contract:\n\n- VERDICT is exactly one of `READY`, `BLOCKED`, `COMPLETED`. No other\n  values. `READY` means pre-checks passed and a CONFIRM gate is\n  pending; `BLOCKED` means at least one pre-check failed — do NOT\n  emit STEPS that mutate state; `COMPLETED` means post-verification\n  passed after execution.\n- If PRE_CHECKS has any `[FAIL]`, VERDICT MUST be `BLOCKED` and STEPS\n  MUST be `(none — pre-checks failed)`.\n- If VERDICT is `READY`, STEPS[1] MUST be the CONFIRM prompt and\n  STEPS[2] MUST be the actual CLI.\n- If VERDICT is `COMPLETED`, POST_VERIFY MUST contain at least one\n  `[PASS]` and no `[FAIL]`.\n- Never wrap the block in JSON, never abbreviate the field names,\n  never omit a section. If a section is empty, write `(none)`.\n\n## Quick reference — verdict thresholds\n\n| Verdict | Trigger condition | Action |\n|---|---|---|\n| `BLOCKED` | One or more pre-checks failed (agent activation key missing\u002Ffailed, source unreachable from agent, destination write-denied, IAM task role missing source-read or destination-write, KMS encrypt gap on SSE-KMS destination, cross-account destination bucket policy missing DataSync principal, Options mismatch like `PosixPermissions PRESERVE` on SMB destination, `ScheduleExpression` past 1-year horizon, bandwidth-throttle value exceeds agent uplink, destination EFS\u002FFSx in WRONG AZ vs agent subnet) | List failures, do NOT execute |\n| `READY` | All pre-checks passed; awaiting CONFIRM gate | Emit exact CLI sequence, wait for operator yes |\n| `COMPLETED` | Task execution reached `Status: SUCCESS` AND post-verification passed (`FilesTransferred == EstimatedFilesToTransfer`, `VerificationFilesFailed == 0` when `VerifyMode != NONE`, destination spot-check object exists with expected size and mtime) | Emit verification results, monitoring plan |\n\n**Priority order for pre-checks (apply in this sequence, all must pass\nfor READY):**\n\n1. **Agent activation + reachability.** Agent ARN exists,\n   `LastConnectionTime` recent (\u003C 5 min), `Status: ONLINE`.\n2. **Source location readable by agent.** Self-managed sources\n   (NFS\u002FSMB\u002FHDFS\u002FObject Storage): agent subnet\u002FSG can reach source\n   server's IP\u002FFQDN on the right port (2049 NFS, 445 SMB, 8020\u002F50070\n   HDFS NameNode, 443\u002F80 object storage). AWS sources (S3): IAM role\n   has `s3:GetObject` + `s3:ListBucket`.\n3. **Destination location writable.** S3: IAM role has\n   `s3:PutObject`, `s3:ListBucketMultipartUploads`,\n   `s3:AbortMultipartUpload`, `s3:GetObject` (for verify). EFS\u002FFSx:\n   file-system-specific write permissions and file system policy\n   allows DataSync service principal.\n4. **IAM task role trust + permissions.** Role trusts\n   `datasync.amazonaws.com` and has the read-on-source +\n   write-on-destination chain. Cross-account destinations need the\n   destination bucket policy to allow the source account's role.\n5. **KMS encrypt path on destination.** SSE-KMS destinations require\n   `kms:Encrypt` + `kms:GenerateDataKey` on the destination key AND\n   the destination key policy must grant the role.\n6. **Options consistency.** `PosixPermissions: PRESERVE` requires a\n   POSIX-preserving destination (EFS, FSx for OpenZFS, FSx for\n   Lustre, S3 with bucket-owner-enforced). SMB sources need\n   `SecurityDescriptorCopyFlags` set. SMB destinations cannot\n   preserve POSIX.\n7. **Schedule expression validity.** `ScheduleExpression` is a valid\n   `at(...)` or `rate(...)` within the 1-year task-schedule horizon.\n   `ScheduleStatus: ENABLED` requires the expression be set.\n8. **Bandwidth-throttle feasibility.** `BandwidthLimitInMb` does not\n   exceed the agent's provisioned uplink (typical VM agent ~10 Gbps;\n   EC2 agents bounded by instance-type network caps).\n9. **Destination file system state.** EFS: `available`, not\n   `updating`. FSx: `AVAILABLE`, agent subnet has a mount target or\n   reachable route.\n10. **Task Reports configuration.** If reports requested,\n    `S3BucketArn` for reports exists and task role has\n    `s3:PutObject` on the report bucket.\n\nCost\u002Ftime baselines (per-agent throughput ~10 Gbps, verify-pass overhead 5-15%, $0.0125\u002FGB pricing, 14\u002F28-day discovery windows) moved verbatim to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\nLoad on demand when estimating transfer duration and cost.\n\n## Mindset\n\nMindset framing (agent-mediated async pipeline, VerifyMode as a separate pass, destination must be writable AS the DataSync service) moved verbatim to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\nLoad on demand to internalize why execution status — not task status — proves delivery.\n\n## Pre-flight: source + destination metadata gate\n\nRun before classification. Misclassifying these produces wrong plans.\n\n**Pagination:** `list-locations` paginates at 100.\n`list-task-executions` paginates at 100 by default, sorted descending\nby `StartTime`. `describe-task-execution` returns the full execution\ndetail.\n\nLive-account pre-flight listing (list-agents, list-locations, S3\u002FEFS\u002FFSx describes, IAM policy checks, KMS describe-key, describe-task, describe-task-execution, list-discovery-jobs) moved verbatim to [references\u002Fdiagnostic-commands.md](references\u002Fdiagnostic-commands.md).\nLoad on demand before planning against a live account.\n\n**Malformed input:** if the input JSON is invalid or missing required\nfields, emit `VERDICT: ERROR` with `REASON: Task\u002Flocation configuration\nis not valid JSON or is missing required fields — cannot plan.` and\n`REMEDIATION: Re-fetch with aws datasync describe-task --task-arn\n\u003Ctask> --output json and re-plan.`\n\n| Location attribute | Effect on operation |\n|---|---|\n| Agent `Status: OFFLINE` | create-task BLOCKED. Existing tasks fail execution. |\n| Agent `LastConnectionTime` > 5 min ago | Activation may have expired or network is broken. |\n| Source `LocationType: NFS` but server unreachable from agent subnet | BLOCKED; verify security group + route table. |\n| SMB source missing `SMBUser`\u002F`SMBPassword` secret ARN | BLOCKED; create AWS Secrets Manager secret and re-create location. |\n| HDFS source missing `NameNodes` list | BLOCKED; re-create `create-location-hdfs` with valid NameNodes. |\n| Object Storage missing `ServerHostname`\u002F`BucketName`\u002F`AccessKey`\u002F`SecretKey` | BLOCKED; re-create with valid endpoint. |\n| S3 destination SSE-KMS but role missing `kms:GenerateDataKey` | BLOCKED; attach KMS permissions to task role. |\n| Destination EFS `LifeCycle: DELETING` | BLOCKED; pick a new destination. |\n| Destination FSx `Lifecycle: MISCONFIGURED` | BLOCKED; resolve FSx config first. |\n| Destination FSx for NetApp ONTAP SVM not reachable via agent subnet | BLOCKED; verify mount target or VPC peering. |\n| Destination S3 `ObjectOwnership: ObjectWriter` (legacy) with cross-account task | Replicas owned by source account; update to `BucketOwnerEnforced`. |\n| `Options.PosixPermissions: PRESERVE` on SMB destination | BLOCKED; SMB does not preserve POSIX. Use `BEST_EFFORT` or `NONE`. |\n| `Options.Atime: BEST_EFFORT` on S3 destination | S3 does not track atime; field silently ignored. |\n| `at(...)` past 1 year | BLOCKED; schedule horizon is 1 year. |\n| `BandwidthLimitInMb: 50000` exceeds agent uplink | BLOCKED; throttle must be \u003C= agent uplink capacity. |\n| Task `Status: RUNNING` with new `start-task-execution` | BLOCKED; only one execution per task concurrently. Queue or wait. |\n| `VerifyMode: NONE` on compliance migration | Surface as a WARNING; never silently allow. |\n| `TransferMode: ALL` on a delta sync task | Forces re-copy of all matching objects; cost\u002Ftime impact. |\n\n## Process — operation planning (apply in order)\n\n### Step 0: Expert knowledge — non-obvious DataSync behaviors\n\nStep 0 expert knowledge (agent mandatory for self-managed sources, VerifyMode re-read semantics, TransferMode delta behavior, OverwriteMode interplay, PosixPermissions per destination, SMB Secrets Manager requirement, per-agent bandwidth, 1-year schedule auto-disable, EFS same-AZ, FSx ONTAP SVM, read-only Discovery, Task Reports, single in-flight execution, DeleteOnDelete, non-persistent start overrides) moved verbatim to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\nLoad on demand — each behavior changes a plan if ignored.\n\n### Step 1: Pre-check gate — BLOCKED if any check fails\n\nRun ALL pre-checks for the chosen operation. If ANY fails, the verdict\nis BLOCKED with the failed checks in PRE_CHECKS. Do NOT execute.\n\n**For ALL operations:**\n1. Task ARN exists (or operator is creating new) in the expected\n   account\u002FRegion.\n2. Agent ARN exists, `Status: ONLINE`, `LastConnectionTime` \u003C 5 min\n   ago (skip for S3-to-S3 in same Region without agent).\n3. Source and destination locations exist and match the operator's\n   intended URIs.\n4. Task IAM role trusts `datasync.amazonaws.com` and has the\n   read-on-source + write-on-destination permission chain.\n\n**For create-task (new `create-task`):**\n5. Source location `LocationArn` exists, `LocationType` matches\n   operator's claim.\n6. Destination location `LocationArn` exists, `LocationType` matches.\n7. IAM task role has source-side read (e.g., `s3:GetObject` for S3\n   source, agent-credential-derived access for self-managed).\n8. IAM task role has destination-side write (e.g., `s3:PutObject`\n   for S3, `elasticfilesystem:ClientWrite` for EFS).\n9. (SSE-KMS destination) IAM role has `kms:Encrypt`,\n   `kms:GenerateDataKey`; destination key policy grants the role.\n10. (Cross-account S3 destination) Destination bucket policy allows\n    the source account's task role.\n11. Options consistency: `PosixPermissions: PRESERVE` only on POSIX\n    destinations; `SecurityDescriptorCopyFlags` set for SMB;\n    `VerifyMode != NONE` for compliance migrations.\n12. (Task Reports) Report bucket exists and the task role has\n    `s3:PutObject` on it.\n\n**For deploy-agent:** activation key non-empty and \u003C 24h old; agent\nVM\u002FEC2 has outbound HTTPS (443) to DataSync endpoints; agent\nsubnet\u002FSG can reach source location or destination VPC; (cross-Region\nor cross-account) VPC peering\u002FTGW\u002FPrivateLink to destination subnet;\nIAM role for the agent has `datasync:*` and source-reading\npermissions.\n\n**For update-task-options:** task `Status: AVAILABLE` (not RUNNING);\nnew `Options` block is internally consistent (see Step 0); pre-state\ncaptured (full prior `Options`).\n\n**For create-schedule:** task ARN exists; `ScheduleExpression` is\nvalid EventBridge `rate`\u002F`at` syntax within 1-year horizon;\n(bandwidth throttle) `BandwidthLimitInMb` \u003C= agent uplink.\n\n**For diagnose-failing-execution (read-only, no BLOCKED gate):** read\nthe failure-mode table to identify the root cause from `ErrorCode` +\n`ErrorDetail`.\n\n**For run-discovery:** on-prem storage reachable from the discovery\nagent; no in-flight discovery job covers the same storage system;\ncollection window (14 or 28 days) set explicitly.\n\n**For transfer-to-fsx-ontap:** FSx for NetApp ONTAP file system\n`AVAILABLE`; SVM exists and inter-cluster endpoint reachable from\nagent; agent subnet has route to SVM endpoint; task role has\n`fsx:CreateMountTarget`, `fsx:DescribeFileSystems`, plus the\nONTAP-specific permissions.\n\n**For configure-task-reports:** reports S3 bucket exists in same\nRegion; task role has `s3:PutObject` on the reports bucket;\n`ReportLevel` is one of `ERRORS_ONLY`, `SUCCESSES_AND_ERRORS`.\n\nFailure-mode table (agent offline, s3:PutObject denied, mount target AZ mismatch, SMB login failed, KMS key policy, VerificationFilesFailed, flat BytesTransferred, skipped files, LAUNCHING > 30 min) moved verbatim to [references\u002Ferror-handling.md](references\u002Ferror-handling.md).\nLoad on demand when diagnosing a failing execution from ErrorCode + ErrorDetail.\n\n### Step 2: READY — emit operation plan\n\nIf all pre-checks pass, emit `VERDICT: READY` with the exact CLI\nsequence and the CONFIRM gate. The plan includes:\n\n- The exact AWS CLI command with all flags populated from the source\n  + destination configuration. For `create-task` this includes the\n  full `--options` JSON and the `--cloud-watch-log-group-arn` if\n  specified.\n- Expected throughput (10 Gbps ceiling for a single VM agent;\n  c5.2xlarge ~2 Gbps typical).\n- Expected verify-mode overhead (5-15% extra wall time for\n  POINT_IN_TIME_CONSISTENT).\n- The CONFIRM gate prompt.\n- The monitoring step (describe-task-execution poll until Status\n  reaches SUCCESS or ERROR).\n\n### Step 3: Execute behind CONFIRM gate\n\n- **MANDATORY CONFIRMATION GATE.** Before any state-changing CLI\n  (`create-task`, `update-task`, `start-task-execution`,\n  `update-task-schedule`, `create-agent`, `delete-task`), emit:\n  `CONFIRM: About to \u003Coperation> on task \u003Ctask> in account \u003Caccount>\n  region \u003Cregion>. This will \u003Cconsequence>. Proceed? (yes\u002Fno)`. Do\n  NOT execute until the operator confirms.\n- Capture pre-state for rollback: `aws datasync describe-task\n  --task-arn \u003Ctask> --output json > \u002Ftmp\u002F\u003Ctask>-pre-$(date +%s).json`.\n- Execute the CLI. For `start-task-execution`, the API returns a\n  `TaskExecutionArn` immediately; the transfer runs asynchronously\n  on the agent.\n- Poll the execution:\n  `aws datasync describe-task-execution --task-execution-arn \u003Carn>`\n  every 60 seconds (or longer for big transfers). Surface\n  `BytesTransferred`, `BytesWritten`, `EstimatedFilesToTransfer`,\n  `FilesTransferred`, `VerificationFilesFailed`.\n\n### Step 4: Post-verification — COMPLETED\n\nAfter execution reaches `Status: SUCCESS`, run post-verification. ALL\nchecks must pass for `COMPLETED`.\n\n1. Confirm `FilesTransferred == EstimatedFilesToTransfer` (unless\n   `Includes`\u002F`Excludes` filters intentionally subset the scope).\n2. For `VerifyMode != NONE`: confirm `VerificationFilesFailed == 0`\n   and `VerificationFilesTransferred == FilesTransferred`.\n3. Spot-check 3 random files on the destination via `head-object` \u002F\n   `ls` on the file system. Compare size and mtime to source.\n4. For S3 destination: confirm `ETag` matches (or differs only by\n   multipart-ETag format).\n5. For EFS\u002FFSx destination: confirm POSIX permissions preserved when\n   `PosixPermissions: PRESERVE` was set.\n6. For scheduled tasks: confirm next-run `NextRunTime` is set under\n   `Schedule`.\n7. For Task Reports: confirm the report object exists at\n   `\u003Creport-bucket>\u002F\u003Ctask-id>\u002F\u003Cexecution-id>\u002Freports\u002F`.\n\nIf ANY verification fails, emit `VERDICT: ERROR` with the failure\ndetails — do not claim COMPLETED. Route the failure back to\ndiagnose-failing-execution.\n\n## Output format (per operation)\n\nSee § STRICT output contract above. The block MUST appear exactly in\nthat shape.\n\n### Worked example — create-task (NFS -> S3, VERIFY + schedule)\n\n```text\nOPERATION: create-task\nVERDICT: READY\nTARGET: nfs:\u002F\u002F10.0.10.20\u002Fvol\u002Fdata -> s3:\u002F\u002Fprod-migration-archive-2026\n        (task: new — \"nfs-to-s3-archive\")\nPRE_CHECKS:\n  - [PASS] Agent arn:aws:datasync:us-east-1:111111111111:agent\u002Fagent-001\n    Status: ONLINE, LastConnectionTime: 2026-08-10T22:00:00Z\n  - [PASS] Source location LocationType: NFS, URI: nfs:\u002F\u002F10.0.10.20\u002Fvol\u002Fdata\n  - [PASS] Destination location LocationType: S3, URI: s3:\u002F\u002Fprod-migration-archive-2026\n  - [PASS] IAM role arn:aws:iam::111111111111:role\u002Fdatasync-task-role\n    trusts datasync.amazonaws.com\n  - [PASS] Task role has s3:PutObject, s3:GetObject, s3:ListBucket,\n    s3:AbortMultipartUpload on prod-migration-archive-2026\n  - [PASS] Task role has kms:Encrypt, kms:GenerateDataKey on\n    arn:aws:kms:us-east-1:111111111111:key\u002Fdest-cmk\n  - [PASS] Destination key policy grants role\n  - [PASS] Options.VerifyMode: POINT_IN_TIME_CONSISTENT\n    Options.PosixPermissions: PRESERVE (S3 destination stores POSIX\n    metadata in object metadata)\n  - [PASS] ScheduleExpression: rate(1 day) within 1-year horizon\n  - [PASS] BandwidthLimitInMb: 1000 \u003C= agent uplink (10 Gbps)\nSTEPS:\n  1. CONFIRM: About to create DataSync task \"nfs-to-s3-archive\"\n     in account 111111111111 region us-east-1. Source:\n     nfs:\u002F\u002F10.0.10.20\u002Fvol\u002Fdata. Destination:\n     s3:\u002F\u002Fprod-migration-archive-2026 (SSE-KMS, key dest-cmk).\n     VerifyMode: POINT_IN_TIME_CONSISTENT. Schedule: daily.\n     Bandwidth throttle: 1000 Mb\u002Fs. First execution transfers\n     ~12 TB. Proceed? (yes\u002Fno)\n  2. aws datasync create-task \\\n       --source-location-arn arn:aws:datasync:us-east-1:111111111111:location\u002Floc-001 \\\n       --destination-location-arn arn:aws:datasync:us-east-1:111111111111:location\u002Floc-042 \\\n       --name nfs-to-s3-archive \\\n       --cloud-watch-log-group-arn arn:aws:logs:us-east-1:111111111111:log-group:\u002Faws\u002Fdatasync\u002Fnfs-to-s3 \\\n       --options file:\u002F\u002F\u002Ftmp\u002Fdatasync-options.json \\\n       --schedule-expression \"rate(1 day)\" \\\n       --tags Key=env,Value=prod Key=pipeline,Value=migration\n  3. aws datasync start-task-execution --task-arn \u003Cnew-task-arn>\n  4. aws datasync describe-task-execution --task-execution-arn \u003Cexec-arn>\nPOST_VERIFY: (pending execution)\nNOTES:\n  - First execution performs a FULL transfer (TransferMode: CHANGED\n    with no prior baseline). Subsequent executions on the daily\n    schedule are delta-only.\n  - VerifyMode POINT_IN_TIME_CONSISTENT adds 5-15% wall time after\n    the transfer phase. For 12 TB expect ~24-36h on a 1 Gbps throttle.\n  - Task Reports NOT configured — recommend update-task with reports\n    bucket for compliance evidence.\n  - Destination KMS key policy MUST list the task role; verify with\n    aws kms get-key-policy --key-id dest-cmk --policy-name default\n    before the first execution.\n```\n\n### Worked example — diagnose-failing-execution (BLOCKED with fix)\n\nWorked example (diagnose-failing-execution: AccessDenied on s3:PutObject, partial 2.1TB transfer, IAM attach + TransferMode CHANGED re-run) moved verbatim to [references\u002Fworked-examples.md](references\u002Fworked-examples.md).\nLoad on demand for the shape of a BLOCKED diagnosis with fix.\n\n### Worked example — transfer-to-fsx-ontap (COMPLETED)\n\nWorked example (transfer-to-fsx-ontap COMPLETED: SMB → FSx ONTAP, OWNER_DACL, 48,231 files, zero verify failures) moved verbatim to [references\u002Fworked-examples.md](references\u002Fworked-examples.md).\nLoad on demand for the shape of a COMPLETED FSx ONTAP transfer.\n\n## Anti-Patterns — NEVER\n\n- NEVER assume `Status: AVAILABLE` on a DataSync task means data is\n  transferred. The task only declares it is ready to execute; the\n  only proof of transfer is a `describe-task-execution` returning\n  `Status: SUCCESS` and `FilesTransferred == EstimatedFilesToTransfer`.\n  Always verify with an explicit execution result check.\n\n- NEVER use `VerifyMode: NONE` for compliance-driven migrations. The\n  speed gain is not worth the loss of integrity verification.\n  Compliance audits require `POINT_IN_TIME_CONSISTENT` or\n  `ONLY_FILES_TRANSFERRED`.\n\n- NEVER set `PosixPermissions: PRESERVE` on an SMB destination. SMB\n  does not preserve POSIX metadata; the execution will fail or\n  silently drop the metadata. Use `BEST_EFFORT` or `NONE`, or pick\n  a POSIX-preserving destination (EFS, FSx for OpenZFS).\n\n- NEVER share an agent across more tasks than its throughput can\n  sustain. Bandwidth throttle is per-agent, not per-task; scheduling\n  three concurrent 1 Gbps tasks on a 1 Gbps-throttled agent starves\n  them all.\n\n- NEVER assume a `rate(2 days)` schedule survives forever. DataSync\n  schedules auto-disable after 1 year. Re-arm annually or move the\n  trigger to EventBridge calling `start-task-execution`.\n\n- NEVER set `BandwidthLimitInMb` higher than the agent's provisioned\n  uplink. The cap is enforced on the agent; setting it higher does\n  not buy throughput, it just removes the throttle.\n\n- NEVER call `start-task-execution` on a task that is already\n  `Status: RUNNING`. The API errors with a \"task already running\"\n  condition. Use `Includes`\u002F`Excludes` filters on multiple tasks to\n  parallelize instead.\n\n- NEVER assume `TransferMode: CHANGED` does a full copy on every\n  run. It copies everything on the first run (no baseline) but\n  subsequent runs only copy new\u002Fmodified files. For a forced re-copy,\n  use `TransferMode: ALL`.\n\n- NEVER use a single cross-account destination S3 bucket without a\n  bucket policy explicitly granting the source account's task role.\n  IAM identity-based policy on the task role is necessary but not\n  sufficient.\n\n- NEVER forget the SMB secret. `create-location-smb` requires an\n  AWS Secrets Manager secret ARN for the SMB password. Hard-coded\n  passwords are not supported.\n\n- NEVER re-create a discovery job for the same on-prem storage\n  system while one is in flight. The two jobs will compete for\n  metrics collection and produce inconsistent recommendations.\n\n- NEVER auto-execute a state-changing DataSync CLI without the\n  CONFIRM gate. `delete-task`, `update-task`, and\n  `start-task-execution` all have irreversible side effects.\n\n- NEVER skip capturing pre-state before `update-task` or\n  `update-task-schedule`. The prior Options and Schedule are\n  overwritten with no undo.\n\n- NEVER assume destination EFS is in the same AZ as the agent.\n  Cross-AZ EFS access works but incurs cross-AZ charges; Single-AZ\n  EFS requires same-AZ mount target.\n\n- NEVER rely solely on the task's `Status` field for migration\n  completeness. Read `describe-task-execution` for every execution.\n\n- NEVER deploy an on-prem agent without verifying outbound HTTPS\n  (443) to DataSync endpoints. The activation key fetch succeeds\n  locally but the agent will not be able to register with DataSync\n  control plane.\n\n## Pre-flight safety checks (run before any remediation CLI)\n\nPre-flight safety checks (CONFIRM gate, pre-state capture, agent health, KMS key policies, cross-account bucket policy, additive-over-destructive, Includes\u002FExcludes scope validation) moved verbatim to [references\u002Fdiagnostic-commands.md](references\u002Fdiagnostic-commands.md).\nLoad on demand before executing any remediation CLI.\n\n## Expert heuristic: the false-green task\n\nFalse-green-task heuristic (registration vs delivery claim, verification-techniques table, three-point verification protocol, DELIVERY_STATUS surfacing, post-deploy silent-failure detection) moved verbatim to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\nLoad on demand before trusting a task's AVAILABLE status.\n\n## Recent AWS features (2024-2026)\n\nRecent AWS features (FSx ONTAP destinations, Discovery, Task Reports, DeleteOnDelete, Object Storage locations, per-task bandwidth override, HDFS Kerberos, Snowball Edge, multi-agent tasks, CloudWatch metrics) moved verbatim to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\nLoad on demand before recommending 2024-2026 capabilities.\n\n## References (load on demand)\n\n- [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md) — Mindset, cost\u002Ftime baselines, Step 0 non-obvious behaviors, false-green heuristic, and Recent AWS features moved from SKILL.md\n- [references\u002Fdiagnostic-commands.md](references\u002Fdiagnostic-commands.md) — live-account pre-flight listing and pre-flight safety checks moved from SKILL.md\n- [references\u002Ferror-handling.md](references\u002Ferror-handling.md) — DataSync failure-mode table moved from SKILL.md\n- [references\u002Fworked-examples.md](references\u002Fworked-examples.md) — secondary worked examples moved from SKILL.md\n- [references\u002Fagent-deployment-and-discovery.md](references\u002Fagent-deployment-and-discovery.md) and [references\u002Ftask-options-and-failure-modes.md](references\u002Ftask-options-and-failure-modes.md) — agent lifecycle, full Options reference, per-source-type setup, and pre-operation checklists (pre-existing)\n\n## Domain\n\nAWS CloudOps \u002F DataSync, on-prem-to-AWS migration, AWS-to-AWS\nlarge-scale transfer, and FSx family destination support.\n\n## AWS documentation\n\n- **DataSync User Guide** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fwhat-is-datasync.html\n- **Working with AWS DataSync agents** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fworking-with-agents.html\n- **Creating a DataSync task** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fcreate-task.html\n- **Task options** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fapi-reference.html#API_TaskOptions\n- **Scheduling a task** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fconfigure-task-schedule.html\n- **DataSync Task Reports** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Ftask-reports.html\n- **DataSync Discovery** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fdiscovering-your-storage.html\n- **FSx for NetApp ONTAP as a destination** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fdestination-fsx-ontap.html\n- **DataSync on Snowball Edge** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002Fsnowball-edge.html\n- **DataSync CLI Reference** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fcli\u002Flatest\u002Freference\u002Fdatasync\u002F\n- **DataSync API Reference** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fdatasync\u002Flatest\u002Fuserguide\u002FAPI_Reference.html\n",{"name":5,"license":15,"metadata":24,"description":7,"compatibility":42},{"tags":25,"phase":26,"author":27,"domain":28,"family":29,"version":30,"keywords":31,"task_type":32,"complexity":33,"entry_point":34,"skill_class":35,"when_to_use":36,"requires_llm":37,"verdict_shape":38,"lifecycle_status":39,"invocation_schema":40,"supports_pipeline":37,"activation_triggers":41},"aws, datasync, storage, migration, nfs, smb, hdfs, s3, efs, fsx, operate","4","Jacky Chan — AWS Community Builder","aws-cloudops","Storage","0.1.0","AWS DataSync, DataSync task, DataSync agent, DataSync Discovery, NFS migration, SMB migration, HDFS migration, Object Storage migration, S3 transfer, EFS transfer, FSx transfer, FSx for NetApp ONTAP, verify data integrity, POINT_IN_TIME_CONSISTENT, ONLY_FILES_TRANSFERRED, bandwidth throttling, BandwidthLimitInMb, task schedule, Task Reports, overwrite mode, PosixPermissions preserve, on-prem to AWS migration, Snowball Edge, activation key","operate","high","false","capability","Creating or modifying a DataSync task, deploying or activating a DataSync agent (on-prem VM or EC2), configuring source\u002Fdestination locations for NFS, SMB, S3, HDFS, Object Storage, EFS, or FSx family destinations, setting task Options (VerifyMode, OverwriteMode, TransferMode, PosixPermissions, ACLs), creating a task Schedule with bandwidth throttling, diagnosing a failed or partial task execution, configuring Task Reports, planning an on-prem assessment with DataSync Discovery, or transferring to FSx for NetApp ONTAP.","true","READY | BLOCKED | COMPLETED","active","Input: either (a) a DataSync task configuration (describe-task, describe-task-execution, describe-agent, list-locations) plus the intended operation (create-task, deploy-agent, update-task-options, create-schedule, diagnose-failing-execution, run-discovery, transfer-to-fsx-ontap, configure-task-reports), OR (b) a source + destination location pair for live-account execution. Output: deterministic OPERATION \u002F VERDICT \u002F PRE_CHECKS \u002F STEPS \u002F POST_VERIFY \u002F NOTES block per operation, where VERDICT is one of READY, BLOCKED, COMPLETED.","create DataSync task, deploy DataSync agent, activate DataSync agent, DataSync NFS to S3, DataSync SMB to FSx, DataSync HDFS migration, DataSync schedule, DataSync bandwidth throttle, verify data integrity DataSync, POINT_IN_TIME_CONSISTENT, ONLY_FILES_TRANSFERRED, DataSync task failing, DataSync task execution error, DataSync Discovery, DataSync FSx for NetApp ONTAP, DataSync Task Reports, DataSync Snowball Edge, DataSync overwrite mode","Agent runtime that reads SKILL.md (Claude Code, Cursor, Windsurf, Codex, Gemini). No AWS CLI required for offline plan classification. Live-account operations use aws datasync create-agent, create-location-nfs | create-location-smb | create-location-s3 | create-location-hdfs | create-location-object-storage | create-location-efs | create-location-fsx-windows | create-location-fsx-lustre | create-location-fsx-openzfs | create-location-fsx-ontap, create-task, update-task, start-task-execution...","main","eeace51bd5dd1db2030729d83eeab988861553aa","skills\u002Fdatasync-task-operator",0,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills","https:\u002F\u002Fgithub.com\u002Fjhkchan","CTO & Co-Founder @Beever-AI  & @votee. CAISP. AWS Community Builder. Organizer@GDGCloudHK. MongoDB Champion. Technopreneur + Infornographer.","2026-09-24 08:54:10",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add jhkchan\u002Faws-agent-skills --skill datasync-task-operator",{"tool":57,"command":58},"bunx","bunx skills add jhkchan\u002Faws-agent-skills --skill datasync-task-operator",{"tool":60,"command":61},"pnpm","pnpm dlx skills add jhkchan\u002Faws-agent-skills --skill datasync-task-operator","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002FSKILL.md",true,[65,71,75,79,83,87,91,95,99,103,107,111,115,119,123,127,131,135,139,143,147],{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":70},"eval\u002Ftest-cases.yaml","REFERENCE","参考文档",10357,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Feval\u002Ftest-cases.yaml",{"path":72,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":73,"sourceHtmlUrl":74},"evals\u002Fbaselines\u002Fcreate-task-nfs-to-s3-verify-ready.md",792,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Fevals\u002Fbaselines\u002Fcreate-task-nfs-to-s3-verify-ready.md",{"path":76,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":77,"sourceHtmlUrl":78},"evals\u002Fbaselines\u002Fdeploy-agent-onprem-activation-expired-blocked.md",552,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Fevals\u002Fbaselines\u002Fdeploy-agent-onprem-activation-expired-blocked.md",{"path":80,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":81,"sourceHtmlUrl":82},"evals\u002Fbaselines\u002Fdiagnose-failing-execution-access-denied-blocked.md",684,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Fevals\u002Fbaselines\u002Fdiagnose-failing-execution-access-denied-blocked.md",{"path":84,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":85,"sourceHtmlUrl":86},"evals\u002Fbaselines\u002Ffsx-ontap-verify-completed.md",595,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Fevals\u002Fbaselines\u002Ffsx-ontap-verify-completed.md",{"path":88,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":89,"sourceHtmlUrl":90},"evals\u002Fbaselines\u002Fschedule-bandwidth-throttle-ready.md",683,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Fevals\u002Fbaselines\u002Fschedule-bandwidth-throttle-ready.md",{"path":92,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":93,"sourceHtmlUrl":94},"evals\u002Feval_config.yaml",1927,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Fevals\u002Feval_config.yaml",{"path":96,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":97,"sourceHtmlUrl":98},"evals\u002Fevals.json",4471,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Fevals\u002Fevals.json",{"path":100,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":101,"sourceHtmlUrl":102},"evals\u002Fprompts\u002Fcreate-task-nfs-to-s3-verify-ready.md",1847,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Fevals\u002Fprompts\u002Fcreate-task-nfs-to-s3-verify-ready.md",{"path":104,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":105,"sourceHtmlUrl":106},"evals\u002Fprompts\u002Fdeploy-agent-onprem-activation-expired-blocked.md",949,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Fevals\u002Fprompts\u002Fdeploy-agent-onprem-activation-expired-blocked.md",{"path":108,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":109,"sourceHtmlUrl":110},"evals\u002Fprompts\u002Fdiagnose-failing-execution-access-denied-blocked.md",1620,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Fevals\u002Fprompts\u002Fdiagnose-failing-execution-access-denied-blocked.md",{"path":112,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":113,"sourceHtmlUrl":114},"evals\u002Fprompts\u002Ffsx-ontap-verify-completed.md",1535,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Fevals\u002Fprompts\u002Ffsx-ontap-verify-completed.md",{"path":116,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":117,"sourceHtmlUrl":118},"evals\u002Fprompts\u002Fschedule-bandwidth-throttle-ready.md",769,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Fevals\u002Fprompts\u002Fschedule-bandwidth-throttle-ready.md",{"path":120,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":121,"sourceHtmlUrl":122},"examples\u002FREADME.md",9371,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Fexamples\u002FREADME.md",{"path":124,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":125,"sourceHtmlUrl":126},"references\u002Fadvanced-patterns.md",12261,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Freferences\u002Fadvanced-patterns.md",{"path":128,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":129,"sourceHtmlUrl":130},"references\u002Fagent-deployment-and-discovery.md",8216,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Freferences\u002Fagent-deployment-and-discovery.md",{"path":132,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":133,"sourceHtmlUrl":134},"references\u002Fdiagnostic-commands.md",3684,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Freferences\u002Fdiagnostic-commands.md",{"path":136,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":137,"sourceHtmlUrl":138},"references\u002Ferror-handling.md",2013,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Freferences\u002Ferror-handling.md",{"path":140,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":141,"sourceHtmlUrl":142},"references\u002Ftask-options-and-failure-modes.md",13079,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Freferences\u002Ftask-options-and-failure-modes.md",{"path":144,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":145,"sourceHtmlUrl":146},"references\u002Fworked-examples.md",3988,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Freferences\u002Fworked-examples.md",{"path":148,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":149,"sourceHtmlUrl":150},"skill.usf.yaml",4713,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdatasync-task-operator\u002Fskill.usf.yaml",[152,159,166,173,180,187],{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":158,"publishedAt":19},"01M7ADVD60X4PCAPKSE58P9NDC","xray-tracing-deployer","Deploys AWS X-Ray distributed tracing with production-grade configuration: X-Ray daemon deployment (EC2 systemd, ECS sidecar, EKS DaemonSet, Lambda built-in), SDK instrumentation (Java, Python, Node.js, Go, .NET) with annotations and metadata, sampling rules (default reservoir + rate vs custom rules with URL \u002F method \u002F service-name predicates), service map generation, trace query and retrieval, groups and insights, CloudWatch ServiceLens integration, IAM permissions (PutTraceSegments, GetSamplingRules), and latest features (Lambda Powertools tracing, OpenTelemetry \u002F ADOT Collector support, W3C trace context). Emits a READY_TO_DEPLOY checklist with every configuration item verified. Use when enabling X-Ray on a new application, adding tracing to ECS \u002F EKS \u002F Lambda, validating a sampling configuration, or generating daemon deployment CLI and IaC templates. Triggers: X-Ray, distributed tracing, X-Ray daemon, sampling rules, service map, X-Ray SDK, OpenTelemetry, ADOT, Lambda Powertools, CloudWatch ServiceLens.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxray-tracing-deployer\u002FSKILL.md",[],[],{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":19},"01M7ADTVJ7DCBM9CB1FY51GH7J","wellarchitected-workload-auditor","Audits AWS Well-Architected Tool workloads for review staleness, per-pillar high-risk issue counts, milestone tracking gaps, and remediation plan completeness. Emits a deterministic verdict (STALE_REVIEW | HIGH_RISK | CONFIG_GAP | OK) per workload with per-pillar risk breakdown, milestone trend analysis, and specific remediation. Use when reviewing Well-Architected workloads, checking WA review freshness, auditing high-risk issues per pillar, validating milestone coverage, or tracking remediation plans.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwellarchitected-workload-auditor\u002FSKILL.md",[],[],{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":19},"01M7ADT59G6FTTNZYHT2QRPNNP","wellarchitected-review-operator","Operates AWS Well-Architected Tool reviews end-to-end — creates workloads, runs pillar reviews (operational excellence, security, reliability, performance, cost optimization, sustainability, Prosperity), answers questions with risk-tier rationale, generates reports and improvement plans, creates milestones, and integrates with Trusted Advisor and Well-Architected Labs. Runs deterministic pre-checks (workload existence, lens availability, pillar coverage), emits the exact update-answer \u002F get-consolidated-report CLI behind a CONFIRM gate, and verifies risk-tier transitions. Emits READY | BLOCKED | COMPLETED. Use when creating a workload, answering pillar questions, generating an improvement plan, creating a milestone, or integrating with Trusted Advisor. Triggers: well-architected tool, well architected review, workload review, pillar, operational excellence, security, reliability, performance, cost optimization, sustainability, prosperity, improvement plan, milestone, trusted advisor.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwellarchitected-review-operator\u002FSKILL.md",[],[],{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":179,"publishedAt":19},"01M7ADSH5JA9QHNPPHQCD7EVA7","wafv2-web-acl-deployer","Provisions AWS WAFv2 Web ACLs with correct production defaults: scope selection (CLOUDFRONT vs REGIONAL), managed rule groups (AWSManagedRulesCommonRuleSet, SQLiRuleSet, LinuxRuleSet, WindowsRuleSet, IPReputationList, BotControlRuleSet, AmazonIpReputationList, ATP), custom rules (byte match, IP set, regex pattern, geo match, size constraint, rate-based), rule priority ordering, logging destinations (Kinesis Firehose, CloudWatch Logs, S3), resource association (ALB, API Gateway, CloudFront), rate-based rules with aggregate keys (IP, forwarded IP), Challenge and CAPTCHA actions, and account takeover prevention. Emits a READY_TO_DEPLOY checklist. Use when creating a Web ACL, attaching managed rules, configuring rate limiting, enabling WAF logging, associating a Web ACL with an ALB\u002FAPI Gateway\u002FCloudFront, or configuring CAPTCHA\u002FChallenge actions. Triggers: create WAF Web ACL, WAFv2, managed rule groups, WAF rate limiting, WAF logging, WAF CAPTCHA, WAF Challenge action, bot control, ATP managed rules.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwafv2-web-acl-deployer\u002FSKILL.md",[],[],{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":19},"01M7ADRYFAT8R73FBNCHRC573X","wafv2-web-acl-auditor","Audits AWS WAFv2 Web ACL configurations to determine whether the ACL provides effective protection: default-action posture (Allow vs Block), managed-rule-group coverage gaps, rule effectiveness (BLOCK vs COUNT, shadow\u002Fbypass rules, stale exclusions), rate-based rule correctness, logging and visibility configuration, and text-transformation bypass vectors. Emits a deterministic verdict per Web ACL. Use when reviewing a WAFv2 Web ACL for security posture, checking managed-rule coverage, validating rate-limit configuration, auditing WAF logging, or hardening a WAF before production deployment. Triggers: WAF, WAFv2, Web ACL, managed rule group, AWSManagedRules, rate-based rule, CAPTCHA, Challenge, OverrideAction, Count mode, forwarded IP, Bot Control, ATP, text transformation, WAF logging, WAF visibility, OWASP, SQLi, XSS, RFI.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwafv2-web-acl-auditor\u002FSKILL.md",[],[],{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":193,"publishedAt":19},"01M7ADR8W7G72JX4KFGN03QK8Q","waf-rule-deployer","Provisions AWS WAFv2 rule sets with production defaults: Web ACL creation (CloudFront scope in us-east-1 vs Regional scope), rule groups (managed vs custom) with capacity planning in WCU (Web ACL Capacity Units, 1500 default per ACL), managed rule groups (AWSManagedRulesCommonRuleSet, AWSManagedRulesSQLiRuleSet, AWSManagedRulesAmazonIpReputationList, AWSManagedRulesLinuxRuleSet, AWSManagedRulesWindowsRuleSet, AWSManagedRulesUnixRuleSet), custom rules (byte-match, regex pattern set, geo-match, rate-based), IP set and regex pattern set resources, rule priority ordering (lowest number evaluated first), action types (allow, block, count, CAPTCHA, Challenge), bot control managed rule group, account takeover. Triggers: create WAF rule, WAF managed rule group, WAF custom rule, WAF byte match, WAF geo match, WAF rate based rule, WAF IP set, WAF regex pattern set, WAF WCU budget, WAF CloudFront ACL, WAF logging Kinesis Firehose, WAF bot control, WAF ATP, WAF label matching, WAF Challenge action, WAF CAPTCHA.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwaf-rule-deployer\u002FSKILL.md",[],[]]