[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7AABSYDCS2DRMPYM91PK449":3,"skill-same:01M7AABSYDCS2DRMPYM91PK449":148},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":42,"commitSha":43,"skillDirectory":44,"forksCount":45,"repositoryHtmlUrl":46,"repositoryHomepageUrl":6,"ownerHtmlUrl":47,"ownerBlogUrl":6,"ownerDescription":48,"updatedAt":49,"install":50,"resources":63},"01M7AABSYDCS2DRMPYM91PK449","neptune-graph-deployer",null,"Provisions Amazon Neptune graph database clusters with production defaults: cluster creation (primary + read replicas), instance types, Neptune ML integration, IAM database authentication, encryption at rest (KMS), parameter groups (neptune_enforce_ssl, neptune_query_timeout), subnet groups, security groups, Neptune Streams (change log), Global Database (cross-region), Gremlin vs SPARQL query language support, auto-scaling read replicas, bulk loader, CloudWatch metrics (VolumeBytesUsed, EngineCPUUtilization, GremlinRequestsPerSec), and snapshot management. Emits a READY_TO_DEPLOY checklist with verification commands. Use when creating a Neptune cluster, setting up graph database replicas, enabling Neptune ML, configuring IAM database authentication, or establishing a Neptune Global Database. Triggers: create neptune cluster, neptune graph database, gremlin sparql cluster, neptune ml, neptune global database, neptune streams, neptune iam auth, neptune bulk loader, neptune read replica autoscaling.","jhkchan\u002Faws-agent-skills","jhkchan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1083902?v=4","01M7A2SVQYP9GQTPTDXP5JKYQ4","Jacky Chan","01M7A2SVS117YWCTZABB75HZR1",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: neptune-graph-deployer\ndescription: 'Provisions Amazon Neptune graph database clusters with production defaults: cluster creation (primary + read replicas), instance types, Neptune ML integration, IAM database authentication, encryption at rest (KMS), parameter groups (neptune_enforce_ssl, neptune_query_timeout), subnet groups, security groups, Neptune Streams (change log), Global Database (cross-region), Gremlin vs SPARQL query language support, auto-scaling read replicas, bulk loader, CloudWatch metrics (VolumeBytesUsed, EngineCPUUtilization, GremlinRequestsPerSec), and snapshot management. Emits a READY_TO_DEPLOY checklist with verification commands. Use when creating a Neptune cluster, setting up graph database replicas, enabling Neptune ML, configuring IAM database authentication, or establishing a Neptune Global Database. Triggers: create neptune cluster, neptune graph database, gremlin sparql cluster, neptune ml, neptune global database, neptune streams, neptune iam auth, neptune bulk loader, neptune read replica autoscaling.'\nlicense: Apache-2.0\ncompatibility: 'Agent runtime that reads SKILL.md (Claude Code, Cursor, Windsurf, Codex, Gemini). For live deployment: AWS CLI v2 with neptune and rds access (Neptune uses RDS-style cluster APIs). Works with Terraform aws_neptune_cluster \u002F aws_neptune_cluster_instance \u002F aws_neptune_cluster_parameter_group resources and CloudFormation AWS::Neptune::DBCluster \u002F AWS::Neptune::DBInstance templates.'\nmetadata:\n  domain: aws-cloudops\n  complexity: high\n  requires_llm: 'true'\n  phase: '1'\n  supports_pipeline: 'true'\n  entry_point: 'false'\n  family: Databases\n  task_type: deploy\n  skill_class: capability\n  lifecycle_status: active\n  verdict_shape: READY_TO_DEPLOY | PREREQUISITES_MISSING\n  version: 0.1.0\n  author: Jacky Chan — AWS Community Builder\n  tags: aws, neptune, graph-database, gremlin, sparql, cloudops, deploy, databases, provisioning, read-replica, encryption, neptune-ml, global-database\n  dependencies: aws-orchestrator\n  keywords: aws, neptune, graph database, gremlin, sparql, cloudops, deploy, provisioning, read replica, cluster, neptune ml, iam auth, encryption, kms, neptune streams, global database, bulk loader, auto scaling\n  when_to_use: Invoke when the user wants to create an Amazon Neptune graph database cluster, configure primary and read replicas, enable Neptune ML integration, configure IAM database authentication, enable encryption at rest with KMS, set parameter groups (neptune_enforce_ssl, neptune_query_timeout), configure Neptune Streams for change logging, create a Neptune Global Database for cross-region disaster recovery, choose between Gremlin and SPARQL query languages, set up auto-scaling read replicas, or run the Neptune bulk loader. Do NOT invoke for Amazon Neptune Analytics (serverless graph analytics), Amazon RDS\u002FAurora (relational databases), or Amazon OpenSearch (search\u002Fdocument databases).\n---\n\n# Neptune Graph Deployer\n\nAn AWS CloudOps agent skill that provisions Amazon Neptune graph\ndatabase clusters with correct defaults. The skill walks the operator\nthrough cluster creation (primary + read replicas), instance type\nselection, Gremlin vs SPARQL query language support, Neptune ML\nintegration, IAM database authentication, encryption at rest (KMS),\nparameter groups (neptune_enforce_ssl, neptune_query_timeout), subnet\ngroups, security groups, Neptune Streams (change log), Global Database\n(cross-region), auto-scaling read replicas, bulk loader, and CloudWatch\nmetrics — then emits a READY_TO_DEPLOY checklist with verification\ncommands.\n\n## Activation keywords\n\ncreate Neptune cluster, Neptune graph database, Gremlin SPARQL cluster,\nNeptune ML, Neptune Global Database, Neptune Streams, Neptune IAM auth,\nNeptune bulk loader, Neptune read replica auto-scaling.\n\n## STRICT output contract\n\nWhen this skill is invoked with a Neptune-provisioning request (create\na cluster, configure read replicas, enable Neptune ML, set up IAM auth,\nenable encryption, configure Streams, create a Global Database, or a\npartial configuration), the agent MUST respond with the READY_TO_DEPLOY\nchecklist defined below. This contract is what assertion-based evals\nand downstream provisioning pipelines rely on; deviating from the\nliteral labels breaks automation silently.\n\n### Required output structure\n\nThe model MUST emit output using these literal labels, in this order,\nas the FIRST lines of the response (no prose, headings, or disclaimers\nbefore them):\n\n- `NEPTUNE: \u003Ccluster-id> (\u003Cinstance-type>, \u003Cengine-version>)` — first line\n- `VERDICT: READY_TO_DEPLOY | PREREQUISITES_MISSING` — second line\n- `CHECKLIST:` followed by `- [✓]` or `- [✗]` items (one row per dimension below)\n- `VERIFICATION_COMMANDS:` followed by a fenced block of copy-pasteable CLI\n\nThe CHECKLIST MUST cover every dimension, in this order: query language\n(Gremlin\u002FSPARQL\u002FOpenCypher), topology (primary + N read replicas across\nM AZs), instance type + memory + IOPS, subnet group, security group\n(port 8182), parameter group (neptune_enforce_ssl, neptune_query_timeout,\nneptune_streams), IAM database authentication, at-rest encryption (KMS\nkey ARN), Neptune Streams (filter pattern), Neptune ML, Global Database,\nauto-scaling, backup retention\u002Fwindow, snapshot window (vs maintenance),\nbulk loader readiness, and tags.\n\n### Decision tree (determines VERDICT)\n\n```text\nIs a subnet group defined with >= 2 AZs in the target VPC?\n├── NO  → VERDICT: PREREQUISITES_MISSING  ([✗] Subnet group)\n└── YES → Is the security group allowing TCP 8182 from the app SG?\n          ├── NO  → VERDICT: PREREQUISITES_MISSING  ([✗] Security group port 8182)\n          └── YES → Is a neptune1.x cluster parameter group created?\n                    ├── NO  → VERDICT: PREREQUISITES_MISSING  ([✗] Parameter group)\n                    └── YES → Is the at-rest encryption decision made BEFORE create?\n                              ├── NO  → VERDICT: PREREQUISITES_MISSING  ([✗] Encryption is creation-time-only)\n                              └── YES → Is the IAM auth decision recorded (also creation-time-only)?\n                                        ├── NO  → VERDICT: PREREQUISITES_MISSING  ([✗] IAM auth)\n                                        └── YES → Is neptune_streams explicitly set in the parameter group?\n                                                  ├── NO  → VERDICT: PREREQUISITES_MISSING  ([✗] neptune_streams not set)\n                                                  └── YES → All prerequisites satisfied\n                                                            → VERDICT: READY_TO_DEPLOY\n```\n\n### FORBIDDEN patterns (NEVER)\n\n1. **NEVER preface the CHECKLIST** with prose, headings, or disclaimers — emit the block as the first lines of the response.\n2. **NEVER omit the VERIFICATION_COMMANDS section**, even when every checklist item passes.\n3. **NEVER use generic placeholders** (`\u003Cyour-value>`, `\u003Ccluster-id>`, `\u003Cregion>`) in a worked example — always use concrete cluster IDs, real ARNs, and specific CLI commands.\n4. **NEVER mix verdict shapes** — if any prerequisite is `[✗]`, VERDICT MUST be `PREREQUISITES_MISSING` and `READY_TO_DEPLOY` MUST NOT also appear.\n5. **NEVER skip a CHECKLIST row** for a dimension that was evaluated — every dimension gets a `[✓]` or `[✗]` line.\n6. **NEVER suggest toggling encryption, IAM auth, or `neptune_enforce_ssl`** on an existing cluster — they are creation-time-only or require a reboot.\n7. **NEVER use `aws rds` commands** in VERIFICATION_COMMANDS — Neptune uses the `aws neptune` namespace.\n8. **NEVER omit the engine version** from the `NEPTUNE:` header line — Global Database and Streams support depend on it.\n\n### Perfect example — 3-instance cluster with Gremlin, KMS encryption, and Streams\n\nThis is the EXACT shape the model emits for a positive scenario.\nCopy the literal labels, the bracket glyphs, and the fenced command\nblock. Replace the concrete values with the scenario's values; do not\ngenericise them into placeholders.\n\n```text\nNEPTUNE: fraud-graph-prod (db.r5.4xlarge, 1.3.2.1)\nVERDICT: READY_TO_DEPLOY\nCHECKLIST:\n  [✓] Query language: Gremlin (primary), SPARQL (available)\n  [✓] Topology: Primary + 2 read replicas (across 3 AZs: us-east-1a, us-east-1b, us-east-1c)\n  [✓] Instance type: db.r5.4xlarge (128 GB RAM, 8000 baseline IOPS)\n  [✓] Subnet group: neptune-prod-subnet-group (3 AZs)\n  [✓] Security group: sg-0a1b2c3d4e5f6g7h8 (port 8182 inbound from sg-app-111222333)\n  [✓] Parameter group: neptune-prod-params (neptune_enforce_ssl=1, neptune_query_timeout=120000, neptune_streams=1)\n  [✓] IAM database authentication: Enabled (set at cluster creation)\n  [✓] At-rest encryption (KMS): Enabled (key arn:aws:kms:us-east-1:123456789012:key\u002Fa1b2c3d4-1111-2222-3333-444455556666)\n  [✓] Neptune Streams: Enabled (filter: {\"op\": [\"ADD\",\"UPDATE\",\"REMOVE\"]})\n  [✓] Neptune ML: Not configured\n  [✓] Global Database: Not configured\n  [✓] Auto-scaling: Target tracking (EngineCPUUtilization 60%, min 1, max 5 replicas)\n  [✓] Backup: Automated (retention 7 days, window 03:00-04:00 UTC)\n  [✓] Snapshot window: 03:00-04:00 UTC (no overlap with maintenance mon:05:00-mon:06:00)\n  [✓] Bulk loader: Ready (S3 s3:\u002F\u002Fneptune-prod-bulk\u002Fgraph\u002F, IAM role arn:aws:iam::123456789012:role\u002FNeptuneBulkLoadRole)\n  [✓] Tags: Environment=production, Application=fraud-detection, Owner=data-eng\nVERIFICATION_COMMANDS:\n  aws neptune describe-db-clusters --db-cluster-identifier fraud-graph-prod --region us-east-1\n  aws neptune describe-db-instances --db-instance-identifier fraud-graph-prod-primary --region us-east-1\n  aws neptune describe-db-cluster-parameters --db-cluster-parameter-group-name neptune-prod-params --region us-east-1\n  aws cloudwatch get-metric-statistics --namespace AWS\u002FNeptune --metric-name EngineCPUUtilization --dimensions Name=DBInstanceIdentifier,Value=fraud-graph-prod-primary --start-time 2026-08-11T00:00:00Z --end-time 2026-08-11T01:00:00Z --period 300 --statistics Average --region us-east-1\n```\n\nIf any prerequisite fails, emit the SAME shape with\n`VERDICT: PREREQUISITES_MISSING`, the failing row marked `[✗]` with a\nspecific gap citation (e.g. `[✗] Subnet group: only 1 AZ — need >= 2`),\nthe passing rows still listed, and VERIFICATION_COMMANDS showing the\ncommand that would confirm the gap.\n\n## Quick navigation\n\n| Section | When to read |\n|---|---|\n| Prerequisites | Always — verify before provisioning |\n| Step 1 — Gremlin vs SPARQL query language | Query language choice |\n| Step 2 — Cluster creation (primary + read replicas) | Core topology |\n| Step 3 — Instance types and storage | Capacity planning |\n| Step 4 — Subnet groups and security groups | Network + security |\n| Step 5 — Parameter groups (neptune_enforce_ssl, neptune_query_timeout) | Engine config |\n| Step 6 — IAM database authentication | Access control |\n| Step 7 — Encryption at rest (KMS) | Security |\n| Step 8 — Neptune Streams (change log) | Change capture |\n| Step 9 — Neptune ML integration | ML workloads |\n| Step 10 — Global Database (cross-region) | DR \u002F cross-region |\n| Step 11 — Auto-scaling read replicas | Capacity elasticity |\n| Step 12 — Bulk loader | Data ingestion |\n| Step 13 — CloudWatch metrics and monitoring | Observability |\n| Step 14 — Snapshot management | Data durability |\n| Step 15 — Recent features | Latest |\n| NEVER do these things | Review before signing off |\n| Output format | The literal checklist template |\n| references\u002Fquery-languages-and-streams.md | Gremlin\u002FSPARQL + Streams detail |\n| references\u002Fscaling-and-monitoring.md | Replica scaling + CloudWatch detail |\n\n## Mindset\n\n**One-line takeaway:** Amazon Neptune is a purpose-built graph database\nthat supports both Gremlin (property graph \u002F RDF) and SPARQL (RDF)\nquery languages on the SAME cluster. A Neptune cluster has one primary\ninstance and 0-15 read replicas. Encryption at rest is a creation-time\nsetting. Neptune Streams captures every graph change for downstream\nprocessing. Read replica auto-scaling handles graph traversal concurrency\nspikes by adding replicas based on CPU utilization.\n\n> The three provisioning misconceptions (storage\u002FIOPS, replica write scaling, Gremlin-vs-SPARQL clusters) moved to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\n> Load on demand; the one-line takeaway above is the operative summary.\n\n## Configuration dependency graph (novel heuristic)\n\n> Full dependency graph table and cross-dependency gotchas moved to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\n> Load on demand to sequence provisioning; encryption\u002FIAM\u002FStreams are creation-time decisions.\n\n## Expert heuristic: instance storage vs IOPS provisioning + read replica scaling for graph traversal concurrency + Stream filter patterns\n\n> Sizing heuristic (storage vs IOPS, replica scaling formula, Stream filter patterns) moved to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\n> Step 3 keeps the instance table and sizing rules.\n\n## Prerequisites (verify before provisioning)\n\nBefore emitting provisioning commands, verify these prerequisites. If\nany are missing, the verdict is **PREREQUISITES_MISSING**.\n\n| Prerequisite | Why it matters | How to verify |\n|---|---|---|\n| VPC and subnets (>= 2 AZs) | Cluster needs multi-AZ subnet group | `aws ec2 describe-subnets` |\n| Subnet group exists or creatable | Cluster requires a DB subnet group | `aws rds describe-db-subnet-groups` |\n| Security group (port 8182) | Neptune default port for client connections | `aws ec2 describe-security-groups` |\n| Instance type selected | Memory (graph fit) + IOPS (traversals) | `aws neptune describe-orderable-db-instance-options` |\n| Engine version selected | Feature support (ML, Streams, Global DB) | `aws neptune describe-db-engine-versions` |\n| Query language decision (Gremlin\u002FSPARQL\u002Fboth) | Application client library depends on it | Assess use case |\n| Parameter group decision | neptune_enforce_ssl, neptune_query_timeout, neptune_streams | Assess security + performance |\n| Encryption decision | MUST be at creation — cannot toggle later | Assess compliance |\n| IAM auth decision | MUST be at cluster creation | Assess access control |\n| Neptune ML decision (if needed) | S3 bucket + SageMaker IAM role required | Assess ML requirements |\n| KMS key (if encryption with CMK) | Custom KMS key must exist | `aws kms describe-key` |\n| Neptune Streams decision | Must be enabled in parameter group | Assess change capture needs |\n| Snapshot window vs maintenance window | Must not overlap | Plan windows |\n\nIf any prerequisite is missing, output `VERDICT: PREREQUISITES_MISSING`\nand cite the specific gap.\n\n## Step 1 — Gremlin vs SPARQL query language\n\n| Feature | Gremlin | SPARQL |\n|---|---|---|\n| Graph model | Property graph | RDF (Resource Description Framework) |\n| Query style | Traversal-based (imperative) | Pattern-matching (declarative) |\n| Best for | Multi-hop traversals, path queries | Linked data, semantic queries, federation |\n| Client library | Gremlin console, TinkerPop drivers | Jena, RDF4J, SPARQL endpoints |\n| Same cluster? | Yes — both supported on one Neptune cluster | Yes |\n| Performance | Optimized for traversals | Optimized for pattern matching |\n\n**Choose Gremlin** for social network analysis, recommendation engines,\nand fraud detection (multi-hop traversals). **Choose SPARQL** for\nsemantic web, linked data integration, and complex pattern matching\nacross heterogeneous data.\n\nA Neptune cluster supports both. The application connects with the\nappropriate client library. No separate cluster is needed.\n\n## Step 2 — Cluster creation (primary + read replicas)\n\nA Neptune cluster has one primary instance (serves reads + writes) and\n0-15 read replicas (serve reads only). All writes go to the primary.\n\n> Cluster\u002Fprimary\u002Freplica creation CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Topology rule: one primary (reads+writes) + 0-15 read replicas (reads only), replicas in different AZs.\n\n**Common mistake:** using `aws rds` commands instead of `aws neptune`.\nNeptune uses its own API namespace (`aws neptune`) even though the\nparameters mirror RDS.\n\n## Step 3 — Instance types and storage\n\n| Instance type | Memory | vCPUs | Use case |\n|---|---|---|---|\n| db.r5.large | 16 GB | 2 | Small dev\u002Ftest graphs |\n| db.r5.4xlarge | 128 GB | 16 | Medium production graphs |\n| db.r5.8xlarge | 256 GB | 32 | Large production graphs |\n| db.r5.12xlarge | 384 GB | 48 | High-memory traversals |\n| db.x2g.8xlarge | 1 TB | 32 | Very large graph working sets |\n\n**Sizing rules:**\n- Memory must fit the graph working set (vertices + edges + indexes).\n- IOPS scale with instance type and EBS volume configuration.\n- Provisioned IOPS (io2) recommended for traversal-heavy workloads.\n- Read replicas scale read concurrency, NOT write throughput.\n\n> Instance-option enumeration CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Sizing rules above remain authoritative.\n\n## Step 4 — Subnet groups and security groups\n\n> Subnet-group and security-group CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Port 8182 inbound from the app SG is mandatory — see Critical note below.\n\n**Critical:** Neptune uses port 8182 for all client connections (both\nGremlin and SPARQL). The security group must allow inbound from the\napplication SG on port 8182.\n\n## Step 5 — Parameter groups (neptune_enforce_ssl, neptune_query_timeout)\n\nParameter groups control engine-level configuration including SSL\nenforcement, query timeouts, and Streams.\n\n> Parameter-group create\u002Fmodify CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Parameter table and the static-parameter reboot warning below remain in-file.\n\n| Parameter | Default | Effect |\n|---|---|---|\n| neptune_enforce_ssl | 0 | 1 = require TLS for all connections (static — needs reboot) |\n| neptune_query_timeout | 120000 (ms) | Max query duration before timeout |\n| neptune_streams | 0 | 1 = enable Neptune Streams change log (static — needs reboot) |\n\n**Critical:** `neptune_enforce_ssl` and `neptune_streams` are static\nparameters — they require an instance reboot to take effect. Set them\nbefore the first write to avoid disruption.\n\n## Step 6 — IAM database authentication\n\nNeptune supports IAM database authentication using AWS SigV4. This\neliminates the need for database passwords.\n\n> IAM-auth creation snippet and the neptune-db:connect policy JSON moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> IAM auth MUST be enabled at creation — see Critical note below.\n\n**Critical:** IAM database authentication MUST be enabled at cluster\ncreation. It cannot be toggled on afterward. The application uses SigV4\nsigning instead of a static password.\n\n## Step 7 — Encryption at rest (KMS)\n\n**Encryption is creation-time-only for Neptune clusters.** It CANNOT be\ntoggled on after the cluster exists.\n\n> Encrypted-cluster creation CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Encryption is creation-time-only; existing clusters need a new cluster + reload.\n\nTo encrypt an existing non-encrypted cluster, create a new encrypted\ncluster and load data via the bulk loader or Neptune Export\u002FImport.\n\n## Step 8 — Neptune Streams (change log)\n\nNeptune Streams captures every graph mutation (ADD, UPDATE, REMOVE) in\na change log. Enable it in the parameter group.\n\n> Streams enable\u002Freboot CLI, stream-consumer curl, and filter-pattern JSON moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Streams capture only post-enablement changes — see Critical note below.\n\n**Critical:** Streams only capture changes AFTER enablement. Past\nmutations are NOT retroactively available. Filter aggressively to reduce\nconsumer processing load.\n\n## Step 9 — Neptune ML integration\n\nNeptune ML uses SageMaker to train and deploy graph machine learning\nmodels (node classification, link prediction, edge regression).\n\n**Prerequisites:**\n- S3 bucket for model artifacts and training data export.\n- IAM role with SageMaker + Neptune + S3 permissions.\n- The Neptune ML workflow: export data, train model, create inference\n  endpoint.\n\n> Neptune ML export\u002Ftraining CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Prerequisites and the inference-latency implication remain in-file.\n\n**Key implication:** Neptune ML inference endpoints add latency to\nqueries. Use them for batch inference, not real-time low-latency paths.\n\n## Step 10 — Global Database (cross-region)\n\nNeptune Global Database provides cross-region read replicas for disaster\nrecovery and low-latency multi-region reads.\n\n> Global Database create\u002Fsecondary\u002Freplica CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Constraints (matching engine versions, read-only secondary) below.\n\n**Constraints:** same engine version across regions; secondary cluster\nis read-only until failover; replication lag depends on cross-region\nnetwork distance.\n\n## Step 11 — Auto-scaling read replicas\n\nNeptune supports Application Auto Scaling for read replicas based on\nCloudWatch metrics.\n\n> Auto-scaling register-target and target-tracking policy CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Replicas take minutes to become available — see Key implication below.\n\n**Key implication:** read replica auto-scaling adds replicas (0-15 max)\nbased on CPU utilization or replica lag. Replicas take minutes to become\navailable — spikes can still cause timeouts during scale-out.\n\n## Step 12 — Bulk loader\n\nThe Neptune bulk loader is for initial or batch data ingestion from S3.\n\n> Bulk-loader curl payload and mode\u002Fparallelism best practice moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Loader is for batch ingestion, not streaming — see Critical note below.\n\n**Critical:** the bulk loader is for batch ingestion, not continuous\nstreaming. For streaming writes, use the application SDK or Neptune\nStreams consumer pattern.\n\n## Step 13 — CloudWatch metrics and monitoring\n\n| Metric | Namespace | What it measures |\n|---|---|---|\n| VolumeBytesUsed | AWS\u002FNeptune | Storage consumed by the graph |\n| EngineCPUUtilization | AWS\u002FNeptune | CPU usage on the instance |\n| GremlinRequestsPerSec | AWS\u002FNeptune | Gremlin query rate |\n| GremlinWebSocketOpenConnections | AWS\u002FNeptune | Active Gremlin WebSocket connections |\n| SparqlRequestsPerSec | AWS\u002FNeptune | SPARQL query rate |\n| TotalRequestsPerSec | AWS\u002FNeptune | Total query rate (Gremlin + SPARQL) |\n| DbCPUUtilization | AWS\u002FNeptune | Database process CPU |\n| DbFreeableMemory | AWS\u002FNeptune | Available memory |\n| BufferCacheHitRatio | AWS\u002FNeptune | Cache effectiveness for traversals |\n\n> CloudWatch monitoring CLI (CPU, storage growth) and alert thresholds moved to [references\u002Fdiagnostic-commands.md](references\u002Fdiagnostic-commands.md).\n> Metric table above stays authoritative.\n\n## Step 14 — Snapshot management\n\n| Snapshot type | How | Retention |\n|---|---|---|\n| Automated | Within backup window | 1-35 days (backup-retention-period) |\n| Manual | On-demand via API | Until manually deleted |\n\n> Snapshot create\u002Frestore CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Snapshot type\u002Fretention table above.\n\n## Step 15 — Recent features\n\n> Recent features (2023-2025) moved to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\n> Load on demand — Neptune Analytics, OpenCypher, loader\u002FStreams\u002FGlobal DB improvements, r7g.\n\n## NEVER do these things\n\n1. **NEVER assume encryption can be enabled after cluster creation.**\n   Storage encryption is creation-time-only for Neptune clusters.\n   Existing non-encrypted clusters require migration to a new encrypted\n   cluster.\n\n2. **NEVER use `aws rds` commands for Neptune.** Neptune uses its own\n   API namespace (`aws neptune`). The parameters mirror RDS, but the\n   API endpoints are different.\n\n3. **NEVER assume read replicas scale write throughput.** All writes go\n   to the primary instance. Read replicas only serve read queries. If\n   writes are the bottleneck, use a larger primary instance type.\n\n4. **NEVER change `neptune_enforce_ssl` without a reboot plan.**\n   `neptune_enforce_ssl` is a static parameter — it requires an instance\n   reboot to take effect. Plan for the brief downtime.\n\n5. **NEVER enable Neptune Streams and expect past changes to be\n   captured.** Streams only capture changes AFTER enablement. Past\n   mutations are NOT retroactively available.\n\n6. **NEVER create a Global Database with mismatched engine versions.**\n   Primary and secondary must use the same engine version. Mismatches\n   cause replication failures.\n\n7. **NEVER use the bulk loader for streaming writes.** The bulk loader\n   is for initial or batch data ingestion from S3. For streaming, use\n   the application SDK or Neptune Streams consumer pattern.\n\n8. **NEVER forget the security group port.** Neptune uses port 8182\n   for all client connections (Gremlin, SPARQL, and OpenCypher). Wrong\n   port is a silent failure.\n\n9. **NEVER enable IAM database authentication on an existing cluster.**\n   IAM auth must be enabled at cluster creation. It cannot be toggled\n   afterward.\n\n10. **NEVER scale read replicas without monitoring replica lag.**\n    Auto-scaling adds replicas based on CPU utilization, but new replicas\n    take minutes to become available. Monitor `NeptuneReadReplicaLag`\n    during scale-out.\n\n## Output format\n\n```text\nNEPTUNE: \u003Ccluster-id> (\u003Cinstance-type>, \u003Cengine-version>)\nVERDICT: READY_TO_DEPLOY | PREREQUISITES_MISSING\nCHECKLIST:\n  [✓|✗] Query language: Gremlin | SPARQL | OpenCypher | Multiple\n  [✓|✗] Topology: Primary + \u003CN> read replicas (across \u003CM> AZs)\n  [✓|✗] Instance type: \u003Cinstance-type> (\u003Cmemory> GB, \u003CIOPS> baseline)\n  [✓|✗] Subnet group: \u003Csubnet-group-name> (\u003CN> AZs)\n  [✓|✗] Security group: \u003Csg-id> (port 8182)\n  [✓|✗] Parameter group: \u003Cparam-group-name> (neptune_enforce_ssl=\u003C0|1>, neptune_query_timeout=\u003Cms>)\n  [✓|✗] IAM database authentication: Enabled | Disabled\n  [✓|✗] At-rest encryption (KMS): Enabled (key \u003Ckms-key-id>) | Disabled\n  [✓|✗] Neptune Streams: Enabled (filter \u003Cpattern>) | Disabled\n  [✓|✗] Neptune ML: Enabled (S3 bucket \u003Cbucket>, SageMaker role \u003Crole>) | Not configured\n  [✓|✗] Global Database: \u003Cglobal-id> (primary \u003Cregion>, secondary \u003Cregion>) | Not configured\n  [✓|✗] Auto-scaling: Target tracking (\u003Cmetric>, target \u003Cvalue>) | Not configured\n  [✓|✗] Backup: Automated (retention \u003CN> days, window \u003Cwindow>) | Manual only\n  [✓|✗] Snapshot window: \u003Cwindow> (no overlap with maintenance \u003Cwindow>)\n  [✓|✗] Bulk loader: Ready (S3 \u003Cbucket>, IAM role \u003Crole>) | Not needed\n  [✓|✗] Tags: \u003Ckey=value list>\nVERIFICATION_COMMANDS:\n  aws neptune describe-db-clusters --db-cluster-identifier \u003Ccluster-id> --region \u003Cregion>\n  aws neptune describe-db-instances --db-instance-identifier \u003Cprimary-id> --region \u003Cregion>\n  aws cloudwatch get-metric-statistics --namespace AWS\u002FNeptune --metric-name EngineCPUUtilization --dimensions Name=DBInstanceIdentifier,Value=\u003Cprimary-id> --region \u003Cregion>\n```\n\n### Worked example — Neptune cluster with Gremlin, encryption, IAM auth, Streams, and read replicas\n\n> Secondary worked example (full READY_TO_DEPLOY block) moved to [references\u002Fworked-examples.md](references\u002Fworked-examples.md).\n> The Perfect example under the STRICT output contract above is the primary in-file example.\n\n## Error handling\n\n> Error-handling deep dives (encryption unsupported, connectivity, replica lag, empty Streams, Global DB replication, loader errors) moved to [references\u002Ferror-handling.md](references\u002Ferror-handling.md).\n> Load on demand when provisioning or verification fails.\n\n## Domain\n\nAWS CloudOps \u002F Amazon Neptune Graph Database Cluster Provisioning &\nGraph Data Management.\n\n## AWS documentation\n\n- **Neptune User Guide** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fintro.html\n- **Creating a Neptune cluster** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fmanage-console-launch.html\n- **Gremlin and SPARQL** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Faccess-graph-gremlin.html\n- **Neptune ML** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fmachine-learning.html\n- **IAM database authentication** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fiam-auth.html\n- **Encryption at rest** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fencrypt.html\n- **Neptune Streams** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fstreams.html\n- **Global Database** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fneptune-global-database.html\n- **Parameter groups** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fparameters.html\n- **Bulk loader** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fload-data.html\n- **CloudWatch metrics** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fcw-metrics.html\n## References (load on demand)\n- [references\u002Ferror-handling.md](references\u002Ferror-handling.md) — provisioning\u002Fconnectivity\u002Fstream\u002Floader error deep dives.\n- [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md) — misconceptions, dependency graph, sizing heuristic, recent features.\n- [references\u002Fworked-examples.md](references\u002Fworked-examples.md) — secondary full worked example.\n- [references\u002Fdiagnostic-commands.md](references\u002Fdiagnostic-commands.md) — CloudWatch monitoring CLI and alert thresholds.\n- [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md) — all provisioning CLI blocks (Steps 2-12, 14).\n\n","# Neptune Graph Deployer\n\nAn AWS CloudOps agent skill that provisions Amazon Neptune graph\ndatabase clusters with correct defaults. The skill walks the operator\nthrough cluster creation (primary + read replicas), instance type\nselection, Gremlin vs SPARQL query language support, Neptune ML\nintegration, IAM database authentication, encryption at rest (KMS),\nparameter groups (neptune_enforce_ssl, neptune_query_timeout), subnet\ngroups, security groups, Neptune Streams (change log), Global Database\n(cross-region), auto-scaling read replicas, bulk loader, and CloudWatch\nmetrics — then emits a READY_TO_DEPLOY checklist with verification\ncommands.\n\n## Activation keywords\n\ncreate Neptune cluster, Neptune graph database, Gremlin SPARQL cluster,\nNeptune ML, Neptune Global Database, Neptune Streams, Neptune IAM auth,\nNeptune bulk loader, Neptune read replica auto-scaling.\n\n## STRICT output contract\n\nWhen this skill is invoked with a Neptune-provisioning request (create\na cluster, configure read replicas, enable Neptune ML, set up IAM auth,\nenable encryption, configure Streams, create a Global Database, or a\npartial configuration), the agent MUST respond with the READY_TO_DEPLOY\nchecklist defined below. This contract is what assertion-based evals\nand downstream provisioning pipelines rely on; deviating from the\nliteral labels breaks automation silently.\n\n### Required output structure\n\nThe model MUST emit output using these literal labels, in this order,\nas the FIRST lines of the response (no prose, headings, or disclaimers\nbefore them):\n\n- `NEPTUNE: \u003Ccluster-id> (\u003Cinstance-type>, \u003Cengine-version>)` — first line\n- `VERDICT: READY_TO_DEPLOY | PREREQUISITES_MISSING` — second line\n- `CHECKLIST:` followed by `- [✓]` or `- [✗]` items (one row per dimension below)\n- `VERIFICATION_COMMANDS:` followed by a fenced block of copy-pasteable CLI\n\nThe CHECKLIST MUST cover every dimension, in this order: query language\n(Gremlin\u002FSPARQL\u002FOpenCypher), topology (primary + N read replicas across\nM AZs), instance type + memory + IOPS, subnet group, security group\n(port 8182), parameter group (neptune_enforce_ssl, neptune_query_timeout,\nneptune_streams), IAM database authentication, at-rest encryption (KMS\nkey ARN), Neptune Streams (filter pattern), Neptune ML, Global Database,\nauto-scaling, backup retention\u002Fwindow, snapshot window (vs maintenance),\nbulk loader readiness, and tags.\n\n### Decision tree (determines VERDICT)\n\n```text\nIs a subnet group defined with >= 2 AZs in the target VPC?\n├── NO  → VERDICT: PREREQUISITES_MISSING  ([✗] Subnet group)\n└── YES → Is the security group allowing TCP 8182 from the app SG?\n          ├── NO  → VERDICT: PREREQUISITES_MISSING  ([✗] Security group port 8182)\n          └── YES → Is a neptune1.x cluster parameter group created?\n                    ├── NO  → VERDICT: PREREQUISITES_MISSING  ([✗] Parameter group)\n                    └── YES → Is the at-rest encryption decision made BEFORE create?\n                              ├── NO  → VERDICT: PREREQUISITES_MISSING  ([✗] Encryption is creation-time-only)\n                              └── YES → Is the IAM auth decision recorded (also creation-time-only)?\n                                        ├── NO  → VERDICT: PREREQUISITES_MISSING  ([✗] IAM auth)\n                                        └── YES → Is neptune_streams explicitly set in the parameter group?\n                                                  ├── NO  → VERDICT: PREREQUISITES_MISSING  ([✗] neptune_streams not set)\n                                                  └── YES → All prerequisites satisfied\n                                                            → VERDICT: READY_TO_DEPLOY\n```\n\n### FORBIDDEN patterns (NEVER)\n\n1. **NEVER preface the CHECKLIST** with prose, headings, or disclaimers — emit the block as the first lines of the response.\n2. **NEVER omit the VERIFICATION_COMMANDS section**, even when every checklist item passes.\n3. **NEVER use generic placeholders** (`\u003Cyour-value>`, `\u003Ccluster-id>`, `\u003Cregion>`) in a worked example — always use concrete cluster IDs, real ARNs, and specific CLI commands.\n4. **NEVER mix verdict shapes** — if any prerequisite is `[✗]`, VERDICT MUST be `PREREQUISITES_MISSING` and `READY_TO_DEPLOY` MUST NOT also appear.\n5. **NEVER skip a CHECKLIST row** for a dimension that was evaluated — every dimension gets a `[✓]` or `[✗]` line.\n6. **NEVER suggest toggling encryption, IAM auth, or `neptune_enforce_ssl`** on an existing cluster — they are creation-time-only or require a reboot.\n7. **NEVER use `aws rds` commands** in VERIFICATION_COMMANDS — Neptune uses the `aws neptune` namespace.\n8. **NEVER omit the engine version** from the `NEPTUNE:` header line — Global Database and Streams support depend on it.\n\n### Perfect example — 3-instance cluster with Gremlin, KMS encryption, and Streams\n\nThis is the EXACT shape the model emits for a positive scenario.\nCopy the literal labels, the bracket glyphs, and the fenced command\nblock. Replace the concrete values with the scenario's values; do not\ngenericise them into placeholders.\n\n```text\nNEPTUNE: fraud-graph-prod (db.r5.4xlarge, 1.3.2.1)\nVERDICT: READY_TO_DEPLOY\nCHECKLIST:\n  [✓] Query language: Gremlin (primary), SPARQL (available)\n  [✓] Topology: Primary + 2 read replicas (across 3 AZs: us-east-1a, us-east-1b, us-east-1c)\n  [✓] Instance type: db.r5.4xlarge (128 GB RAM, 8000 baseline IOPS)\n  [✓] Subnet group: neptune-prod-subnet-group (3 AZs)\n  [✓] Security group: sg-0a1b2c3d4e5f6g7h8 (port 8182 inbound from sg-app-111222333)\n  [✓] Parameter group: neptune-prod-params (neptune_enforce_ssl=1, neptune_query_timeout=120000, neptune_streams=1)\n  [✓] IAM database authentication: Enabled (set at cluster creation)\n  [✓] At-rest encryption (KMS): Enabled (key arn:aws:kms:us-east-1:123456789012:key\u002Fa1b2c3d4-1111-2222-3333-444455556666)\n  [✓] Neptune Streams: Enabled (filter: {\"op\": [\"ADD\",\"UPDATE\",\"REMOVE\"]})\n  [✓] Neptune ML: Not configured\n  [✓] Global Database: Not configured\n  [✓] Auto-scaling: Target tracking (EngineCPUUtilization 60%, min 1, max 5 replicas)\n  [✓] Backup: Automated (retention 7 days, window 03:00-04:00 UTC)\n  [✓] Snapshot window: 03:00-04:00 UTC (no overlap with maintenance mon:05:00-mon:06:00)\n  [✓] Bulk loader: Ready (S3 s3:\u002F\u002Fneptune-prod-bulk\u002Fgraph\u002F, IAM role arn:aws:iam::123456789012:role\u002FNeptuneBulkLoadRole)\n  [✓] Tags: Environment=production, Application=fraud-detection, Owner=data-eng\nVERIFICATION_COMMANDS:\n  aws neptune describe-db-clusters --db-cluster-identifier fraud-graph-prod --region us-east-1\n  aws neptune describe-db-instances --db-instance-identifier fraud-graph-prod-primary --region us-east-1\n  aws neptune describe-db-cluster-parameters --db-cluster-parameter-group-name neptune-prod-params --region us-east-1\n  aws cloudwatch get-metric-statistics --namespace AWS\u002FNeptune --metric-name EngineCPUUtilization --dimensions Name=DBInstanceIdentifier,Value=fraud-graph-prod-primary --start-time 2026-08-11T00:00:00Z --end-time 2026-08-11T01:00:00Z --period 300 --statistics Average --region us-east-1\n```\n\nIf any prerequisite fails, emit the SAME shape with\n`VERDICT: PREREQUISITES_MISSING`, the failing row marked `[✗]` with a\nspecific gap citation (e.g. `[✗] Subnet group: only 1 AZ — need >= 2`),\nthe passing rows still listed, and VERIFICATION_COMMANDS showing the\ncommand that would confirm the gap.\n\n## Quick navigation\n\n| Section | When to read |\n|---|---|\n| Prerequisites | Always — verify before provisioning |\n| Step 1 — Gremlin vs SPARQL query language | Query language choice |\n| Step 2 — Cluster creation (primary + read replicas) | Core topology |\n| Step 3 — Instance types and storage | Capacity planning |\n| Step 4 — Subnet groups and security groups | Network + security |\n| Step 5 — Parameter groups (neptune_enforce_ssl, neptune_query_timeout) | Engine config |\n| Step 6 — IAM database authentication | Access control |\n| Step 7 — Encryption at rest (KMS) | Security |\n| Step 8 — Neptune Streams (change log) | Change capture |\n| Step 9 — Neptune ML integration | ML workloads |\n| Step 10 — Global Database (cross-region) | DR \u002F cross-region |\n| Step 11 — Auto-scaling read replicas | Capacity elasticity |\n| Step 12 — Bulk loader | Data ingestion |\n| Step 13 — CloudWatch metrics and monitoring | Observability |\n| Step 14 — Snapshot management | Data durability |\n| Step 15 — Recent features | Latest |\n| NEVER do these things | Review before signing off |\n| Output format | The literal checklist template |\n| references\u002Fquery-languages-and-streams.md | Gremlin\u002FSPARQL + Streams detail |\n| references\u002Fscaling-and-monitoring.md | Replica scaling + CloudWatch detail |\n\n## Mindset\n\n**One-line takeaway:** Amazon Neptune is a purpose-built graph database\nthat supports both Gremlin (property graph \u002F RDF) and SPARQL (RDF)\nquery languages on the SAME cluster. A Neptune cluster has one primary\ninstance and 0-15 read replicas. Encryption at rest is a creation-time\nsetting. Neptune Streams captures every graph change for downstream\nprocessing. Read replica auto-scaling handles graph traversal concurrency\nspikes by adding replicas based on CPU utilization.\n\n> The three provisioning misconceptions (storage\u002FIOPS, replica write scaling, Gremlin-vs-SPARQL clusters) moved to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\n> Load on demand; the one-line takeaway above is the operative summary.\n\n## Configuration dependency graph (novel heuristic)\n\n> Full dependency graph table and cross-dependency gotchas moved to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\n> Load on demand to sequence provisioning; encryption\u002FIAM\u002FStreams are creation-time decisions.\n\n## Expert heuristic: instance storage vs IOPS provisioning + read replica scaling for graph traversal concurrency + Stream filter patterns\n\n> Sizing heuristic (storage vs IOPS, replica scaling formula, Stream filter patterns) moved to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\n> Step 3 keeps the instance table and sizing rules.\n\n## Prerequisites (verify before provisioning)\n\nBefore emitting provisioning commands, verify these prerequisites. If\nany are missing, the verdict is **PREREQUISITES_MISSING**.\n\n| Prerequisite | Why it matters | How to verify |\n|---|---|---|\n| VPC and subnets (>= 2 AZs) | Cluster needs multi-AZ subnet group | `aws ec2 describe-subnets` |\n| Subnet group exists or creatable | Cluster requires a DB subnet group | `aws rds describe-db-subnet-groups` |\n| Security group (port 8182) | Neptune default port for client connections | `aws ec2 describe-security-groups` |\n| Instance type selected | Memory (graph fit) + IOPS (traversals) | `aws neptune describe-orderable-db-instance-options` |\n| Engine version selected | Feature support (ML, Streams, Global DB) | `aws neptune describe-db-engine-versions` |\n| Query language decision (Gremlin\u002FSPARQL\u002Fboth) | Application client library depends on it | Assess use case |\n| Parameter group decision | neptune_enforce_ssl, neptune_query_timeout, neptune_streams | Assess security + performance |\n| Encryption decision | MUST be at creation — cannot toggle later | Assess compliance |\n| IAM auth decision | MUST be at cluster creation | Assess access control |\n| Neptune ML decision (if needed) | S3 bucket + SageMaker IAM role required | Assess ML requirements |\n| KMS key (if encryption with CMK) | Custom KMS key must exist | `aws kms describe-key` |\n| Neptune Streams decision | Must be enabled in parameter group | Assess change capture needs |\n| Snapshot window vs maintenance window | Must not overlap | Plan windows |\n\nIf any prerequisite is missing, output `VERDICT: PREREQUISITES_MISSING`\nand cite the specific gap.\n\n## Step 1 — Gremlin vs SPARQL query language\n\n| Feature | Gremlin | SPARQL |\n|---|---|---|\n| Graph model | Property graph | RDF (Resource Description Framework) |\n| Query style | Traversal-based (imperative) | Pattern-matching (declarative) |\n| Best for | Multi-hop traversals, path queries | Linked data, semantic queries, federation |\n| Client library | Gremlin console, TinkerPop drivers | Jena, RDF4J, SPARQL endpoints |\n| Same cluster? | Yes — both supported on one Neptune cluster | Yes |\n| Performance | Optimized for traversals | Optimized for pattern matching |\n\n**Choose Gremlin** for social network analysis, recommendation engines,\nand fraud detection (multi-hop traversals). **Choose SPARQL** for\nsemantic web, linked data integration, and complex pattern matching\nacross heterogeneous data.\n\nA Neptune cluster supports both. The application connects with the\nappropriate client library. No separate cluster is needed.\n\n## Step 2 — Cluster creation (primary + read replicas)\n\nA Neptune cluster has one primary instance (serves reads + writes) and\n0-15 read replicas (serve reads only). All writes go to the primary.\n\n> Cluster\u002Fprimary\u002Freplica creation CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Topology rule: one primary (reads+writes) + 0-15 read replicas (reads only), replicas in different AZs.\n\n**Common mistake:** using `aws rds` commands instead of `aws neptune`.\nNeptune uses its own API namespace (`aws neptune`) even though the\nparameters mirror RDS.\n\n## Step 3 — Instance types and storage\n\n| Instance type | Memory | vCPUs | Use case |\n|---|---|---|---|\n| db.r5.large | 16 GB | 2 | Small dev\u002Ftest graphs |\n| db.r5.4xlarge | 128 GB | 16 | Medium production graphs |\n| db.r5.8xlarge | 256 GB | 32 | Large production graphs |\n| db.r5.12xlarge | 384 GB | 48 | High-memory traversals |\n| db.x2g.8xlarge | 1 TB | 32 | Very large graph working sets |\n\n**Sizing rules:**\n- Memory must fit the graph working set (vertices + edges + indexes).\n- IOPS scale with instance type and EBS volume configuration.\n- Provisioned IOPS (io2) recommended for traversal-heavy workloads.\n- Read replicas scale read concurrency, NOT write throughput.\n\n> Instance-option enumeration CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Sizing rules above remain authoritative.\n\n## Step 4 — Subnet groups and security groups\n\n> Subnet-group and security-group CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Port 8182 inbound from the app SG is mandatory — see Critical note below.\n\n**Critical:** Neptune uses port 8182 for all client connections (both\nGremlin and SPARQL). The security group must allow inbound from the\napplication SG on port 8182.\n\n## Step 5 — Parameter groups (neptune_enforce_ssl, neptune_query_timeout)\n\nParameter groups control engine-level configuration including SSL\nenforcement, query timeouts, and Streams.\n\n> Parameter-group create\u002Fmodify CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Parameter table and the static-parameter reboot warning below remain in-file.\n\n| Parameter | Default | Effect |\n|---|---|---|\n| neptune_enforce_ssl | 0 | 1 = require TLS for all connections (static — needs reboot) |\n| neptune_query_timeout | 120000 (ms) | Max query duration before timeout |\n| neptune_streams | 0 | 1 = enable Neptune Streams change log (static — needs reboot) |\n\n**Critical:** `neptune_enforce_ssl` and `neptune_streams` are static\nparameters — they require an instance reboot to take effect. Set them\nbefore the first write to avoid disruption.\n\n## Step 6 — IAM database authentication\n\nNeptune supports IAM database authentication using AWS SigV4. This\neliminates the need for database passwords.\n\n> IAM-auth creation snippet and the neptune-db:connect policy JSON moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> IAM auth MUST be enabled at creation — see Critical note below.\n\n**Critical:** IAM database authentication MUST be enabled at cluster\ncreation. It cannot be toggled on afterward. The application uses SigV4\nsigning instead of a static password.\n\n## Step 7 — Encryption at rest (KMS)\n\n**Encryption is creation-time-only for Neptune clusters.** It CANNOT be\ntoggled on after the cluster exists.\n\n> Encrypted-cluster creation CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Encryption is creation-time-only; existing clusters need a new cluster + reload.\n\nTo encrypt an existing non-encrypted cluster, create a new encrypted\ncluster and load data via the bulk loader or Neptune Export\u002FImport.\n\n## Step 8 — Neptune Streams (change log)\n\nNeptune Streams captures every graph mutation (ADD, UPDATE, REMOVE) in\na change log. Enable it in the parameter group.\n\n> Streams enable\u002Freboot CLI, stream-consumer curl, and filter-pattern JSON moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Streams capture only post-enablement changes — see Critical note below.\n\n**Critical:** Streams only capture changes AFTER enablement. Past\nmutations are NOT retroactively available. Filter aggressively to reduce\nconsumer processing load.\n\n## Step 9 — Neptune ML integration\n\nNeptune ML uses SageMaker to train and deploy graph machine learning\nmodels (node classification, link prediction, edge regression).\n\n**Prerequisites:**\n- S3 bucket for model artifacts and training data export.\n- IAM role with SageMaker + Neptune + S3 permissions.\n- The Neptune ML workflow: export data, train model, create inference\n  endpoint.\n\n> Neptune ML export\u002Ftraining CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Prerequisites and the inference-latency implication remain in-file.\n\n**Key implication:** Neptune ML inference endpoints add latency to\nqueries. Use them for batch inference, not real-time low-latency paths.\n\n## Step 10 — Global Database (cross-region)\n\nNeptune Global Database provides cross-region read replicas for disaster\nrecovery and low-latency multi-region reads.\n\n> Global Database create\u002Fsecondary\u002Freplica CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Constraints (matching engine versions, read-only secondary) below.\n\n**Constraints:** same engine version across regions; secondary cluster\nis read-only until failover; replication lag depends on cross-region\nnetwork distance.\n\n## Step 11 — Auto-scaling read replicas\n\nNeptune supports Application Auto Scaling for read replicas based on\nCloudWatch metrics.\n\n> Auto-scaling register-target and target-tracking policy CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Replicas take minutes to become available — see Key implication below.\n\n**Key implication:** read replica auto-scaling adds replicas (0-15 max)\nbased on CPU utilization or replica lag. Replicas take minutes to become\navailable — spikes can still cause timeouts during scale-out.\n\n## Step 12 — Bulk loader\n\nThe Neptune bulk loader is for initial or batch data ingestion from S3.\n\n> Bulk-loader curl payload and mode\u002Fparallelism best practice moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Loader is for batch ingestion, not streaming — see Critical note below.\n\n**Critical:** the bulk loader is for batch ingestion, not continuous\nstreaming. For streaming writes, use the application SDK or Neptune\nStreams consumer pattern.\n\n## Step 13 — CloudWatch metrics and monitoring\n\n| Metric | Namespace | What it measures |\n|---|---|---|\n| VolumeBytesUsed | AWS\u002FNeptune | Storage consumed by the graph |\n| EngineCPUUtilization | AWS\u002FNeptune | CPU usage on the instance |\n| GremlinRequestsPerSec | AWS\u002FNeptune | Gremlin query rate |\n| GremlinWebSocketOpenConnections | AWS\u002FNeptune | Active Gremlin WebSocket connections |\n| SparqlRequestsPerSec | AWS\u002FNeptune | SPARQL query rate |\n| TotalRequestsPerSec | AWS\u002FNeptune | Total query rate (Gremlin + SPARQL) |\n| DbCPUUtilization | AWS\u002FNeptune | Database process CPU |\n| DbFreeableMemory | AWS\u002FNeptune | Available memory |\n| BufferCacheHitRatio | AWS\u002FNeptune | Cache effectiveness for traversals |\n\n> CloudWatch monitoring CLI (CPU, storage growth) and alert thresholds moved to [references\u002Fdiagnostic-commands.md](references\u002Fdiagnostic-commands.md).\n> Metric table above stays authoritative.\n\n## Step 14 — Snapshot management\n\n| Snapshot type | How | Retention |\n|---|---|---|\n| Automated | Within backup window | 1-35 days (backup-retention-period) |\n| Manual | On-demand via API | Until manually deleted |\n\n> Snapshot create\u002Frestore CLI moved to [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md).\n> Snapshot type\u002Fretention table above.\n\n## Step 15 — Recent features\n\n> Recent features (2023-2025) moved to [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md).\n> Load on demand — Neptune Analytics, OpenCypher, loader\u002FStreams\u002FGlobal DB improvements, r7g.\n\n## NEVER do these things\n\n1. **NEVER assume encryption can be enabled after cluster creation.**\n   Storage encryption is creation-time-only for Neptune clusters.\n   Existing non-encrypted clusters require migration to a new encrypted\n   cluster.\n\n2. **NEVER use `aws rds` commands for Neptune.** Neptune uses its own\n   API namespace (`aws neptune`). The parameters mirror RDS, but the\n   API endpoints are different.\n\n3. **NEVER assume read replicas scale write throughput.** All writes go\n   to the primary instance. Read replicas only serve read queries. If\n   writes are the bottleneck, use a larger primary instance type.\n\n4. **NEVER change `neptune_enforce_ssl` without a reboot plan.**\n   `neptune_enforce_ssl` is a static parameter — it requires an instance\n   reboot to take effect. Plan for the brief downtime.\n\n5. **NEVER enable Neptune Streams and expect past changes to be\n   captured.** Streams only capture changes AFTER enablement. Past\n   mutations are NOT retroactively available.\n\n6. **NEVER create a Global Database with mismatched engine versions.**\n   Primary and secondary must use the same engine version. Mismatches\n   cause replication failures.\n\n7. **NEVER use the bulk loader for streaming writes.** The bulk loader\n   is for initial or batch data ingestion from S3. For streaming, use\n   the application SDK or Neptune Streams consumer pattern.\n\n8. **NEVER forget the security group port.** Neptune uses port 8182\n   for all client connections (Gremlin, SPARQL, and OpenCypher). Wrong\n   port is a silent failure.\n\n9. **NEVER enable IAM database authentication on an existing cluster.**\n   IAM auth must be enabled at cluster creation. It cannot be toggled\n   afterward.\n\n10. **NEVER scale read replicas without monitoring replica lag.**\n    Auto-scaling adds replicas based on CPU utilization, but new replicas\n    take minutes to become available. Monitor `NeptuneReadReplicaLag`\n    during scale-out.\n\n## Output format\n\n```text\nNEPTUNE: \u003Ccluster-id> (\u003Cinstance-type>, \u003Cengine-version>)\nVERDICT: READY_TO_DEPLOY | PREREQUISITES_MISSING\nCHECKLIST:\n  [✓|✗] Query language: Gremlin | SPARQL | OpenCypher | Multiple\n  [✓|✗] Topology: Primary + \u003CN> read replicas (across \u003CM> AZs)\n  [✓|✗] Instance type: \u003Cinstance-type> (\u003Cmemory> GB, \u003CIOPS> baseline)\n  [✓|✗] Subnet group: \u003Csubnet-group-name> (\u003CN> AZs)\n  [✓|✗] Security group: \u003Csg-id> (port 8182)\n  [✓|✗] Parameter group: \u003Cparam-group-name> (neptune_enforce_ssl=\u003C0|1>, neptune_query_timeout=\u003Cms>)\n  [✓|✗] IAM database authentication: Enabled | Disabled\n  [✓|✗] At-rest encryption (KMS): Enabled (key \u003Ckms-key-id>) | Disabled\n  [✓|✗] Neptune Streams: Enabled (filter \u003Cpattern>) | Disabled\n  [✓|✗] Neptune ML: Enabled (S3 bucket \u003Cbucket>, SageMaker role \u003Crole>) | Not configured\n  [✓|✗] Global Database: \u003Cglobal-id> (primary \u003Cregion>, secondary \u003Cregion>) | Not configured\n  [✓|✗] Auto-scaling: Target tracking (\u003Cmetric>, target \u003Cvalue>) | Not configured\n  [✓|✗] Backup: Automated (retention \u003CN> days, window \u003Cwindow>) | Manual only\n  [✓|✗] Snapshot window: \u003Cwindow> (no overlap with maintenance \u003Cwindow>)\n  [✓|✗] Bulk loader: Ready (S3 \u003Cbucket>, IAM role \u003Crole>) | Not needed\n  [✓|✗] Tags: \u003Ckey=value list>\nVERIFICATION_COMMANDS:\n  aws neptune describe-db-clusters --db-cluster-identifier \u003Ccluster-id> --region \u003Cregion>\n  aws neptune describe-db-instances --db-instance-identifier \u003Cprimary-id> --region \u003Cregion>\n  aws cloudwatch get-metric-statistics --namespace AWS\u002FNeptune --metric-name EngineCPUUtilization --dimensions Name=DBInstanceIdentifier,Value=\u003Cprimary-id> --region \u003Cregion>\n```\n\n### Worked example — Neptune cluster with Gremlin, encryption, IAM auth, Streams, and read replicas\n\n> Secondary worked example (full READY_TO_DEPLOY block) moved to [references\u002Fworked-examples.md](references\u002Fworked-examples.md).\n> The Perfect example under the STRICT output contract above is the primary in-file example.\n\n## Error handling\n\n> Error-handling deep dives (encryption unsupported, connectivity, replica lag, empty Streams, Global DB replication, loader errors) moved to [references\u002Ferror-handling.md](references\u002Ferror-handling.md).\n> Load on demand when provisioning or verification fails.\n\n## Domain\n\nAWS CloudOps \u002F Amazon Neptune Graph Database Cluster Provisioning &\nGraph Data Management.\n\n## AWS documentation\n\n- **Neptune User Guide** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fintro.html\n- **Creating a Neptune cluster** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fmanage-console-launch.html\n- **Gremlin and SPARQL** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Faccess-graph-gremlin.html\n- **Neptune ML** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fmachine-learning.html\n- **IAM database authentication** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fiam-auth.html\n- **Encryption at rest** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fencrypt.html\n- **Neptune Streams** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fstreams.html\n- **Global Database** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fneptune-global-database.html\n- **Parameter groups** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fparameters.html\n- **Bulk loader** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fload-data.html\n- **CloudWatch metrics** — https:\u002F\u002Fdocs.aws.amazon.com\u002Fneptune\u002Flatest\u002Fuserguide\u002Fcw-metrics.html\n## References (load on demand)\n- [references\u002Ferror-handling.md](references\u002Ferror-handling.md) — provisioning\u002Fconnectivity\u002Fstream\u002Floader error deep dives.\n- [references\u002Fadvanced-patterns.md](references\u002Fadvanced-patterns.md) — misconceptions, dependency graph, sizing heuristic, recent features.\n- [references\u002Fworked-examples.md](references\u002Fworked-examples.md) — secondary full worked example.\n- [references\u002Fdiagnostic-commands.md](references\u002Fdiagnostic-commands.md) — CloudWatch monitoring CLI and alert thresholds.\n- [references\u002Fprovisioning-cli-commands.md](references\u002Fprovisioning-cli-commands.md) — all provisioning CLI blocks (Steps 2-12, 14).\n\n",{"name":5,"license":15,"metadata":24,"description":7,"compatibility":41},{"tags":25,"phase":26,"author":27,"domain":28,"family":29,"version":30,"keywords":31,"task_type":32,"complexity":33,"entry_point":34,"skill_class":35,"when_to_use":36,"dependencies":37,"requires_llm":38,"verdict_shape":39,"lifecycle_status":40,"supports_pipeline":38},"aws, neptune, graph-database, gremlin, sparql, cloudops, deploy, databases, provisioning, read-replica, encryption, neptune-ml, global-database","1","Jacky Chan — AWS Community Builder","aws-cloudops","Databases","0.1.0","aws, neptune, graph database, gremlin, sparql, cloudops, deploy, provisioning, read replica, cluster, neptune ml, iam auth, encryption, kms, neptune streams, global database, bulk loader, auto scaling","deploy","high","false","capability","Invoke when the user wants to create an Amazon Neptune graph database cluster, configure primary and read replicas, enable Neptune ML integration, configure IAM database authentication, enable encryption at rest with KMS, set parameter groups (neptune_enforce_ssl, neptune_query_timeout), configure Neptune Streams for change logging, create a Neptune Global Database for cross-region disaster recovery, choose between Gremlin and SPARQL query languages, set up auto-scaling read replicas, or run the Neptune bulk loader. Do NOT invoke for Amazon Neptune Analytics (serverless graph analytics), Amazon RDS\u002FAurora (relational databases), or Amazon OpenSearch (search\u002Fdocument databases).","aws-orchestrator","true","READY_TO_DEPLOY | PREREQUISITES_MISSING","active","Agent runtime that reads SKILL.md (Claude Code, Cursor, Windsurf, Codex, Gemini). For live deployment: AWS CLI v2 with neptune and rds access (Neptune uses RDS-style cluster APIs). Works with Terraform aws_neptune_cluster \u002F aws_neptune_cluster_instance \u002F aws_neptune_cluster_parameter_group resources and CloudFormation AWS::Neptune::DBCluster \u002F AWS::Neptune::DBInstance templates.","main","eeace51bd5dd1db2030729d83eeab988861553aa","skills\u002Fneptune-graph-deployer",0,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills","https:\u002F\u002Fgithub.com\u002Fjhkchan","CTO & Co-Founder @Beever-AI  & @votee. CAISP. AWS Community Builder. Organizer@GDGCloudHK. MongoDB Champion. Technopreneur + Infornographer.","2026-09-24 08:54:10",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add jhkchan\u002Faws-agent-skills --skill neptune-graph-deployer",{"tool":56,"command":57},"bunx","bunx skills add jhkchan\u002Faws-agent-skills --skill neptune-graph-deployer",{"tool":59,"command":60},"pnpm","pnpm dlx skills add jhkchan\u002Faws-agent-skills --skill neptune-graph-deployer","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002FSKILL.md",true,[64,70,74,78,82,86,90,94,98,102,106,109,112,116,120,124,128,132,136,140,144],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"eval\u002Ftest-cases.yaml","REFERENCE","参考文档",611,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Feval\u002Ftest-cases.yaml",{"path":71,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":72,"sourceHtmlUrl":73},"evals\u002Fbaselines\u002Fmissing-subnet-group.md",279,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Fevals\u002Fbaselines\u002Fmissing-subnet-group.md",{"path":75,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":76,"sourceHtmlUrl":77},"evals\u002Fbaselines\u002Fneptune-cluster-gremlin.md",313,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Fevals\u002Fbaselines\u002Fneptune-cluster-gremlin.md",{"path":79,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":80,"sourceHtmlUrl":81},"evals\u002Fbaselines\u002Fneptune-ml-integration.md",312,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Fevals\u002Fbaselines\u002Fneptune-ml-integration.md",{"path":83,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":84,"sourceHtmlUrl":85},"evals\u002Fbaselines\u002Fneptune-sparql.md",304,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Fevals\u002Fbaselines\u002Fneptune-sparql.md",{"path":87,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":88,"sourceHtmlUrl":89},"evals\u002Fbaselines\u002Fneptune-without-ssl.md",278,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Fevals\u002Fbaselines\u002Fneptune-without-ssl.md",{"path":91,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":92,"sourceHtmlUrl":93},"evals\u002Feval_config.yaml",48,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Fevals\u002Feval_config.yaml",{"path":95,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":96,"sourceHtmlUrl":97},"evals\u002Fevals.json",1169,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Fevals\u002Fevals.json",{"path":99,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":100,"sourceHtmlUrl":101},"evals\u002Fprompts\u002Fmissing-subnet-group.md",209,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Fevals\u002Fprompts\u002Fmissing-subnet-group.md",{"path":103,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":104,"sourceHtmlUrl":105},"evals\u002Fprompts\u002Fneptune-cluster-gremlin.md",380,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Fevals\u002Fprompts\u002Fneptune-cluster-gremlin.md",{"path":107,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":72,"sourceHtmlUrl":108},"evals\u002Fprompts\u002Fneptune-ml-integration.md","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Fevals\u002Fprompts\u002Fneptune-ml-integration.md",{"path":110,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":88,"sourceHtmlUrl":111},"evals\u002Fprompts\u002Fneptune-sparql.md","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Fevals\u002Fprompts\u002Fneptune-sparql.md",{"path":113,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":114,"sourceHtmlUrl":115},"evals\u002Fprompts\u002Fneptune-without-ssl.md",202,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Fevals\u002Fprompts\u002Fneptune-without-ssl.md",{"path":117,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":118,"sourceHtmlUrl":119},"examples\u002FREADME.md",280,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Fexamples\u002FREADME.md",{"path":121,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":122,"sourceHtmlUrl":123},"references\u002Fadvanced-patterns.md",6980,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Freferences\u002Fadvanced-patterns.md",{"path":125,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":126,"sourceHtmlUrl":127},"references\u002Fconfig-patterns.md",230,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Freferences\u002Fconfig-patterns.md",{"path":129,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":130,"sourceHtmlUrl":131},"references\u002Fdiagnostic-commands.md",1212,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Freferences\u002Fdiagnostic-commands.md",{"path":133,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":134,"sourceHtmlUrl":135},"references\u002Ferror-handling.md",1468,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Freferences\u002Ferror-handling.md",{"path":137,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":138,"sourceHtmlUrl":139},"references\u002Fprovisioning-cli-commands.md",8316,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Freferences\u002Fprovisioning-cli-commands.md",{"path":141,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":142,"sourceHtmlUrl":143},"references\u002Fworked-examples.md",1888,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Freferences\u002Fworked-examples.md",{"path":145,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":146,"sourceHtmlUrl":147},"skill.usf.yaml",4514,"https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fneptune-graph-deployer\u002Fskill.usf.yaml",[149,156,163,170,177,184],{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":19},"01M7ADVD60X4PCAPKSE58P9NDC","xray-tracing-deployer","Deploys AWS X-Ray distributed tracing with production-grade configuration: X-Ray daemon deployment (EC2 systemd, ECS sidecar, EKS DaemonSet, Lambda built-in), SDK instrumentation (Java, Python, Node.js, Go, .NET) with annotations and metadata, sampling rules (default reservoir + rate vs custom rules with URL \u002F method \u002F service-name predicates), service map generation, trace query and retrieval, groups and insights, CloudWatch ServiceLens integration, IAM permissions (PutTraceSegments, GetSamplingRules), and latest features (Lambda Powertools tracing, OpenTelemetry \u002F ADOT Collector support, W3C trace context). Emits a READY_TO_DEPLOY checklist with every configuration item verified. Use when enabling X-Ray on a new application, adding tracing to ECS \u002F EKS \u002F Lambda, validating a sampling configuration, or generating daemon deployment CLI and IaC templates. Triggers: X-Ray, distributed tracing, X-Ray daemon, sampling rules, service map, X-Ray SDK, OpenTelemetry, ADOT, Lambda Powertools, CloudWatch ServiceLens.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxray-tracing-deployer\u002FSKILL.md",[],[],{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":19},"01M7ADTVJ7DCBM9CB1FY51GH7J","wellarchitected-workload-auditor","Audits AWS Well-Architected Tool workloads for review staleness, per-pillar high-risk issue counts, milestone tracking gaps, and remediation plan completeness. Emits a deterministic verdict (STALE_REVIEW | HIGH_RISK | CONFIG_GAP | OK) per workload with per-pillar risk breakdown, milestone trend analysis, and specific remediation. Use when reviewing Well-Architected workloads, checking WA review freshness, auditing high-risk issues per pillar, validating milestone coverage, or tracking remediation plans.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwellarchitected-workload-auditor\u002FSKILL.md",[],[],{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":19},"01M7ADT59G6FTTNZYHT2QRPNNP","wellarchitected-review-operator","Operates AWS Well-Architected Tool reviews end-to-end — creates workloads, runs pillar reviews (operational excellence, security, reliability, performance, cost optimization, sustainability, Prosperity), answers questions with risk-tier rationale, generates reports and improvement plans, creates milestones, and integrates with Trusted Advisor and Well-Architected Labs. Runs deterministic pre-checks (workload existence, lens availability, pillar coverage), emits the exact update-answer \u002F get-consolidated-report CLI behind a CONFIRM gate, and verifies risk-tier transitions. Emits READY | BLOCKED | COMPLETED. Use when creating a workload, answering pillar questions, generating an improvement plan, creating a milestone, or integrating with Trusted Advisor. Triggers: well-architected tool, well architected review, workload review, pillar, operational excellence, security, reliability, performance, cost optimization, sustainability, prosperity, improvement plan, milestone, trusted advisor.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwellarchitected-review-operator\u002FSKILL.md",[],[],{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":176,"publishedAt":19},"01M7ADSH5JA9QHNPPHQCD7EVA7","wafv2-web-acl-deployer","Provisions AWS WAFv2 Web ACLs with correct production defaults: scope selection (CLOUDFRONT vs REGIONAL), managed rule groups (AWSManagedRulesCommonRuleSet, SQLiRuleSet, LinuxRuleSet, WindowsRuleSet, IPReputationList, BotControlRuleSet, AmazonIpReputationList, ATP), custom rules (byte match, IP set, regex pattern, geo match, size constraint, rate-based), rule priority ordering, logging destinations (Kinesis Firehose, CloudWatch Logs, S3), resource association (ALB, API Gateway, CloudFront), rate-based rules with aggregate keys (IP, forwarded IP), Challenge and CAPTCHA actions, and account takeover prevention. Emits a READY_TO_DEPLOY checklist. Use when creating a Web ACL, attaching managed rules, configuring rate limiting, enabling WAF logging, associating a Web ACL with an ALB\u002FAPI Gateway\u002FCloudFront, or configuring CAPTCHA\u002FChallenge actions. Triggers: create WAF Web ACL, WAFv2, managed rule groups, WAF rate limiting, WAF logging, WAF CAPTCHA, WAF Challenge action, bot control, ATP managed rules.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwafv2-web-acl-deployer\u002FSKILL.md",[],[],{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":183,"publishedAt":19},"01M7ADRYFAT8R73FBNCHRC573X","wafv2-web-acl-auditor","Audits AWS WAFv2 Web ACL configurations to determine whether the ACL provides effective protection: default-action posture (Allow vs Block), managed-rule-group coverage gaps, rule effectiveness (BLOCK vs COUNT, shadow\u002Fbypass rules, stale exclusions), rate-based rule correctness, logging and visibility configuration, and text-transformation bypass vectors. Emits a deterministic verdict per Web ACL. Use when reviewing a WAFv2 Web ACL for security posture, checking managed-rule coverage, validating rate-limit configuration, auditing WAF logging, or hardening a WAF before production deployment. Triggers: WAF, WAFv2, Web ACL, managed rule group, AWSManagedRules, rate-based rule, CAPTCHA, Challenge, OverrideAction, Count mode, forwarded IP, Bot Control, ATP, text transformation, WAF logging, WAF visibility, OWASP, SQLi, XSS, RFI.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwafv2-web-acl-auditor\u002FSKILL.md",[],[],{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":190,"publishedAt":19},"01M7ADR8W7G72JX4KFGN03QK8Q","waf-rule-deployer","Provisions AWS WAFv2 rule sets with production defaults: Web ACL creation (CloudFront scope in us-east-1 vs Regional scope), rule groups (managed vs custom) with capacity planning in WCU (Web ACL Capacity Units, 1500 default per ACL), managed rule groups (AWSManagedRulesCommonRuleSet, AWSManagedRulesSQLiRuleSet, AWSManagedRulesAmazonIpReputationList, AWSManagedRulesLinuxRuleSet, AWSManagedRulesWindowsRuleSet, AWSManagedRulesUnixRuleSet), custom rules (byte-match, regex pattern set, geo-match, rate-based), IP set and regex pattern set resources, rule priority ordering (lowest number evaluated first), action types (allow, block, count, CAPTCHA, Challenge), bot control managed rule group, account takeover. Triggers: create WAF rule, WAF managed rule group, WAF custom rule, WAF byte match, WAF geo match, WAF rate based rule, WAF IP set, WAF regex pattern set, WAF WCU budget, WAF CloudFront ACL, WAF logging Kinesis Firehose, WAF bot control, WAF ATP, WAF label matching, WAF Challenge action, WAF CAPTCHA.","https:\u002F\u002Fgithub.com\u002Fjhkchan\u002Faws-agent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwaf-rule-deployer\u002FSKILL.md",[],[]]