processing-s3-uploads-with-step-functions

Deploys an event-driven Step Functions workflow routing S3 uploads to Lambda or Fargate by file size.

2.5k|282|Updated Apr 23, 2026
One-click install
npx skills add https://github.com/aws/agent-toolkit-for-aws --skill processing-s3-uploads-with-step-functions
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: processing-s3-uploads-with-step-functions
Source: https://github.com/aws/agent-toolkit-for-aws/tree/main/skills/specialized-skills/serverless-skills/processing-s3-uploads-with-step-functions
Command: npx skills add https://github.com/aws/agent-toolkit-for-aws --skill processing-s3-uploads-with-step-functions

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires boto3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Processing S3 uploads often requires different compute depending on file size: small files fit Lambda's limits while large files need containerized Fargate tasks. Manually wiring S3, EventBridge, Step Functions, Lambda, ECS, ECR, VPC networking, and scoped IAM roles is error-prone and time-consuming.

Core Features & Use Cases

  • Event-driven routing: EventBridge triggers a Step Functions state machine on S3 object creation, and a Choice state routes files ≤ 6 MB to Lambda and larger files to a Fargate task.
  • Complete infrastructure provisioning: Creates the S3 bucket with encryption, ECR repository, ECS cluster and task definition, VPC security group with scoped egress, CloudWatch log group with KMS encryption, and least-privilege IAM roles.
  • Built-in observability: Configures an SQS dead-letter queue for failed EventBridge invocations and a CloudWatch alarm on Step Functions execution failures.
  • Use Case: A data engineering team receives mixed-size file uploads from partners and needs small CSVs processed instantly in Lambda while multi-gigabyte archives run as Fargate containers, all orchestrated automatically.

Quick Start

Ask the agent to deploy the S3 upload processing workflow with Step Functions, providing a bucket name, AWS region, ECR repository name, and state machine name.

Frequently Asked Questions about processing-s3-uploads-with-step-functions

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I route S3 uploads to Lambda or Fargate based on file size?

Enable EventBridge notifications on the S3 bucket, create an EventBridge rule matching Object Created events, and target a Step Functions state machine. A Choice state checks $.detail.object.size and routes files over 6 MB to an ECS RunTask call and smaller files to a Lambda invocation.

How do I trigger a Step Functions state machine from S3 events?

Enable EventBridge notifications on the bucket with put-bucket-notification-configuration, then create an EventBridge rule filtering on source aws.s3 and detail-type Object Created. Add the state machine as a target with an IAM role allowing states:StartExecution.

What prerequisites are needed to deploy this Step Functions workflow?

You need AWS CLI v2 configured with valid credentials, Python 3.12 for the Lambda runtime, and Docker to build and push the Fargate container image to ECR. A default VPC with at least two subnets is also required for the Fargate task networking.

Why is my EventBridge rule not triggering Step Functions on S3 uploads?

Verify EventBridge notifications are enabled on the bucket with get-bucket-notification-configuration, confirm the rule exists with aws events describe-rule, and check the target has the correct state machine ARN and an IAM role with states:StartExecution permission.

When should I not use Step Functions with Lambda and Fargate for file processing?

Skip this pattern when all files fit within Lambda's limits, since a direct S3-to-Lambda trigger is simpler. It is also unsuitable for real-time streaming workloads, where Kinesis is the appropriate service.

Why is my Fargate task stuck in PROVISIONING state?

Fargate tasks stall in PROVISIONING when subnets lack auto-assign public IP or the route table has no 0.0.0.0/0 route to an internet gateway. Verify the internet gateway is attached and the security group permits required outbound traffic.