本文へ移動
cccskills
無料GitHub で公開

aws-social-messaging

Manages WhatsApp messaging through AWS End User Messaging Social. Covers managing templates (create, update, delete, library), sending messages (utility/marketing/auth templates and freeform), uploading and managing media, configuring event destinations for delivery tracking, and troubleshooting delivery failures. Applicable when a user needs to send WhatsApp messages, create or manage templates, upload media, configure delivery notifications, or diagnose messaging issues.

インストール方法を見る

含まれるファイル(6)

  • SKILL.md11.1 KB
  • references/configuring-event-destinations.md3.9 KB
  • references/managing-media.md2.6 KB
  • references/managing-templates.md7.5 KB
  • references/sending-messages.md6.6 KB
  • references/troubleshooting-delivery.md4.3 KB

SKILL.md(原文)

インストールする前に、エージェントに与えられる指示の中身を確認できます。

AWS End User Messaging Social — WhatsApp

Overview

WhatsApp messaging via AWS End User Messaging Social: template management, sending, media handling, event destinations, and delivery troubleshooting.

Recommended setup: Use the AWS MCP server for sandboxed execution, audit logging, and enterprise controls.

Without AWS MCP: This skill works with any agent that has AWS CLI access. All commands use standard AWS CLI syntax.

Common Tasks

1. Verify Dependencies

Constraints:

  • The AWS MCP server is recommended for seamless API execution but not required — all commands use standard AWS CLI syntax
  • You MUST verify the AWS CLI is installed and configured with appropriate credentials
  • You SHOULD recommend the user assume an IAM role with ephemeral credentials
  • You MUST inform the user if any required tool is missing and how to install/configure it
  • You MUST ask the user if they want to proceed despite any missing tools
  • If the aws socialmessaging subcommand is not recognized, the user must update to the latest AWS CLI version
  • Required IAM permissions (scope to specific WABA and phone number ARNs):
    • Templates: social-messaging:CreateWhatsAppMessageTemplate, social-messaging:GetWhatsAppMessageTemplate, social-messaging:ListWhatsAppMessageTemplates, social-messaging:UpdateWhatsAppMessageTemplate, social-messaging:DeleteWhatsAppMessageTemplate, social-messaging:ListWhatsAppTemplateLibrary, social-messaging:CreateWhatsAppMessageTemplateFromLibrary
    • Sending: social-messaging:SendWhatsAppMessage
    • Media: social-messaging:PostWhatsAppMessageMedia, social-messaging:CreateWhatsAppMessageTemplateMedia, social-messaging:GetWhatsAppMessageMedia, social-messaging:DeleteWhatsAppMessageMedia
    • Events: social-messaging:PutWhatsAppBusinessAccountEventDestinations
    • Diagnostics: social-messaging:GetLinkedWhatsAppBusinessAccount, social-messaging:GetLinkedWhatsAppBusinessAccountPhoneNumber, social-messaging:ListLinkedWhatsAppBusinessAccounts
    • Supporting: sns:ListSubscriptionsByTopic, iam:PassRole (for event destination role)

2. Manage Templates

Create, update, and delete message templates (utility, marketing, authentication).

  • create-whatsapp-message-template: base64-encode --template-definition (blob type)
  • create-whatsapp-message-template-from-library: use pre-approved Meta library templates
  • list-whatsapp-template-library: browse available library templates
  • get-whatsapp-message-template: retrieve template details by --id (WABA) and --meta-template-id
  • update-whatsapp-message-template: modify existing template content
  • delete-whatsapp-message-template: requires --template-name (NOT --meta-template-name); always include --delete-all-languages
  • list-whatsapp-message-templates: response fields are templateStatus and templateCategory (NOT status/category)
  • Templates with {{N}} parameters MUST include "parameter_format": "positional" (exception: AUTHENTICATION — Meta handles OTP parameters automatically) and "example"
  • Meta reviews all templates (minutes to 24h); MUST NOT send with PENDING/REJECTED
  • Choosing the wrong category causes reclassification (UTILITY → MARKETING) which changes pricing — see managing-templates.md — Choosing the Right Category for guidance on selecting UTILITY vs MARKETING vs AUTHENTICATION
  • You MUST confirm the intended category (UTILITY, MARKETING, or AUTHENTICATION) with the user before creating a template — explain the categorization criteria and reclassification risk if the choice is ambiguous

See managing-templates.md.

3. Send Messages

Template Messages (no 24h restriction)

  • Use for: transactional updates (utility), promotions (marketing), verification codes (authentication)
  • Collect: phone number ID, recipient (E.164 with +), template name, language, parameters
  • Marketing templates may include image headers
  • --message is blob type — MUST base64-encode JSON

Freeform Messages (24h window required)

  • Use for: customer service replies within 24h of customer's last inbound message
  • Supports: text, image, document, video, audio — see WhatsApp Cloud API media reference for supported format and size constraints
  • No API to check window status — user must confirm from logs or event history
  • Media URLs MUST be publicly accessible HTTPS and remain available for the full 30-day message availability window (Meta can re-fetch anytime). For sensitive content (receipts, invoices, PII), upload via post-whatsapp-message-media and reference by media ID instead — presigned URLs cannot satisfy the 30-day availability requirement

Constraints for all sends:

  • Before executing any API call, validate parameter formats:
    • Phone number IDs match phone-number-id-* pattern
    • WABA IDs match waba-* pattern
    • Recipient numbers are E.164 with + prefix (e.g., +14155551234), or Business-Scoped User ID (BSUID) via the "recipient" field
    • Template names contain only lowercase letters, numbers, and underscores
    • Language codes use Meta's locale format with underscores (e.g., en_US, pt_BR)
    • --meta-api-version is v{Major}.{Minor} format (e.g., v21.0)
  • "messaging_product" MUST be "whatsapp" in the JSON body; check Meta's Graph API changelog for the supported Meta Graph API version
  • --message is blob type — MUST base64-encode the JSON payload
  • A successful messageId means queued, not delivered
  • You MUST ask for all required parameters upfront in a single prompt
  • You MUST accept parameters as individual values, JSON objects, or file references
  • You MUST explain each step before executing
  • You SHOULD confirm all parameters with the user before executing
  • You MUST respect the user's decision to abort
  • You MUST NOT send more than 5 messages per batch without user confirmation
  • You MUST NOT create or access credentials directly

See sending-messages.md.

4. Manage Media

Upload, retrieve, and delete media for messages and template headers.

  • post-whatsapp-message-media: upload media, returns reusable media ID
  • create-whatsapp-message-template-media: upload media specifically for template headers
  • get-whatsapp-message-media: retrieve media metadata/URL by ID
  • delete-whatsapp-message-media: remove uploaded media

See managing-media.md.

5. Configure Event Destinations

Set up delivery tracking, template status notifications, and reclassification alerts.

Set up delivery tracking, template status notifications, and reclassification alerts. A WABA can only have one event destination. See configuring-event-destinations.md for prerequisites (IAM role, SNS topic with KMS encryption, HTTPS-only subscription endpoints, condition keys) and full security controls.

6. Troubleshoot Delivery

Diagnostic flow: WABA status → phone number → templates → event destinations → quotas.

  • get-linked-whatsapp-business-account: registration MUST be COMPLETE
  • get-linked-whatsapp-business-account-phone-number: verify phone number health
  • list-linked-whatsapp-business-accounts: list all WABAs
  • Template reclassified: detectable via event destinations (real-time) or by listing templates and comparing categories; delete and recreate
  • 24h window expired: use template message instead
  • Rate limiting: new WABAs have lower limits; increases with quality
  • Recipient without WhatsApp: silently dropped

See troubleshooting-delivery.md.

Quick Reference — Common Errors

  • Access denied: verify IAM permissions scoped to WABA/phone number ARNs
  • Template rejected: body must match category; include parameter_format and example
  • Template reclassified: configure event destinations to detect; delete and recreate
  • 24h window expired: use template message instead of freeform
  • Send fails: --origination-phone-number-id is the ID (not phone number); recipient E.164 with +
  • Queued but not delivered: 200 = queued; configure event destinations for status
  • Media URL inaccessible: must be publicly accessible HTTPS

Security Considerations

  • Use least-privilege IAM policies scoped to specific social-messaging: actions and WABA/phone number ARNs
  • Use ephemeral credentials (IAM roles) instead of long-lived access keys
  • Store secrets in AWS Secrets Manager or Parameter Store — never in code or environment variables
  • Enable CloudTrail for auditing all social-messaging API calls; encrypt logs with KMS CMK
  • Encrypt SNS topics for event destinations with KMS (callbacks contain recipient metadata)
  • Encrypt CloudWatch Logs with KMS if monitoring social-messaging activity
  • Avoid sensitive data in template parameters and freeform message content (they appear in CloudTrail logs)
  • Validate recipient phone numbers to prevent unauthorized messaging
  • Verify SNS subscription endpoints are authorized by your team — validate that all subscribed email addresses and systems belong to personnel/systems that should receive sensitive delivery status and recipient metadata before confirming subscriptions. Use HTTPS-only endpoints
  • Add condition keys (aws:SourceArn, aws:SourceAccount) to SNS topic policies to prevent confused deputy attacks
  • Implement rate limiting via service quotas and CloudWatch alarms on send rates

Additional Resources

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

同じリポジトリのスキル

概要と使いどころ

Entry point for AI-agent work on AWS: pick a runtime, plan a migration for existing workloads, and build an executable POC — one phased flow. Triggers on: which runtime for my agent, AgentCore vs ECS vs EKS vs Lambda, AgentCore vs Lambda MicroVMs, deploy an AI agent on AWS, agent architecture on AWS, I have an agent idea what do I build, move/migrate my agents to AWS, agent migration plan, add AgentCore services (memory, gateway, identity, policy, observability) to an agent already on AWS, Temporal on AWS (migrate/run Temporal workers on AWS, a service orchestrated by Temporal, Temporal Cloud vs self-hosted). Temporal Workflow code is never rewritten into Step Functions. Requires at least one agentic component — a purely non-agent system (plain services, batch jobs, HTTP endpoints, non-agent Temporal Activities) is out of scope, redirected to gcp-to-aws / heroku-to-aws / llm-to-bedrock. Not for: compute/data migration with no AI agent; pure LLM SDK rewrite (use llm-to-bedrock); per-model pricing.

日本語の概要は準備中です。原文の説明を表示しています。

aws/agent-toolkit-for-aws2,8502026年10月12日 更新

Use to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments, or resource removal. Triggers: "add memory", "remember across sessions", "call agent from app", "invoke agent from code", "agent auth", "streaming", "VPC", "VPC connectivity", "can't reach from VPC", "multi-agent", "A2A", "A2A auth", "orchestrator not delegating", "specialist not called", "migrate Bedrock Agent", "migration issue", "change model", "browser tool", "code interpreter", "delete agent", "tear down", "agentcore remove", "cross-account memory", "add payments capability to my agent", "wire payments plugin", "integrate x402 payments with the agent I'm building", "add MPP payments", "Machine Payments Protocol". External APIs via Gateway: use agents-connect. New project: use agents-get-started. CLI/dev-server errors: use agents-debug. Runtime x402/MPP payments: use agents-pay. Migration-specific Strands vs LangGraph routes here.

日本語の概要は準備中です。原文の説明を表示しています。

aws/agent-toolkit-for-aws2,8502026年10月12日 更新

Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: "connect to API", "add gateway", "connect to MCP server", "Lambda tools", "OpenAPI", "gateway target", "Cedar policy", "restrict tools", "policy engine", "gateway auth error", "store API key", "outbound credential", "env var API key", "API key None after deploy", "credential not available after deploy", "should this be a gateway target", "give my agent tools", "add tools to agent". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.

日本語の概要は準備中です。原文の説明を表示しています。

aws/agent-toolkit-for-aws2,8502026年10月12日 更新

Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: "agent not working", "wrong answer", "agent error", "tool call failing", "debug agent", "check logs", "read traces", "broken", "500 error", "424 error", "model access denied", "command not found", "stuck in DELETING", "maxVms exceeded", "cold start diagnosis", "cold start slow", "agentcore create error", "create failed", "exit code 7", "connection refused local dev". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.

日本語の概要は準備中です。原文の説明を表示しています。

aws/agent-toolkit-for-aws2,8502026年10月12日 更新

Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK/IAM/quota error diagnosis, version management, rollback, and canary deployments. Triggers on: "deploy my agent", "agentcore deploy", "deploy failed", "CDK error", "rollback", "canary deploy", "pin version", "redeploy", "deploy stuck". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.

日本語の概要は準備中です。原文の説明を表示しています。

aws/agent-toolkit-for-aws2,8502026年10月12日 更新

Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: "build an agent", "create an agent", "get started", "new project", "agentcore create", "which framework", "Strands vs LangGraph", "hello world agent", "first agent", "create MCP server", "host MCP server", "agentcore dev", "dev server", "what port", "local development". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.

日本語の概要は準備中です。原文の説明を表示しています。

aws/agent-toolkit-for-aws2,8502026年10月12日 更新

aws のスキルをすべて見る

このスキルの問題を報告する