processing-s3-uploads-with-step-functions

Deploys an event-driven Step Functions workflow routing S3 uploads to Lambda or Fargate by file size.

2.5k|282|Updated Apr 23, 2026
One-click install
npx skills add https://github.com/aws/agent-toolkit-for-aws --skill processing-s3-uploads-with-step-functions
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: processing-s3-uploads-with-step-functions
Source: https://github.com/aws/agent-toolkit-for-aws/tree/main/skills/specialized-skills/serverless-skills/processing-s3-uploads-with-step-functions
Command: npx skills add https://github.com/aws/agent-toolkit-for-aws --skill processing-s3-uploads-with-step-functions

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires boto3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Processing S3 uploads often requires different compute depending on file size: small files fit Lambda's limits while large files need containerized Fargate tasks. Manually wiring S3, EventBridge, Step Functions, Lambda, ECS, ECR, VPC networking, and scoped IAM roles is error-prone and time-consuming.

Core Features & Use Cases

  • Event-driven routing: EventBridge triggers a Step Functions state machine on S3 object creation, and a Choice state routes files ≤ 6 MB to Lambda and larger files to a Fargate task.
  • Complete infrastructure provisioning: Creates the S3 bucket with encryption, ECR repository, ECS cluster and task definition, VPC security group with scoped egress, CloudWatch log group with KMS encryption, and least-privilege IAM roles.
  • Built-in observability: Configures an SQS dead-letter queue for failed EventBridge invocations and a CloudWatch alarm on Step Functions execution failures.
  • Use Case: A data engineering team receives mixed-size file uploads from partners and needs small CSVs processed instantly in Lambda while multi-gigabyte archives run as Fargate containers, all orchestrated automatically.

Quick Start

Ask the agent to deploy the S3 upload processing workflow with Step Functions, providing a bucket name, AWS region, ECR repository name, and state machine name.

Frequently Asked Questions about processing-s3-uploads-with-step-functions

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I route S3 uploads to Lambda or Fargate based on file size?▼

Enable EventBridge notifications on the S3 bucket, create an EventBridge rule matching Object Created events, and target a Step Functions state machine. A Choice state checks $.detail.object.size and routes files over 6 MB to an ECS RunTask call and smaller files to a Lambda invocation.

How do I trigger a Step Functions state machine from S3 events?▼

Enable EventBridge notifications on the bucket with put-bucket-notification-configuration, then create an EventBridge rule filtering on source aws.s3 and detail-type Object Created. Add the state machine as a target with an IAM role allowing states:StartExecution.

What prerequisites are needed to deploy this Step Functions workflow?▼

You need AWS CLI v2 configured with valid credentials, Python 3.12 for the Lambda runtime, and Docker to build and push the Fargate container image to ECR. A default VPC with at least two subnets is also required for the Fargate task networking.

Why is my EventBridge rule not triggering Step Functions on S3 uploads?▼

Verify EventBridge notifications are enabled on the bucket with get-bucket-notification-configuration, confirm the rule exists with aws events describe-rule, and check the target has the correct state machine ARN and an IAM role with states:StartExecution permission.

When should I not use Step Functions with Lambda and Fargate for file processing?▼

Skip this pattern when all files fit within Lambda's limits, since a direct S3-to-Lambda trigger is simpler. It is also unsuitable for real-time streaming workloads, where Kinesis is the appropriate service.

Why is my Fargate task stuck in PROVISIONING state?▼

Fargate tasks stall in PROVISIONING when subnets lack auto-assign public IP or the route table has no 0.0.0.0/0 route to an internet gateway. Verify the internet gateway is attached and the security group permits required outbound traffic.