alivirgo AWS CLI & Cloud APIs AI Skill Guide
Overview & Engine Architecture
The AWS CLI v2 calls AWS service APIs using a credential chain (environment, SSO/profile, instance role). Every mutating call is account- and region-scoped. Agents always print caller identity and region before deletes, prefer least-privilege IAM, and keep long-lived access keys out of git and chat.
User / CI
-> aws CLI v2
-> credential chain (SSO / env / role)
-> service APIs (S3, EC2, Lambda, IAM, Logs, ...)
When to use this skill
- Imperative debugging alongside Terraform/CDK
- S3 sync, log tails, Lambda invoke, IAM policy simulation
- Confirming which account a pipeline is acting on
- One-off safe read operations during incidents
Operational directives
- Start with
aws sts get-caller-identityand confirm account/ARN. - Prefer IAM Identity Center (SSO) over permanent access keys for humans.
- Use
--dry-runwhere the API supports it (notably EC2). - Never log
AWS_SECRET_ACCESS_KEY, session tokens, or pre-signed URL query secrets in full. - Scope IAM policies to resources and conditions (
aws:RequestedRegion, source IP, MFA) when designing roles.
Identity and config
aws sts get-caller-identity
aws configure list
aws configure list-profiles
# SSO example:
aws sso login --profile prod-admin
export AWS_PROFILE=prod-admin
High-value command patterns
# S3
aws s3 ls s3://my-bucket/prefix/
aws s3 sync ./dist s3://my-bucket/app/ --delete --dryrun
# Logs
aws logs tail /aws/lambda/my-fn --follow --since 30m
# Lambda
aws lambda get-function --function-name my-fn
aws lambda invoke --function-name my-fn --payload '{}' out.json
# IAM sanity
aws iam get-role --role-name gha-deploy
Incident hygiene table
| Task | Safe first step | Dangerous if blind |
|---|---|---|
| Clear a bucket | ls + versioning check |
rb --force |
| Stop an instance | describe-instances |
terminate vs stop mixup |
| Rotate keys | create new + update consumers | deactivate last key early |
| Fix Lambda | check CloudWatch errors | raising memory without need |
Best practices
- Tag resources for cost and ownership (
Owner,Service,Env). - Prefer instance/task roles over embedding keys in compute.
- Use CloudTrail when investigating who changed what.
- Keep CLI version current; auth and SSO flows improve over time.
Limitations
- Service quotas, SCPs, and permission boundaries can deny valid CLI calls.
- Some older services have inconsistent pagination and dry-run support.
- This skill does not replace Well-Architected reviews for new architectures.
Related skills
@terraform- durable infrastructure changes@kubernetes- EKS workload debugging after node/IAM issues@docker- images pushed to ECR