cloudthinker-ai Chamber Management Skill
Manage and analyze secrets stored in AWS SSM Parameter Store using Chamber.
Tool Conventions
Prerequisites
chamber CLI must be installed and AWS credentials must be configured with appropriate SSM permissions.
Core Commands
chamber list <service>-- list secret keys for a servicechamber read <service> <key>-- read a specific secretchamber write <service> <key> <value>-- write a secretchamber export <service>-- export all secrets as JSON
Output Rules
- TOKEN EFFICIENCY: Extract only needed fields
- Target <=50 lines per script output
- NEVER output secret values -- only output key names and metadata
- Never dump full secret exports
Discovery Phase
List Services and Keys
#!/bin/bash
echo "=== Services (SSM Parameter Prefixes) ==="
aws ssm get-parameters-by-path --path "/" --recursive --query "Parameters[].Name" --output text \
| tr '\t' '\n' | sed 's|^/||' | cut -d'/' -f1 | sort -u | head -25
echo ""
SERVICE="${1:?Service name required}"
echo "=== Secret Keys for ${SERVICE} ==="
chamber list "${SERVICE}" 2>/dev/null | head -25
List Parameters with Metadata
#!/bin/bash
SERVICE="${1:?Service name required}"
echo "=== Parameters for ${SERVICE} ==="
chamber list -e "${SERVICE}" 2>/dev/null \
| awk 'NR>1 {print $1"\t"$2"\t"$3}' | column -t | head -25
echo ""
echo "=== Parameter Count ==="
count=$(chamber list "${SERVICE}" 2>/dev/null | wc -l)
echo "${SERVICE}: $((count - 1)) parameters"
Analysis Phase
Compare Services
#!/bin/bash
SERVICE1="${1:?First service required}"
SERVICE2="${2:?Second service required}"
echo "=== Key Comparison ==="
KEYS1=$(chamber list "${SERVICE1}" 2>/dev/null | awk 'NR>1 {print $1}' | sort)
KEYS2=$(chamber list "${SERVICE2}" 2>/dev/null | awk 'NR>1 {print $1}' | sort)
echo "Keys in ${SERVICE1} only:"
comm -23 <(echo "$KEYS1") <(echo "$KEYS2") | head -10
echo ""
echo "Keys in ${SERVICE2} only:"
comm -13 <(echo "$KEYS1") <(echo "$KEYS2") | head -10
echo ""
echo "Common keys: $(comm -12 <(echo "$KEYS1") <(echo "$KEYS2") | wc -l)"
Parameter History
#!/bin/bash
SERVICE="${1:?Service name required}"
KEY="${2:?Key name required}"
echo "=== Parameter Version History ==="
aws ssm get-parameter-history \
--name "/${SERVICE}/${KEY}" \
--query "Parameters[].{Version:Version,LastModified:LastModifiedDate,ModifiedBy:LastModifiedUser}" \
--output table 2>/dev/null | head -20
echo ""
echo "=== Recent SSM Activity ==="
aws ssm describe-parameters \
--parameter-filters "Key=Path,Option=Recursive,Values=/${SERVICE}" \
--query "Parameters[].{Name:Name,Type:Type,Version:Version,Modified:LastModifiedDate}" \
--output table 2>/dev/null | head -20
Output Format
- Use tab-separated columns with
column -t - Limit lists to 15-25 items
- NEVER display secret values -- only key names and metadata
- Show summaries before details
Anti-Hallucination Rules
- NEVER assume resource names — always discover via CLI/API in Phase 1 before referencing in Phase 2.
- NEVER fabricate metric names or dimensions — verify against the service documentation or
--helpoutput. - NEVER mix CLI commands between service versions — confirm which version/API you are targeting.
- ALWAYS use the discovery → verify → analyze chain — every resource referenced must have been discovered first.
- ALWAYS handle empty results gracefully — an empty response is valid data, not an error to retry.
Counter-Rationalizations
| Shortcut | Counter | Why |
|---|---|---|
| "I'll skip discovery and check known resources" | Always run Phase 1 discovery first | Resource names change, new resources appear — assumed names cause errors |
| "The user only asked for a quick check" | Follow the full discovery → analysis flow | Quick checks miss critical issues; structured analysis catches silent failures |
| "Default configuration is probably fine" | Audit configuration explicitly | Defaults often leave logging, security, and optimization features disabled |
| "Metrics aren't needed for this" | Always check relevant metrics when available | API/CLI responses show current state; metrics reveal trends and intermittent issues |
| "I don't have access to that" | Try the command and report the actual error | Assumed permission failures prevent useful investigation; actual errors are informative |
Common Pitfalls
- Never expose values: Only display parameter names and metadata, never values
- Service = path prefix: Chamber uses
/service/keypaths in SSM Parameter Store - IAM permissions: Requires
ssm:GetParametersByPath,ssm:PutParameter,ssm:GetParameterpermissions - KMS encryption: SecureString parameters require KMS decrypt permissions
- Case sensitivity: Chamber lowercases all key names
- Rate limits: AWS SSM has API rate limits -- avoid rapid bulk operations