AWS resource query
Translate resource inventory questions into read-only AWS CLI commands, confirm account and region context, format concise tables, and refuse create/modify/delete actions. This is the intent-to-command bridge for each service/query.
When to invoke
- "List my EC2 instances in us-east-1."
- "Show Lambda event source mappings and batch sizes."
- "Which S3 buckets exist in this account?"
- "Find RDS databases by tag."
- "Query AWS resources without changing anything."
Safety contract
STRICTLY READ ONLY. Use ONLY these AWS CLI command families:
| Allowed command family |
Examples |
| Describe |
aws <service> describe-* |
| List |
aws <service> list-* |
| Get |
aws <service> get-* |
| Identity |
aws sts get-caller-identity |
| Configuration |
aws configure get |
| Tags |
aws resourcegroupstaggingapi get-resources |
| Cost Explorer |
aws ce get-* |
| Support |
aws support describe-* |
NEVER run mutating commands, including create-*, run-*, start-*, stop-*, reboot-*, delete-*, terminate-*, put-*, update-*, modify-*, attach-*, detach-*, send-*, publish-*, invoke-*, or execute-*.
If the user's query implies a write action, respond exactly with this pattern:
This skill is read-only. I can show you the current state of [resource], but I cannot [create/modify/delete] it. Would you like to see what currently exists?
Procedure
- Parse intent: target service, resource type, filters, detail level, and region.
- Confirm account and default region:
aws sts get-caller-identity --query '{Account:Account,UserId:UserId}'aws configure get region
- Append
--region <region> to every command when the user specifies a region.
- Read
references/intent-command-mapping.md when translating service/resource intent to AWS CLI commands.
- Run only allowed read-only commands.
- Format list results with
--output table; use --output json only for explicitly requested deep detail.
- Use
--query to extract relevant fields and avoid dumping raw JSON.
- For large result sets over 20 items, show a count first and offer filters.
Common query patterns
| User intent |
Read-only command pattern |
| Confirm identity |
aws sts get-caller-identity --query '{Account:Account,UserId:UserId}' |
| Check default region |
aws configure get region |
| Lambda event source mappings |
aws lambda list-event-source-mappings --query 'EventSourceMappings[].[FunctionArn,EventSourceArn,State,BatchSize]' --output table |
| Tag-based inventory |
aws resourcegroupstaggingapi get-resources --query '<fields>' --output table |
| Cost data |
aws ce get-* --query '<fields>' --output table |
| Support metadata |
aws support describe-* --query '<fields>' --output table |
Services covered include EC2, S3, RDS, Lambda, ECS, EKS, Secrets Manager, IAM, VPC, networking, messaging, and more when the command remains read-only.
Progressive disclosure and bundled resources
references/intent-command-mapping.md: open this when mapping natural-language AWS resource questions to service-specific CLI commands.
Output formatting rules
| Rule |
Implementation |
| Table first |
Use --output table for list results. |
| JSON only on request |
Use --output json only for deep detail the user explicitly asks for. |
| Query fields |
Always include --query to select relevant fields. |
| Large results |
If more than 20 items are likely or returned, show count and offer filters. |
| Empty results |
Explain likely causes: wrong region, no resources, or insufficient permissions. |
| Drill-down |
Offer a next filter, such as state, type, tag, or resource ID. |
Troubleshooting
| Error |
Likely cause |
Response |
AccessDenied |
Caller lacks permission. |
"You don't have permission to list [resource]. Required: <service>:<Action>." |
NoCredentialProviders |
AWS credentials are missing. |
"Run aws configure or set AWS_PROFILE." |
| Empty result |
Region, filters, or account do not contain the resource. |
"No [resources] found in [region]. Check another region?" |
| Invalid identifier |
Name or ID does not match an existing resource. |
"Could not find '[name]'. Check the name or provide the resource ID." |
Output template
## AWS resource query result
**Status:** complete | read-only refusal | blocked
**Account:** `<account or not checked>`
**Region:** `<region or default>`
**Question:** <user intent>
| Resource | Key fields | Notes |
| --- | --- | --- |
| `<id/name>` | `<selected --query fields>` | <state, tags, or caveat> |
### Commands run
- `<aws read-only command with --query and --output table>`
### Next filter
- <state, type, tag, resource ID, or none>
Quality gate
1---2name: aws-resource-query-23description: Answer natural-language questions about AWS resources by running strictly read-only AWS CLI queries. Use when asking about EC2, S3, RDS, Lambda, ECS, EKS, Secrets Manager, IAM, VPC, networking, messaging, `aws lambda list-event-source-mappings --query 'EventSourceMappings[].[FunctionArn,EventSourceArn,State,BatchSize]' --output table`, or current-state inventory.4---56# AWS resource query78Translate resource inventory questions into read-only AWS CLI commands, confirm account and region context, format concise tables, and refuse create/modify/delete actions. This is the intent-to-command bridge for each `service/query`.910## When to invoke1112- "List my EC2 instances in us-east-1."13- "Show Lambda event source mappings and batch sizes."14- "Which S3 buckets exist in this account?"15- "Find RDS databases by tag."16- "Query AWS resources without changing anything."1718## Safety contract1920STRICTLY READ ONLY. Use ONLY these AWS CLI command families:2122| Allowed command family | Examples |23| --- | --- |24| Describe | `aws <service> describe-*` |25| List | `aws <service> list-*` |26| Get | `aws <service> get-*` |27| Identity | `aws sts get-caller-identity` |28| Configuration | `aws configure get` |29| Tags | `aws resourcegroupstaggingapi get-resources` |30| Cost Explorer | `aws ce get-*` |31| Support | `aws support describe-*` |3233NEVER run mutating commands, including `create-*`, `run-*`, `start-*`, `stop-*`, `reboot-*`, `delete-*`, `terminate-*`, `put-*`, `update-*`, `modify-*`, `attach-*`, `detach-*`, `send-*`, `publish-*`, `invoke-*`, or `execute-*`.3435If the user's query implies a write action, respond exactly with this pattern:3637```markdown38This skill is read-only. I can show you the current state of [resource], but I cannot [create/modify/delete] it. Would you like to see what currently exists?39```4041## Procedure42431. Parse intent: target service, resource type, filters, detail level, and region.442. Confirm account and default region:45 - `aws sts get-caller-identity --query '{Account:Account,UserId:UserId}'`46 - `aws configure get region`473. Append `--region <region>` to every command when the user specifies a region.484. Read `references/intent-command-mapping.md` when translating service/resource intent to AWS CLI commands.495. Run only allowed read-only commands.506. Format list results with `--output table`; use `--output json` only for explicitly requested deep detail.517. Use `--query` to extract relevant fields and avoid dumping raw JSON.528. For large result sets over 20 items, show a count first and offer filters.5354## Common query patterns5556| User intent | Read-only command pattern |57| --- | --- |58| Confirm identity | `aws sts get-caller-identity --query '{Account:Account,UserId:UserId}'` |59| Check default region | `aws configure get region` |60| Lambda event source mappings | `aws lambda list-event-source-mappings --query 'EventSourceMappings[].[FunctionArn,EventSourceArn,State,BatchSize]' --output table` |61| Tag-based inventory | `aws resourcegroupstaggingapi get-resources --query '<fields>' --output table` |62| Cost data | `aws ce get-* --query '<fields>' --output table` |63| Support metadata | `aws support describe-* --query '<fields>' --output table` |6465Services covered include EC2, S3, RDS, Lambda, ECS, EKS, Secrets Manager, IAM, VPC, networking, messaging, and more when the command remains read-only.6667## Progressive disclosure and bundled resources6869- `references/intent-command-mapping.md`: open this when mapping natural-language AWS resource questions to service-specific CLI commands.7071## Output formatting rules7273| Rule | Implementation |74| --- | --- |75| Table first | Use `--output table` for list results. |76| JSON only on request | Use `--output json` only for deep detail the user explicitly asks for. |77| Query fields | Always include `--query` to select relevant fields. |78| Large results | If more than 20 items are likely or returned, show count and offer filters. |79| Empty results | Explain likely causes: wrong region, no resources, or insufficient permissions. |80| Drill-down | Offer a next filter, such as state, type, tag, or resource ID. |8182## Troubleshooting8384| Error | Likely cause | Response |85| --- | --- | --- |86| `AccessDenied` | Caller lacks permission. | "You don't have permission to list [resource]. Required: `<service>:<Action>`." |87| `NoCredentialProviders` | AWS credentials are missing. | "Run `aws configure` or set `AWS_PROFILE`." |88| Empty result | Region, filters, or account do not contain the resource. | "No [resources] found in [region]. Check another region?" |89| Invalid identifier | Name or ID does not match an existing resource. | "Could not find '[name]'. Check the name or provide the resource ID." |9091## Output template9293```markdown94## AWS resource query result9596**Status:** complete | read-only refusal | blocked97**Account:** `<account or not checked>`98**Region:** `<region or default>`99**Question:** <user intent>100101| Resource | Key fields | Notes |102| --- | --- | --- |103| `<id/name>` | `<selected --query fields>` | <state, tags, or caveat> |104105### Commands run106- `<aws read-only command with --query and --output table>`107108### Next filter109- <state, type, tag, resource ID, or none>110```111112## Quality gate113114- [ ] Every command is read-only and belongs to an allowed command family.115- [ ] Mutating verbs such as `create-*`, `delete-*`, `update-*`, `modify-*`, `invoke-*`, and `execute-*` were refused.116- [ ] Account and region were checked or the inability to check them was reported.117- [ ] User-specified regions were applied with `--region <region>`.118- [ ] List output uses `--output table` and a focused `--query`.119- [ ] Large, empty, or permission-denied results are explained with next-step filters or required permissions.
paulasilvatech