AWS resource query
Translate resource inventory questions into read-only AWS CLI commands, confirm account and region context, format concise tables, and refuse create/modify/delete actions. This is the intent-to-command bridge for each service/query.
When to invoke
- "List my EC2 instances in us-east-1."
- "Show Lambda event source mappings and batch sizes."
- "Which S3 buckets exist in this account?"
- "Find RDS databases by tag."
- "Query AWS resources without changing anything."
Safety contract
STRICTLY READ ONLY. Use ONLY these AWS CLI command families:
| Allowed command family |
Examples |
| Describe |
aws <service> describe-* |
| List |
aws <service> list-* |
| Get |
aws <service> get-* |
| Identity |
aws sts get-caller-identity |
| Configuration |
aws configure get |
| Tags |
aws resourcegroupstaggingapi get-resources |
| Cost Explorer |
aws ce get-* |
| Support |
aws support describe-* |
NEVER run mutating commands, including create-*, run-*, start-*, stop-*, reboot-*, delete-*, terminate-*, put-*, update-*, modify-*, attach-*, detach-*, send-*, publish-*, invoke-*, or execute-*.
If the user's query implies a write action, respond exactly with this pattern:
This skill is read-only. I can show you the current state of [resource], but I cannot [create/modify/delete] it. Would you like to see what currently exists?
Procedure
- Parse intent: target service, resource type, filters, detail level, and region.
- Confirm account and default region:
aws sts get-caller-identity --query '{Account:Account,UserId:UserId}'aws configure get region
- Append
--region <region> to every command when the user specifies a region.
- Read
references/intent-command-mapping.md when translating service/resource intent to AWS CLI commands.
- Run only allowed read-only commands.
- Format list results with
--output table; use --output json only for explicitly requested deep detail.
- Use
--query to extract relevant fields and avoid dumping raw JSON.
- For large result sets over 20 items, show a count first and offer filters.
Common query patterns
| User intent |
Read-only command pattern |
| Confirm identity |
aws sts get-caller-identity --query '{Account:Account,UserId:UserId}' |
| Check default region |
aws configure get region |
| Lambda event source mappings |
aws lambda list-event-source-mappings --query 'EventSourceMappings[].[FunctionArn,EventSourceArn,State,BatchSize]' --output table |
| Tag-based inventory |
aws resourcegroupstaggingapi get-resources --query '<fields>' --output table |
| Cost data |
aws ce get-* --query '<fields>' --output table |
| Support metadata |
aws support describe-* --query '<fields>' --output table |
Services covered include EC2, S3, RDS, Lambda, ECS, EKS, Secrets Manager, IAM, VPC, networking, messaging, and more when the command remains read-only.
Progressive disclosure and bundled resources
references/intent-command-mapping.md: open this when mapping natural-language AWS resource questions to service-specific CLI commands.
Output formatting rules
| Rule |
Implementation |
| Table first |
Use --output table for list results. |
| JSON only on request |
Use --output json only for deep detail the user explicitly asks for. |
| Query fields |
Always include --query to select relevant fields. |
| Large results |
If more than 20 items are likely or returned, show count and offer filters. |
| Empty results |
Explain likely causes: wrong region, no resources, or insufficient permissions. |
| Drill-down |
Offer a next filter, such as state, type, tag, or resource ID. |
Troubleshooting
| Error |
Likely cause |
Response |
AccessDenied |
Caller lacks permission. |
"You don't have permission to list [resource]. Required: <service>:<Action>." |
NoCredentialProviders |
AWS credentials are missing. |
"Run aws configure or set AWS_PROFILE." |
| Empty result |
Region, filters, or account do not contain the resource. |
"No [resources] found in [region]. Check another region?" |
| Invalid identifier |
Name or ID does not match an existing resource. |
"Could not find '[name]'. Check the name or provide the resource ID." |
Output template
## AWS resource query result
**Status:** complete | read-only refusal | blocked
**Account:** `<account or not checked>`
**Region:** `<region or default>`
**Question:** <user intent>
| Resource | Key fields | Notes |
| --- | --- | --- |
| `<id/name>` | `<selected --query fields>` | <state, tags, or caveat> |
### Commands run
- `<aws read-only command with --query and --output table>`
### Next filter
- <state, type, tag, resource ID, or none>
Quality gate
1---2name: aws-resource-query-33description: Answer natural-language questions about AWS resources by running strictly read-only AWS CLI queries. Use when asking about EC2, S3, RDS, Lambda, ECS, EKS, Secrets Manager, IAM, VPC, networking, messaging, `aws lambda list-event-source-mappings --query 'EventSourceMappings[].[FunctionArn,EventSourceArn,State,BatchSize]' --output table`, or current-state inventory.4---56<!-- Generated from harness/github-copilot/plugins/aws-cloud-development/skills/aws-resource-query/SKILL.md by harness/claude-code/scripts/convert_from_copilot.py. Edit the source, not this file. -->78# AWS resource query910Translate resource inventory questions into read-only AWS CLI commands, confirm account and region context, format concise tables, and refuse create/modify/delete actions. This is the intent-to-command bridge for each `service/query`.1112## When to invoke1314- "List my EC2 instances in us-east-1."15- "Show Lambda event source mappings and batch sizes."16- "Which S3 buckets exist in this account?"17- "Find RDS databases by tag."18- "Query AWS resources without changing anything."1920## Safety contract2122STRICTLY READ ONLY. Use ONLY these AWS CLI command families:2324| Allowed command family | Examples |25| --- | --- |26| Describe | `aws <service> describe-*` |27| List | `aws <service> list-*` |28| Get | `aws <service> get-*` |29| Identity | `aws sts get-caller-identity` |30| Configuration | `aws configure get` |31| Tags | `aws resourcegroupstaggingapi get-resources` |32| Cost Explorer | `aws ce get-*` |33| Support | `aws support describe-*` |3435NEVER run mutating commands, including `create-*`, `run-*`, `start-*`, `stop-*`, `reboot-*`, `delete-*`, `terminate-*`, `put-*`, `update-*`, `modify-*`, `attach-*`, `detach-*`, `send-*`, `publish-*`, `invoke-*`, or `execute-*`.3637If the user's query implies a write action, respond exactly with this pattern:3839```markdown40This skill is read-only. I can show you the current state of [resource], but I cannot [create/modify/delete] it. Would you like to see what currently exists?41```4243## Procedure44451. Parse intent: target service, resource type, filters, detail level, and region.462. Confirm account and default region:47 - `aws sts get-caller-identity --query '{Account:Account,UserId:UserId}'`48 - `aws configure get region`493. Append `--region <region>` to every command when the user specifies a region.504. Read `references/intent-command-mapping.md` when translating service/resource intent to AWS CLI commands.515. Run only allowed read-only commands.526. Format list results with `--output table`; use `--output json` only for explicitly requested deep detail.537. Use `--query` to extract relevant fields and avoid dumping raw JSON.548. For large result sets over 20 items, show a count first and offer filters.5556## Common query patterns5758| User intent | Read-only command pattern |59| --- | --- |60| Confirm identity | `aws sts get-caller-identity --query '{Account:Account,UserId:UserId}'` |61| Check default region | `aws configure get region` |62| Lambda event source mappings | `aws lambda list-event-source-mappings --query 'EventSourceMappings[].[FunctionArn,EventSourceArn,State,BatchSize]' --output table` |63| Tag-based inventory | `aws resourcegroupstaggingapi get-resources --query '<fields>' --output table` |64| Cost data | `aws ce get-* --query '<fields>' --output table` |65| Support metadata | `aws support describe-* --query '<fields>' --output table` |6667Services covered include EC2, S3, RDS, Lambda, ECS, EKS, Secrets Manager, IAM, VPC, networking, messaging, and more when the command remains read-only.6869## Progressive disclosure and bundled resources7071- `references/intent-command-mapping.md`: open this when mapping natural-language AWS resource questions to service-specific CLI commands.7273## Output formatting rules7475| Rule | Implementation |76| --- | --- |77| Table first | Use `--output table` for list results. |78| JSON only on request | Use `--output json` only for deep detail the user explicitly asks for. |79| Query fields | Always include `--query` to select relevant fields. |80| Large results | If more than 20 items are likely or returned, show count and offer filters. |81| Empty results | Explain likely causes: wrong region, no resources, or insufficient permissions. |82| Drill-down | Offer a next filter, such as state, type, tag, or resource ID. |8384## Troubleshooting8586| Error | Likely cause | Response |87| --- | --- | --- |88| `AccessDenied` | Caller lacks permission. | "You don't have permission to list [resource]. Required: `<service>:<Action>`." |89| `NoCredentialProviders` | AWS credentials are missing. | "Run `aws configure` or set `AWS_PROFILE`." |90| Empty result | Region, filters, or account do not contain the resource. | "No [resources] found in [region]. Check another region?" |91| Invalid identifier | Name or ID does not match an existing resource. | "Could not find '[name]'. Check the name or provide the resource ID." |9293## Output template9495```markdown96## AWS resource query result9798**Status:** complete | read-only refusal | blocked99**Account:** `<account or not checked>`100**Region:** `<region or default>`101**Question:** <user intent>102103| Resource | Key fields | Notes |104| --- | --- | --- |105| `<id/name>` | `<selected --query fields>` | <state, tags, or caveat> |106107### Commands run108- `<aws read-only command with --query and --output table>`109110### Next filter111- <state, type, tag, resource ID, or none>112```113114## Quality gate115116- [ ] Every command is read-only and belongs to an allowed command family.117- [ ] Mutating verbs such as `create-*`, `delete-*`, `update-*`, `modify-*`, `invoke-*`, and `execute-*` were refused.118- [ ] Account and region were checked or the inability to check them was reported.119- [ ] User-specified regions were applied with `--region <region>`.120- [ ] List output uses `--output table` and a focused `--query`.121- [ ] Large, empty, or permission-denied results are explained with next-step filters or required permissions.
paulasilvatech