# AWS

> Use this skill whenever the user asks about AWS — querying resources, debugging infrastructure, reading logs, checking costs, IAM, S3, EC2, RDS, Lambda, ECS, CloudWatch, or any other AWS service. Covers CLI commands, SDK calls, and architectural questions.

- Skill: `sakydev/aws` (Agent Skill)
- Install (CLI): `npx skillmds@latest add sakydev/aws`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sakydev/aws/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: sakydev (https://skillmd.com/u/sakydev)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/sakydev/aws

---


# AWS Skill

## Hard rules

1. **Never destroy data.** No `delete-*`, `terminate-*`, `remove-*`, `purge-*`. No `s3 rm`. No `delete-db-instance`. No `delete-log-group`. If the user needs a destructive command, describe it and let them run it themselves.

2. **Always use a read-only profile.** Every command gets `--profile <readonly>`. Never assume the default profile is safe. If no profile is set, ask before running anything.

3. **Never fetch secrets.** No `secretsmanager get-secret-value`. No `ssm get-parameter --with-decryption`. Hand the user the command and let them run it privately.

## Step 1 — Establish context

Before any command:

- **Profile** - which one? Ask if unclear.
- **Region** - always pass `--region` explicitly. Never rely on environment defaults.
- **Account** - if ambiguous, run `aws sts get-caller-identity --profile <profile>` first.

## Step 2 — Read-side commands

| Service | Use |
|---|---|
| S3 | `ls`, `cp` (download only), `head-object` |
| EC2 | `describe-*` |
| RDS | `describe-*` |
| Lambda | `list-*`, `get-*` |
| ECS | `describe-*`, `list-*` |
| CloudWatch | `get-metric-statistics`, `filter-log-events`, `describe-*` |
| IAM | `list-*`, `get-*`, `simulate-principal-policy` |
| DynamoDB | `describe-*`, `query`, `get-item` |
| Cost Explorer | `get-cost-and-usage` |

## Step 3 — Format output

```bash
--output json    # default
--output table   # human-readable
--query '...'    # filter server-side, not with grep
```

Example:
```bash
aws ec2 describe-instances \
  --profile readonly \
  --region us-east-1 \
  --query 'Reservations[*].Instances[*].{ID:InstanceId,State:State.Name,Type:InstanceType}' \
  --output table
```

## Step 4 — Cost awareness

Flag before running anything expensive.

| Situation | Say |
|---|---|
| DynamoDB full scan | "Full scans consume read capacity on every item. Add `--filter-expression` or `--limit` first?" |
| High-volume CloudWatch log group | "Add `--start-time` and `--end-time` to limit data scanned." |
| Cross-region data transfer | "Moving data across regions costs money. Confirm the target region." |

## IAM rules

- Run `simulate-principal-policy` before suggesting any IAM change.
- No `*` wildcards in resource ARNs unless explicitly asked. Warn about blast radius.
- Never suggest `AdministratorAccess` or `PowerUserAccess`. Offer least-privilege alternatives.
- Show policies as JSON blocks so the user can review before applying.

## Concerns

| Situation | Say |
|---|---|
| User asks to delete something | Describe the command. Do not run it. Let them verify first. |
| No `--region` given | Ask, or use the project's known primary region. |
| Default profile would be used | "Which profile should I use? Not assuming the default." |
| Production resources targeted | "This targets production. Confirm before I proceed." |
| User asks to fetch a secret | "Not retrieving secret values. Run this yourself: `aws secretsmanager get-secret-value --secret-id <name>`" |
| Results are paginated | "Page 1 only. Use `--starting-token <NextToken>` to continue." |
| Cross-account operation | "This looks cross-account. Confirm the target account ID." |
| Borrowed or assumed credentials | "Temporary credentials expire. Check `aws sts get-caller-identity` if you hit auth errors." |

## Useful patterns

```bash
# Who am I?
aws sts get-caller-identity --profile readonly --output table

# Running EC2 instances
aws ec2 describe-instances \
  --profile readonly --region us-east-1 \
  --filters "Name=instance-state-name,Values=running" \
  --query 'Reservations[*].Instances[*].{ID:InstanceId,Type:InstanceType,IP:PrivateIpAddress}' \
  --output table

# Tail Lambda logs
aws logs tail "/aws/lambda/my-function" \
  --profile readonly --region us-east-1 \
  --follow --since 10m

# Check what a role can do
aws iam simulate-principal-policy \
  --profile readonly \
  --policy-source-arn arn:aws:iam::123456789012:role/MyRole \
  --action-names s3:GetObject ec2:DescribeInstances
```