# AWS CLI

> Use for AWS control-plane validation during authorized pentests. Trigger on credentialed cloud review, IAM boundary checks, inventory confirmation, storage exposure review, and verifying what an approved AWS principal can see or access.

- Skill: `timsonner/aws-cli` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/aws-cli`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/aws-cli/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/aws-cli

---


# AWS CLI

## Purpose

Use this skill for tightly scoped AWS control-plane validation when the engagement includes approved AWS credentials or roles.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need to confirm identity, account scope, or accessible services.
- Need to validate whether an approved principal can reach sensitive resources.
- Need a low-impact retest after cloud hardening changes.

## Avoid When

- AWS scope or credential authorization is unclear.
- Commands would mutate state without explicit approval.

## Inputs

- Approved profile or role
- Named account and region scope
- Read-only versus state-changing boundaries

## Procedure

1. Start by confirming identity and account context.
2. Keep service queries narrowly aligned to the current hypothesis.
3. Prefer read-only inspection over state-changing actions.
4. Record only the permissions or exposures that materially change risk.
5. Preserve the exact profile and region scope for retest.

## Command Syntax

Replace sample profiles, regions, and resource names with approved in-scope values.

```bash
# Verify effective identity and account
aws sts get-caller-identity --profile pentest

# List S3 buckets
aws s3 ls --profile pentest

# List contents of a bucket
aws s3 ls s3://contoso-prod-backup --profile pentest --recursive

# Download a file from S3
aws s3 cp s3://contoso-prod-backup/config.env ./config.env --profile pentest

# List IAM users
aws iam list-users --profile pentest

# Get attached policies for a user
aws iam list-attached-user-policies --user-name developer --profile pentest

# List EC2 instances
aws ec2 describe-instances --profile pentest --region us-east-1 --output table

# Get a Secrets Manager value
aws secretsmanager get-secret-value --secret-id prod/contoso/dbpass --profile pentest
```

## Evidence to Capture

- Effective identity and account scope of the approved principal
- Resource access that materially affects risk
- Exact profile, region, and service context used

## Safety Boundaries

- Default to read-only validation.
- Do not create, modify, or delete resources without explicit written approval.