How do I install the Hf Cloud AWS Context Discovery skill?

Run npx skillmds add waybarrios/hf-cloud-aws-context-discovery in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Hf Cloud AWS Context Discovery safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Hf Cloud AWS Context Discovery?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Hf Cloud AWS Context Discovery free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Hf Cloud AWS Context Discovery?

waybarrios (@waybarrios) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Hf Cloud AWS Context Discovery by waybarrios

Name: Hf Cloud AWS Context Discovery
Rating: 4.5 (4 reviews)
Author: waybarrios

Hf Cloud AWS Context Discovery

Discover the active AWS profile, region, account, and caller identity before SageMaker or AWS work. Use when local AWS context is needed or unspecified; do not use for cloud-agnostic model planning.

waybarrios f0b5529 3.6 KB Updated Sep 9, 2026

File contents

AWS Context Discovery

Before doing any AWS work, read the user's local AWS config. Don't guess the region, and don't ask the user for things their config already answers.

What to discover

Run these at the start of the AWS work and remember the results for the rest of the session.

1. Active profile

AWS_PROFILE env var, else default. If the user mentioned a profile in their prompt, that overrides. If the named profile doesn't exist in ~/.aws/config, surface that clearly.

2. Region

Resolution order — stop at the first one that produces a value:

Region the user explicitly named in this conversation
AWS_REGION env var
AWS_DEFAULT_REGION env var
region field on the active profile in ~/.aws/config
Ask the user — but only after the first four have failed

Do not fall back to us-east-1 or any other hardcoded default.

3. Credentials, account ID, caller ARN

aws sts get-caller-identity --profile <profile> --region <region>

Three purposes in one call: confirms credentials are valid (stop if not), returns the Account ID (needed for ARN construction), returns the Arn of the caller.

4. Identify SSO / assumed-role principals

The Arn field tells you what kind of principal this is. The pattern matters because it determines what IAM operations the caller can do.

ARN pattern	Type	IAM write capability
`arn:aws:iam::<acct>:user/<name>`	IAM user	Depends on attached policies
`arn:aws:sts::<acct>:assumed-role/AWSReservedSSO_<...>/<email>`	SSO assumed-role	Typically none — can't create/modify IAM roles
`arn:aws:sts::<acct>:assumed-role/<role>/<session>`	Regular assumed-role	Depends on the role

If the caller is SSO, surface this immediately before later skills hit iam:CreateRole and fail:

Heads up: you're authenticated via SSO (AWSReservedSSO_<PermissionSet>_...). SSO principals usually can't create IAM roles directly. If we need a SageMaker execution role, I'll look for an existing one first — if none exists, you'll need to ask whoever manages your AWS access to create one.

This is the highest-leverage thing this skill does. Surfacing it now turns a confusing mid-deployment error into a five-second conversation.

Commands to run

# Effective profile and region (faster than parsing config files)
aws configure list

# Validate credentials and get identity
aws sts get-caller-identity
aws sts get-caller-identity --profile <profile-name>  # if a profile was named

aws configure list handles env-var overrides and shows the resolved effective values. Prefer it over parsing ~/.aws/config yourself. If you need to read raw config (e.g. to list profiles), ~/.aws/config and ~/.aws/credentials are plain INI files — read-only.

What to report back

One or two lines, not a wall of text:

Working with profile my-profile in eu-west-1, account 123456789012. You're authenticated via SSO, so we'll need to use an existing IAM role rather than create one.

Don't ask the user to confirm the region you just read from their config — they configured it; that is the confirmation.

If something is wrong (credentials expired, profile doesn't exist, no region anywhere), stop and surface the specific error before continuing.

---name: hf-cloud-aws-context-discoverydescription: Discover the active AWS profile, region, account, and caller identity before SageMaker or AWS work. Use when local AWS context is needed or unspecified; do not use for cloud-agnostic model planning.license: Apache-2.0 (modified; see UPSTREAMS.json)--- # AWS Context Discovery Before doing any AWS work, read the user's local AWS config. Don't guess the region, and don't ask the user for things their config already answers. ## What to discover Run these at the start of the AWS work and remember the results for the rest of the session. ### 1. Active profile `AWS_PROFILE` env var, else `default`. If the user mentioned a profile in their prompt, that overrides. If the named profile doesn't exist in `~/.aws/config`, surface that clearly. ### 2. Region Resolution order — stop at the first one that produces a value: 1. Region the user explicitly named in this conversation 2. `AWS_REGION` env var 3. `AWS_DEFAULT_REGION` env var 4. `region` field on the active profile in `~/.aws/config` 5. Ask the user — but only after the first four have failed Do not fall back to `us-east-1` or any other hardcoded default. ### 3. Credentials, account ID, caller ARN ```bash aws sts get-caller-identity --profile <profile> --region <region> ``` Three purposes in one call: confirms credentials are valid (stop if not), returns the `Account` ID (needed for ARN construction), returns the `Arn` of the caller. ### 4. Identify SSO / assumed-role principals The `Arn` field tells you what kind of principal this is. The pattern matters because it determines what IAM operations the caller can do. | ARN pattern | Type | IAM write capability | |---|---|---| | `arn:aws:iam::<acct>:user/<name>` | IAM user | Depends on attached policies | | `arn:aws:sts::<acct>:assumed-role/AWSReservedSSO_<...>/<email>` | **SSO assumed-role** | Typically **none** — can't create/modify IAM roles | | `arn:aws:sts::<acct>:assumed-role/<role>/<session>` | Regular assumed-role | Depends on the role | **If the caller is SSO**, surface this immediately before later skills hit `iam:CreateRole` and fail: > Heads up: you're authenticated via SSO (`AWSReservedSSO_<PermissionSet>_...`). SSO principals usually can't create IAM roles directly. If we need a SageMaker execution role, I'll look for an existing one first — if none exists, you'll need to ask whoever manages your AWS access to create one. This is the highest-leverage thing this skill does. Surfacing it now turns a confusing mid-deployment error into a five-second conversation. ## Commands to run ```bash # Effective profile and region (faster than parsing config files) aws configure list # Validate credentials and get identity aws sts get-caller-identity aws sts get-caller-identity --profile <profile-name> # if a profile was named ``` `aws configure list` handles env-var overrides and shows the resolved effective values. Prefer it over parsing `~/.aws/config` yourself. If you need to read raw config (e.g. to list profiles), `~/.aws/config` and `~/.aws/credentials` are plain INI files — read-only. ## What to report back One or two lines, not a wall of text: > Working with profile `my-profile` in `eu-west-1`, account `123456789012`. You're authenticated via SSO, so we'll need to use an existing IAM role rather than create one. Don't ask the user to confirm the region you just read from their config — they configured it; that is the confirmation. If something is wrong (credentials expired, profile doesn't exist, no region anywhere), stop and surface the specific error before continuing.

Frequently asked questions