AWS Infra

Overview

Use the local AWS CLI to answer questions about AWS resources. Default to read‑only queries. Only propose or run write/destructive actions after explicit user confirmation.

Quick Start

Determine profile/region from environment or ~/.aws/config.

Start with identity:

- aws sts get-caller-identity

Use read‑only service commands to answer the question.

If the user asks for changes, outline the exact command and ask for confirmation before running.

Safety Rules (must follow)

• Treat all actions as read‑only unless the user explicitly requests a change and confirms it.
• For any potentially destructive change (delete/terminate/destroy/modify/scale/billing/IAM credentials), require a confirmation step.
• Prefer --dry-run when available and show the plan before execution.
• Never reveal or log secrets (access keys, session tokens).

Task Guide (common requests)

• Inventory / list: use list/describe/get commands.
• Health / errors: use CloudWatch metrics/logs queries.
• Security checks: IAM, S3 public access, SG exposure, KMS key usage.
• Costs: Cost Explorer / billing queries (read‑only).
• Changes: show exact CLI command and require confirmation.

Region & Profile Handling

• If the user specifies a region/profile, honor it.
• Otherwise use AWS_PROFILE / AWS_REGION if set, then fall back to ~/.aws/config.
• When results are region‑scoped, state the region used.

References

See references/aws-cli-queries.md for common command patterns.

Assets

• assets/icon.svg — custom icon (dark cloud + terminal prompt)