AWS Infrastructure Skill (Read-Only)

Discover AWS resources using the native AWS CLI. Designed for multi-account environments with SSO.

NEVER RUN THESE COMMANDS

The following patterns are FORBIDDEN - never execute them:

Pattern	Reason
`aws * delete*`	Deletes resources
`aws * remove*`	Removes resources
`aws * terminate*`	Terminates instances
`aws * put*`	Writes/overwrites data
`aws * create*`	Creates resources
`aws * update*`	Updates resources
`aws * modify*`	Modifies resources
`aws * start-instances`	Starts EC2 instances
`aws * stop-instances`	Stops EC2 instances
`aws * reboot*`	Reboots instances
`aws s3 rm`	Deletes S3 objects
`aws s3 mv`	Moves S3 objects
`aws s3 cp` (to S3)	Writes to S3
`aws s3 sync` (to S3)	Syncs to S3
`aws iam attach*`	Attaches policies
`aws iam detach*`	Detaches policies
`aws iam add*`	Adds IAM resources
`aws iam delete*`	Deletes IAM resources
`aws iam put*`	Writes IAM policies

SAFE READ-ONLY COMMANDS

These patterns are safe to run:

Pattern	Use
`aws * describe*`	Describe resources
`aws * list*`	List resources
`aws * get*`	Get resource details
`aws s3 ls`	List S3 contents
`aws s3api head-*`	Get S3 object metadata
`aws s3api get-*`	Get S3 bucket/object info
`aws sts get-caller-identity`	Check current identity
`aws logs filter-log-events`	Query logs
`aws logs start-query`	CloudWatch Insights
`aws logs get-query-results`	Get Insights results

Multi-Account Usage

List Available Profiles

bash

grep '^\[profile' ~/.aws/config | sed 's/\[profile //' | sed 's/\]//'

Switch Accounts

Always use --profile to target a specific account:

bash

aws --profile reman-dev.RemanAdmin_775255424688 s3 ls
aws --profile ics-vision-prod.ICSAdmin_158134245097 ec2 describe-instances

Check Current Identity

bash

aws sts get-caller-identity
aws --profile <profile-name> sts get-caller-identity

Login if Session Expired

bash

aws sso login
# Or for specific profile:
aws sso login --profile <profile-name>

Common Query Patterns

EC2 Instances

bash

# List all instances with name and state
aws ec2 describe-instances \
  --query 'Reservations[].Instances[].[InstanceId,State.Name,Tags[?Key==`Name`].Value|[0]]' \
  --output table

# Running instances only
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query 'Reservations[].Instances[].[InstanceId,InstanceType,Tags[?Key==`Name`].Value|[0]]' \
  --output table

# Find by tag
aws ec2 describe-instances \
  --filters "Name=tag:Environment,Values=production" \
  --output table

S3 Buckets

bash

# List all buckets
aws s3 ls

# List bucket contents
aws s3 ls s3://bucket-name/ --recursive --summarize

# Get bucket location
aws s3api get-bucket-location --bucket bucket-name

# Check if bucket is public
aws s3api get-public-access-block --bucket bucket-name

# Get bucket policy
aws s3api get-bucket-policy --bucket bucket-name

Lambda Functions

bash

# List functions
aws lambda list-functions \
  --query 'Functions[].[FunctionName,Runtime,LastModified]' \
  --output table

# Get function details
aws lambda get-function --function-name my-function

# Get function configuration
aws lambda get-function-configuration --function-name my-function

IAM Roles & Policies

bash

# List roles
aws iam list-roles \
  --query 'Roles[].[RoleName,CreateDate]' \
  --output table

# Get role details
aws iam get-role --role-name my-role

# List attached policies for a role
aws iam list-attached-role-policies --role-name my-role

# Get inline policy
aws iam get-role-policy --role-name my-role --policy-name my-policy

# List users
aws iam list-users \
  --query 'Users[].[UserName,CreateDate]' \
  --output table

# List access keys for a user
aws iam list-access-keys --user-name my-user

Security Groups

bash

# List security groups
aws ec2 describe-security-groups \
  --query 'SecurityGroups[].[GroupId,GroupName,VpcId]' \
  --output table

# Find groups with 0.0.0.0/0 ingress (public access)
aws ec2 describe-security-groups \
  --filters "Name=ip-permission.cidr,Values=0.0.0.0/0" \
  --query 'SecurityGroups[].[GroupId,GroupName]' \
  --output table

# Get specific security group rules
aws ec2 describe-security-group-rules \
  --filters "Name=group-id,Values=sg-xxx"

VPC

bash

# List VPCs
aws ec2 describe-vpcs \
  --query 'Vpcs[].[VpcId,CidrBlock,Tags[?Key==`Name`].Value|[0]]' \
  --output table

# List subnets
aws ec2 describe-subnets \
  --query 'Subnets[].[SubnetId,VpcId,CidrBlock,AvailabilityZone]' \
  --output table

# List route tables
aws ec2 describe-route-tables \
  --query 'RouteTables[].[RouteTableId,VpcId]' \
  --output table

EKS

bash

# List clusters
aws eks list-clusters

# Describe cluster
aws eks describe-cluster --name my-cluster

# List nodegroups
aws eks list-nodegroups --cluster-name my-cluster

# Describe nodegroup
aws eks describe-nodegroup --cluster-name my-cluster --nodegroup-name my-ng

RDS

bash

# List databases
aws rds describe-db-instances \
  --query 'DBInstances[].[DBInstanceIdentifier,DBInstanceClass,Engine,DBInstanceStatus]' \
  --output table

# Get database details
aws rds describe-db-instances --db-instance-identifier my-db

CloudWatch Logs

bash

# List log groups
aws logs describe-log-groups \
  --query 'logGroups[].[logGroupName,storedBytes]' \
  --output table

# Query logs (last hour)
aws logs filter-log-events \
  --log-group-name /aws/lambda/my-function \
  --start-time $(( $(date +%s) - 3600 ))000 \
  --filter-pattern "ERROR"

# CloudWatch Insights query
aws logs start-query \
  --log-group-name /aws/lambda/my-function \
  --start-time $(( $(date +%s) - 3600 )) \
  --end-time $(date +%s) \
  --query-string 'fields @timestamp, @message | filter @message like /ERROR/'

Secrets Manager

bash

# List secrets (metadata only - does NOT reveal values)
aws secretsmanager list-secrets \
  --query 'SecretList[].[Name,LastChangedDate]' \
  --output table

# Describe secret (metadata only)
aws secretsmanager describe-secret --secret-id my-secret

# NOTE: get-secret-value is read-only but reveals secret values
# Only use when explicitly needed

ECS

bash

# List clusters
aws ecs list-clusters

# Describe cluster
aws ecs describe-clusters --clusters my-cluster

# List services in cluster
aws ecs list-services --cluster my-cluster

# List tasks in cluster
aws ecs list-tasks --cluster my-cluster

Load Balancers

bash

# List ALBs/NLBs
aws elbv2 describe-load-balancers \
  --query 'LoadBalancers[].[LoadBalancerName,Type,State.Code]' \
  --output table

# List target groups
aws elbv2 describe-target-groups \
  --query 'TargetGroups[].[TargetGroupName,Protocol,Port]' \
  --output table

Output Formats

bash

# Table (human readable)
aws ec2 describe-instances --output table

# JSON (for parsing with jq)
aws ec2 describe-instances --output json

# Text (simple, tab-separated)
aws ec2 describe-instances --output text

# YAML
aws ec2 describe-instances --output yaml

JQ Patterns for JSON Parsing

bash

# Extract specific fields
aws ec2 describe-instances --output json | \
  jq '.Reservations[].Instances[] | {id: .InstanceId, state: .State.Name}'

# Filter by condition
aws ec2 describe-instances --output json | \
  jq '.Reservations[].Instances[] | select(.State.Name == "running")'

# Count resources
aws s3api list-buckets --output json | jq '.Buckets | length'

# Get tag value
aws ec2 describe-instances --output json | \
  jq '.Reservations[].Instances[] | {id: .InstanceId, name: (.Tags // [] | map(select(.Key == "Name")) | .[0].Value // "unnamed")}'

# Filter and format
aws lambda list-functions --output json | \
  jq -r '.Functions[] | [.FunctionName, .Runtime, .MemorySize] | @tsv'

Region Handling

bash

# Query specific region
aws ec2 describe-instances --region us-west-2

# Query all regions (loop)
for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  echo "=== $region ==="
  aws ec2 describe-instances --region $region --query 'Reservations[].Instances[].InstanceId' --output text
done

Tips

•Always use --profile for multi-account work
•Use --query to filter results server-side (faster, less data transfer)
•Use --output table for human-readable output
•Use --output json | jq for scripting and complex filtering
•Use --region to target specific regions
•Run aws sso login if you get credential errors
•Combine --query with --output table for clean reports
•Use --no-paginate carefully - can return huge results