# Aws

> Operate AWS accounts, resources, and SSO profiles with aws and aws-sso-util.

- **Type:** Skill
- **Install:** `agentstack add skill-fmind-dot-aws`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [fmind](https://agentstack.voostack.com/s/fmind)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [fmind](https://github.com/fmind)
- **Source:** https://github.com/fmind/dot/tree/main/skills/aws
- **Website:** https://fmind.dev

## Install

```sh
agentstack add skill-fmind-dot-aws
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Amazon Web Services CLI

Use `aws` and `aws-sso-util` for AWS account, IAM, S3, ECS, and CloudWatch operations. [infra-as-code](../infra-as-code/SKILL.md) owns provisioned infrastructure, and [incident-response](../incident-response/SKILL.md) owns a live outage.

## Workflow

1. **Resolve identity and profile context**: inspect the active AWS profile, SSO session, and caller identity; never assume role or run commands under ambiguous profiles.

   ```bash
   aws sts get-caller-identity --profile  --output json
   aws configure list-profiles
   ```

1. **Authenticate via SSO**: when credentials expire, refresh the session using AWS IAM Identity Center (SSO); avoid long-lived access keys.

   ```bash
   aws sso login --profile 
   # Or using aws-sso-util:
   aws-sso-util login --profile 
   ```

1. **Pin every consequential call**: pass `--profile ` and `--region ` explicitly so environment variables or shell defaults cannot redirect operations to the wrong account or region.
1. **Start read-only with bounded queries**: use `--query` (JMESPath) and `--max-items` to constrain results; describe resources, IAM policies, and CloudWatch metrics before changing anything.

   ```bash
   aws s3 ls --profile 
   aws ecs list-clusters --profile  --region  --max-items 20 --output json
   ```

1. **Plan mutations and confirm**: state the target ARN, expected before and after states, and rollback steps; resource creation, security group changes, policy updates, and deletions require user authorization; reuse existing authority rather than asking again.
1. **Apply and verify**: execute the mutation, then re-read the resource status to confirm the state change.

## Gotchas

- **Expired SSO tokens**: SSO tokens expire after their configured duration; refresh via `aws sso login` rather than falling back to static API keys.
- **`--query` client-side evaluation**: JMESPath queries in `--query` run client-side after downloading the page; for large resources, pair with `--max-items`; `--page-size` only changes each request size to prevent timeout.
- **Failures are findings**: report authorization (`AccessDeniedException`) or missing role errors directly; do not attempt permission escalation or modify IAM policies without authorization.

## Documentation

- [AWS CLI User Guide](https://docs.aws.amazon.com/cli/latest/userguide/) · [AWS CLI Command Reference](https://awscli.amazonaws.com/v2/documentation/api/latest/index.html)
- Releases: [AWS CLI GitHub Releases](https://github.com/aws/aws-cli/releases)
- Companion skills: [infra-as-code](../infra-as-code/SKILL.md) (provisioning), [security-review](../security-review/SKILL.md) (IAM audits), [incident-response](../incident-response/SKILL.md) (outages).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [fmind](https://github.com/fmind)
- **Source:** [fmind/dot](https://github.com/fmind/dot)
- **License:** MIT
- **Homepage:** https://fmind.dev

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-fmind-dot-aws
- Seller: https://agentstack.voostack.com/s/fmind
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.