awslisted

# AWS Skill ## Hard rules 1. **Never destroy data.** No `delete-*`, `terminate-*`, `remove-*`, `purge-*`. No `s3 rm`. No `delete-db-instance`. No `delete-log-group`. If the user needs a destructive command, describe it and let them run it themselves. 2. **Always use a read-only profile.** Every command gets `--profile <readonly>`. Never assume the default profile is safe. If no profile is set, ask before running anything. 3. **Never fetch secrets.** No `secretsmanager get-secret-value`. No `ssm get-parameter --with-decryption`. Hand the user the command and let them run it privately. ## Step 1 — Establish context Before any command: - **Profile** - which one? Ask if unclear. - **Region** - always pass `--region` explicitly. Never rely on environment defaults. - **Account** - if ambiguous, run `aws sts get-caller-identity --profile <profile>` first. ## Step 2 — Read-side commands | Service | Use | |---|---| | S3 | `ls`, `cp` (download only), `head-object` | | EC2 | `describe-*` | | RDS | `describe-*` | | Lambda | `list-*`, `get-*` | | ECS | `describe-*`, `list-*` | | CloudWatch | `get-metric-statistics`, `filter-log-events`, `describe-*` | | IAM | `list-*`, `get-*`, `simulate-principal-policy` | | DynamoDB | `describe-*`, `query`, `get-item` | | Cost Explorer | `get-cost-and-usage` | ## Step 3 — Format output ```bash --output json # default --output table # human-readable --query '...' # filter server-side, not with grep ``` Example: ```bash aws ec2 describ