A working guide for using AWS CLI version 2, the command-line tool for managing Amazon Web Services. It covers profiles and single sign-on, permissions, storage, servers, functions, and logs, with checks before account-changing actions.

It is for checking AWS resources, copying files to S3, inspecting logs, invoking Lambda functions, working with EC2 and IAM, and handling incidents alongside Terraform or CDK.

Cloud commands can affect the wrong account or region and can expose credentials if used carelessly. The guide promotes identity checks, limited permissions, safer previews, and secret handling.

aws-cli — Skill for Claude Code by alivirgo

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add alivirgo/Major-AI-Skills --skill aws-cli

Clone the repo

git clone --depth 1 https://github.com/alivirgo/Major-AI-Skills

Made for: Claude Code.

Or install major-ai-skills, the plugin that ships this one along with the rest of its 147 skills, 7 plugins.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/alivirgo/major-ai-skills/aws-cli/github.svg)](https://agentmods.dev/skills/alivirgo/major-ai-skills/aws-cli)

Your own site

<a href="https://agentmods.dev/skills/alivirgo/major-ai-skills/aws-cli"><img src="https://agentmods.dev/badge/skills/alivirgo/major-ai-skills/aws-cli/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/alivirgo/major-ai-skills/aws-cli"><img src="https://agentmods.dev/badge/skills/alivirgo/major-ai-skills/aws-cli.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 41 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 800 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00041	$0.00800
Opus 5	$0.00020	$0.00400
Sonnet 5	$0.00008	$0.00160
Haiku 4.5	$0.00004	$0.00080

Measured 5d ago against content hash f9a7f74108a7, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

aws-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/aws-cli/SKILL.md · 97 lines

How it starts

The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AWS CLI & Cloud APIs AI Skill Guide

Overview & Engine Architecture

The AWS CLI v2 calls AWS service APIs using a credential chain (environment, SSO/profile, instance role). Every mutating call is account- and region-scoped. Agents always print caller identity and region before deletes, prefer least-privilege IAM, and keep long-lived access keys out of git and chat.

User / CI
  -> aws CLI v2
      -> credential chain (SSO / env / role)
          -> service APIs (S3, EC2, Lambda, IAM, Logs, ...)

When to use this skill

Imperative debugging alongside Terraform/CDK
S3 sync, log tails, Lambda invoke, IAM policy simulation
Confirming which account a pipeline is acting on
One-off safe read operations during incidents

Operational directives

Start with aws sts get-caller-identity and confirm account/ARN.
Prefer IAM Identity Center (SSO) over permanent access keys for humans.
Use --dry-run where the API supports it (notably EC2).
Never log AWS_SECRET_ACCESS_KEY, session tokens, or pre-signed URL query secrets in full.
Scope IAM policies to resources and conditions (aws:RequestedRegion, source IP, MFA) when designing roles.

Identity and config

aws sts get-caller-identity
aws configure list
aws configure list-profiles
# SSO example:
aws sso login --profile prod-admin
export AWS_PROFILE=prod-admin

High-value command patterns

# S3
aws s3 ls s3://my-bucket/prefix/
aws s3 sync ./dist s3://my-bucket/app/ --delete --dryrun

# Logs
aws logs tail /aws/lambda/my-fn --follow --since 30m

# Lambda
aws lambda get-function --function-name my-fn
aws lambda invoke --function-name my-fn --payload '{}' out.json

# IAM sanity
aws iam get-role --role-name gha-deploy

Incident hygiene table

Task	Safe first step	Dangerous if blind
Clear a bucket	`ls` + versioning check	`rb --force`
Stop an instance	`describe-instances`	terminate vs stop mixup
Rotate keys	create new + update consumers	deactivate last key early
Fix Lambda	check CloudWatch errors	raising memory without need

Read the full file on GitHub · 97 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

5d ago First seen · 97 lines · 41 tokens per session scan A f9a7f74108a7

Subscribe to this mod's changes

aws-cli is a skill published in the GitHub repository alivirgo/Major-AI-Skills (1 stars, last pushed today), licensed MIT. It adds 41 tokens to every session and 800 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.

Cloud DevOps and cloud Security agent-skills agentic-skills ai-agent-skills ai-agents aws aws-cli claude cloudwatch iam lambda s3

cis-aws-foundations-2.21

Ensure AWS resource policies do not allow unrestricted access using "Principal": "".

CyberStrikeus/CyberStrike · 24 tokens

securing-aws-lambda-execution-roles

Securing AWS Lambda execution roles by implementing least-privilege IAM policies, applying permission boundaries, restricting resource-based policies, using IAM Access Analyzer to validate permissions, and enforcing role scoping through SCPs.

xalgorix/xalgorix · 53 tokens

aws-essentials

Use when standing up the core AWS surface a small product needs: hardening a fresh account, a private S3 bucket, encrypted RDS Postgres, ECS Fargate vs EC2, CloudFront + OAC, or scoping an IAM policy to least privilege. NOT the CI pipeline that ships the container (that is deployment), NOT app-code access-control…

ericrisco/rsc-harness · 89 tokens

aws-cli