chrishuffman5/aws-cli

AWS CLI Expert

This skill covers the AWS CLI v2 for managing AWS resources from the command line. It has deep coverage of:

• Authentication (profiles, SSO, assume-role, instance profiles, environment variables)
• Output formats (json, table, text, yaml) and JMESPath queries
• Pagination (auto, --max-items, --page-size) and waiters
• IAM (users, groups, roles, managed/inline policies, access keys, instance profiles)
• S3 (high-level aws s3 and low-level aws s3api, versioning, lifecycle, encryption)
• Lambda (create, deploy, invoke, layers, event source mappings, aliases, concurrency)
• RDS (instances, Aurora clusters, snapshots, parameter groups, subnet groups)
• CloudFormation (stacks, change sets, deploy, exports, drift detection)
• ECS (Fargate clusters, task definitions, services, exec command)
• EKS (clusters, managed node groups, Fargate profiles, add-ons, auth)
• CloudWatch (metrics, alarms, Logs, Insights, metric filters)
• SSM (Parameter Store, Run Command, Session Manager)
• Route 53 (hosted zones, UPSERT records, alias records)
• STS (assume-role, get-caller-identity)
• EC2 VPC networking (VPCs, subnets, security groups, NAT gateways, route tables)

How to Approach Tasks

When you receive a request:

1. Classify the request type:

   • Authentication/config -- Load references/core.md
   • Service-specific commands -- Load references/commands.md
   • Infrastructure scripting -- Load references/patterns.md
   • JMESPath/output -- Load references/core.md

2. Verify identity -- Remind user to check aws sts get-caller-identity before operations.

3. Use waiters -- Replace sleep loops with aws <service> wait <condition> commands.

4. Use --query for extraction -- Combine --query with --output text for scripting variables.

5. Provide complete commands -- Include all required parameters. Show region and profile flags when relevant.

Core Expertise

Authentication

aws configure                        # interactive setup
aws configure --profile prod         # named profile
export AWS_PROFILE=prod              # set default profile
aws sts get-caller-identity          # verify current identity

# SSO
aws configure sso
aws sso login --profile my-sso-profile

# Assume role
creds=$(aws sts assume-role --role-arn arn:aws:iam::123456789012:role/DeployRole \
  --role-session-name deploy --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' -o text)
export AWS_ACCESS_KEY_ID=$(echo "$creds" | awk '{print $1}')
export AWS_SECRET_ACCESS_KEY=$(echo "$creds" | awk '{print $2}')
export AWS_SESSION_TOKEN=$(echo "$creds" | awk '{print $3}')

Output and JMESPath

# Formats: json, table, text, yaml
aws iam list-users --output table

# JMESPath
aws ec2 describe-instances --query 'Reservations[].Instances[].{ID:InstanceId,Type:InstanceType,State:State.Name}' -o table
aws ec2 describe-instances --query 'Reservations[].Instances[?State.Name==`running`].InstanceId' -o text
aws lambda list-functions --query 'Functions[?Runtime==`python3.12`].{Name:FunctionName,Memory:MemorySize}' -o table

# Capture for scripting
ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' -o text)
VPC_ID=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 --query 'Vpc.VpcId' -o text)

Waiters

aws ec2 wait instance-running --instance-ids i-0123456789abcdef0
aws rds wait db-instance-available --db-instance-identifier my-db
aws cloudformation wait stack-create-complete --stack-name my-stack
aws ecs wait services-stable --cluster my-cluster --services my-svc
aws lambda wait function-active --function-name my-func

Key Services Quick Reference

# IAM
aws iam create-role --role-name my-role --assume-role-policy-document file://trust.json
aws iam attach-role-policy --role-name my-role --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

# S3
aws s3 sync ./dist s3://my-bucket/static/ --delete
aws s3 cp s3://my-bucket/file.txt ./file.txt
aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled

# Lambda
aws lambda create-function --function-name my-func --runtime python3.12 --handler index.handler \
  --role arn:aws:iam::123456789012:role/lambda-role --zip-file fileb://function.zip

# CloudFormation
aws cloudformation deploy --stack-name my-stack --template-file template.yaml \
  --parameter-overrides Env=prod --capabilities CAPABILITY_NAMED_IAM --no-fail-on-empty-changeset

Common Pitfalls

1. Not using --output text for scripting JSON output adds quotes and formatting. Use --output text with --query for clean variable capture.

2. Ignoring pagination CLI v2 auto-paginates by default, but --max-items limits total results. Use --no-paginate only when you want one page.

3. Using sleep instead of waiters aws <service> wait commands poll the API correctly. Sleep loops are fragile and wasteful.

4. Not using --cli-binary-format raw-in-base64-out for Lambda Lambda invoke --payload expects base64 by default in CLI v2. Add this flag for raw JSON.

5. Forgetting --region when working cross-region Region defaults to profile config. Always pass --region when operating on resources in non-default regions.

6. Hardcoding account IDs Use aws sts get-caller-identity --query Account --output text to dynamically get the account ID.

7. Not versioning S3 buckets Enable versioning before storing important data. Without it, overwrites and deletes are permanent.

8. Missing --capabilities CAPABILITY_NAMED_IAM on CloudFormation Stacks that create IAM resources require this capability flag.

9. Not blocking public S3 access Always add put-public-access-block after bucket creation.

10. Storing secrets in plain SSM parameters Use --type SecureString for passwords and API keys in SSM Parameter Store.

Reference Files

• references/core.md -- Auth, output formats, JMESPath patterns, pagination, waiters. Read for CLI configuration and query questions.
• references/commands.md -- Complete command reference by service: IAM, S3, Lambda, RDS, CloudFormation, ECS, EKS, CloudWatch, SSM, Route 53, STS, VPC. Read for specific service commands.
• references/patterns.md -- Scripting patterns: idempotent create, batch operations, infrastructure provisioning. Read for automation scripts.

Scripts

• scripts/01-aws-provision.sh -- Complete VPC/subnet/security group/EC2 provisioning