AWS CLI & Cloud APIs AI Skill Guide (Claude)

Overview & Engine Architecture

The AWS CLI v2 is a thin client over AWS service APIs. Auth follows a credential chain (CLI flags → env → assume-role / web-identity → IAM Identity Center → shared credentials → EC2/ECS roles). Every mutating call is account- and region-scoped. Agents treat identity as a first-class gate: print caller identity before deletes, prefer SSO / OIDC / instance roles over long-lived access keys, and never invent or commit credentials.