Email setup

Requires: aws CLI with a working profile, and kubectl with cluster context for the deployment checks. Credentials come from the Bitwarden helper. See the bws-secrets skill, and use it for anything involving a secret value. If a profile or cluster context is unavailable, say which check you couldn't run and fall back to the GitOps repo; don't guess at live state.

Use live AWS and repository state as the source of truth. Do not assume profile names, account ownership, regions, identities, quotas, SMTP users, or deployed workloads from an old report.

Scope

Discovery and diagnosis are the default, and they are read-only. Sending is an external side effect, so never use a test send as a health check.

Anything that changes state, including creating an IAM user, writing a secret, editing an ExternalSecret, rolling a deployment, or revoking a key, happens only when the user explicitly asked for that change. Diagnosing a delivery failure does not authorize fixing it; report the cause and what the fix would be, then wait. Keep rotation work separate from a read-only investigation rather than folding it in.

Discover the AWS CLI setup

List every configured profile, its configured region, and its authenticated AWS identity: