AWS CLI

Run AWS CLI commands safely and efficiently. Default to read-only operations. Always confirm identity, region, and blast radius before mutating anything.

Always Do First

Before any AWS CLI command, confirm three things:

1. Identity — aws sts get-caller-identity (account, principal)
2. Region — explicit --region <r> or AWS_REGION env. Do not rely on default profile region for cross-account work.
3. Profile — AWS_PROFILE=<name> if multiple. Show user which profile is active.

If aws sts get-caller-identity fails: stop. Do not retry blindly. Diagnose: missing creds, expired SSO session, wrong profile. See references/auth.md.

Output Filtering

The CLI returns large JSON. Always narrow output with --query (JMESPath) and --output.