AWS CLI

Run AWS CLI commands safely and efficiently. Default to read-only operations. Always confirm identity, region, and blast radius before mutating anything.

Always Do First

Before any AWS CLI command, establish identity, region, and profile.

Fast path — resolve context from local config, no network call. Region and a cached account ID both come from local files, so there's no need for an sts round-trip:

# env vars win (CI, direnv); else fall back to the active profile's ~/.aws/config
ACCT="${AWS_EXPECTED_ACCOUNT_ID:-$(aws configure get expected_account_id 2>/dev/null)}"
REGION="${AWS_REGION:-$(aws configure get region 2>/dev/null)}"
echo "context: ${ACCT:-?} / ${REGION:-?}  (profile ${AWS_PROFILE:-default})"

If both resolve, skip the upfront aws sts get-caller-identity round-trip — treat them as the known account and region. Any auth problem (missing creds, expired SSO) surfaces on the first real command, so the check buys nothing for read-only work. State the assumed context in your summary ("Using cached context 123456789012 / us-east-1").