[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AD7KXC2KQEFDMKVJDPFAFZ":3,"skill-same:01M6AD7KXC2KQEFDMKVJDPFAFZ":87},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":50,"ownerHtmlUrl":51,"ownerBlogUrl":52,"ownerDescription":53,"updatedAt":54,"install":55,"resources":68},"01M6AD7KXC2KQEFDMKVJDPFAFZ","aws-resource-query",null,"Query AWS resources using natural language. Covers EC2, S3, RDS, Lambda, ECS, EKS, Secrets Manager, IAM, VPC, networking, messaging, and more. Strictly read-only — no writes, deletes, or mutations.","github\u002Fawesome-copilot","github","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","01M6AC83DS133TPXFSP1DHNCC6","GitHub","01M6AD3PBDYPK7NVFJNJ66Y8RS",41046,"MIT","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Faws-resource-query\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"aws resource query","aws","query","resource query","read","manager","secrets manager","rds","read-only","ecs","resources","natural language","only","networking","secrets","vpc","lambda","eks","iam","s3","messaging","2026-11-10 10:12:30",false,"---\nname: aws-resource-query\ndescription: 'Query AWS resources using natural language. Covers EC2, S3, RDS, Lambda, ECS, EKS, Secrets Manager, IAM, VPC, networking, messaging, and more. Strictly read-only — no writes, deletes, or mutations.'\n---\n\n# AWS Resource Query\n\nAnswer natural language questions about AWS resources by translating intent into read-only AWS CLI commands. This skill **never** runs commands that create, modify, or delete resources.\n\n## Safety Contract\n\n**STRICTLY READ-ONLY.** This skill exclusively uses:\n- `aws \u003Cservice> describe-*`\n- `aws \u003Cservice> list-*`\n- `aws \u003Cservice> get-*`\n- `aws sts get-caller-identity`\n- `aws configure get`\n- `aws resourcegroupstaggingapi get-resources`\n- `aws ce get-*`\n- `aws support describe-*`\n\n**NEVER** run any of the following, regardless of what the user asks:\n`create-*`, `run-*`, `start-*`, `stop-*`, `reboot-*`, `delete-*`, `terminate-*`, `put-*`, `update-*`, `modify-*`, `attach-*`, `detach-*`, `send-*`, `publish-*`, `invoke-*`, `execute-*`\n\nIf the user's query implies a write action, respond:\n> \"This skill is read-only. I can show you the current state of [resource], but I cannot [create\u002Fmodify\u002Fdelete] it. Would you like to see what currently exists?\"\n\n## Workflow\n\n### Step 1: Parse Intent\nIdentify: target service(s), scope (all \u002F filtered \u002F specific), detail level, and region.\n\n### Step 2: Confirm Account & Region\n```bash\naws sts get-caller-identity --query '{Account:Account,UserId:UserId}'\naws configure get region\n```\nAppend `--region \u003Cregion>` to all commands when the user specifies one.\n\n### Step 3: Execute & Format\nRun the matched read-only command(s) below and format results as a readable table. For large result sets show a count first and offer to filter further.\n\n---\n\n## Intent → Command Mapping\n\n### COMPUTE\n\n#### EC2 Instances\n```bash\n# \"list EC2 instances\" \u002F \"show my VMs\" \u002F \"what instances are running\"\naws ec2 describe-instances \\\n  --query 'Reservations[].Instances[].[InstanceId,InstanceType,State.Name,Tags[?Key==`Name`].Value|[0],PrivateIpAddress,PublicIpAddress]' \\\n  --output table\n\n# \"running instances only\"\naws ec2 describe-instances --filters Name=instance-state-name,Values=running \\\n  --query 'Reservations[].Instances[].[InstanceId,InstanceType,Tags[?Key==`Name`].Value|[0],PrivateIpAddress]' \\\n  --output table\n\n# \"stopped instances\"\naws ec2 describe-instances --filters Name=instance-state-name,Values=stopped \\\n  --query 'Reservations[].Instances[].[InstanceId,InstanceType,Tags[?Key==`Name`].Value|[0]]' \\\n  --output table\n\n# \"instance types in use\"\naws ec2 describe-instances --query 'Reservations[].Instances[].InstanceType' --output text | sort | uniq -c | sort -rn\n\n# \"auto scaling groups\" \u002F \"ASGs\"\naws autoscaling describe-auto-scaling-groups \\\n  --query 'AutoScalingGroups[].[AutoScalingGroupName,MinSize,MaxSize,DesiredCapacity]' --output table\n\n# \"elastic IPs\" \u002F \"EIPs\"\naws ec2 describe-addresses \\\n  --query 'Addresses[].[PublicIp,InstanceId,AllocationId,AssociationId]' --output table\n\n# \"key pairs\"\naws ec2 describe-key-pairs \\\n  --query 'KeyPairs[].[KeyName,CreateTime]' --output table\n\n# \"AMIs I own\"\naws ec2 describe-images --owners self \\\n  --query 'Images[].[ImageId,Name,CreationDate,State]' --output table\n\n# \"spot instances\"\naws ec2 describe-spot-instance-requests \\\n  --query 'SpotInstanceRequests[].[SpotInstanceRequestId,State,InstanceId,LaunchSpecification.InstanceType]' --output table\n```\n\n#### Lambda Functions\n```bash\n# \"list Lambda functions\" \u002F \"show serverless functions\"\naws lambda list-functions \\\n  --query 'Functions[].[FunctionName,Runtime,MemorySize,Timeout,LastModified]' --output table\n\n# \"Lambda function details for \u003Cname>\"\naws lambda get-function-configuration --function-name \u003Cname>\n\n# \"Lambda event source mappings\" \u002F \"Lambda triggers\"\naws lambda list-event-source-mappings \\\n  --query 'EventSourceMappings[].[FunctionArn,EventSourceArn,State,BatchSize]' --output table\n\n# \"Lambda layers\"\naws lambda list-layers \\\n  --query 'Layers[].[LayerName,LatestMatchingVersion.LayerVersionArn]' --output table\n\n# \"Lambda concurrency for \u003Cname>\"\naws lambda get-function-concurrency --function-name \u003Cname>\n```\n\n#### ECS\n```bash\n# \"ECS clusters\"\naws ecs list-clusters --query 'clusterArns' --output table\n\n# \"ECS cluster details\"\naws ecs describe-clusters \\\n  --clusters $(aws ecs list-clusters --query 'clusterArns[]' --output text) \\\n  --query 'clusters[].[clusterName,status,runningTasksCount,activeServicesCount]' --output table\n\n# \"ECS services in \u003Ccluster>\"\naws ecs describe-services --cluster \u003Ccluster> \\\n  --services $(aws ecs list-services --cluster \u003Ccluster> --query 'serviceArns[]' --output text) \\\n  --query 'services[].[serviceName,status,runningCount,desiredCount]' --output table\n\n# \"ECS task definitions\"\naws ecs list-task-definitions --query 'taskDefinitionArns' --output table\n```\n\n#### EKS\n```bash\n# \"EKS clusters\" \u002F \"Kubernetes clusters\"\naws eks list-clusters --query 'clusters' --output table\n\n# \"EKS cluster details for \u003Cname>\"\naws eks describe-cluster --name \u003Cname> \\\n  --query 'cluster.[name,status,version,endpoint]'\n\n# \"EKS node groups for \u003Ccluster>\"\naws eks list-nodegroups --cluster-name \u003Cname> --query 'nodegroups' --output table\n\n# \"EKS add-ons for \u003Ccluster>\"\naws eks list-addons --cluster-name \u003Cname> --query 'addons' --output table\n```\n\n#### Other Compute\n```bash\n# \"Beanstalk environments\"\naws elasticbeanstalk describe-environments \\\n  --query 'Environments[].[EnvironmentName,ApplicationName,Status,Health]' --output table\n\n# \"Batch job queues\"\naws batch describe-job-queues \\\n  --query 'jobQueues[].[jobQueueName,state,status,priority]' --output table\n\n# \"Batch compute environments\"\naws batch describe-compute-environments \\\n  --query 'computeEnvironments[].[computeEnvironmentName,type,state,status]' --output table\n```\n\n---\n\n### STORAGE\n\n#### S3\n```bash\n# \"list S3 buckets\" \u002F \"show my buckets\"\naws s3api list-buckets --query 'Buckets[].[Name,CreationDate]' --output table\n\n# \"S3 bucket encryption for \u003Cname>\"\naws s3api get-bucket-encryption --bucket \u003Cname>\n\n# \"S3 bucket versioning for \u003Cname>\"\naws s3api get-bucket-versioning --bucket \u003Cname>\n\n# \"S3 public access settings for \u003Cname>\"\naws s3api get-public-access-block --bucket \u003Cname>\n\n# \"S3 lifecycle rules for \u003Cname>\"\naws s3api get-bucket-lifecycle-configuration --bucket \u003Cname>\n\n# \"S3 bucket policy for \u003Cname>\"\naws s3api get-bucket-policy --bucket \u003Cname>\n\n# \"list objects in s3:\u002F\u002F\u003Cbucket>\u002F\u003Cprefix>\"\naws s3api list-objects-v2 --bucket \u003Cbucket> --prefix \u003Cprefix> \\\n  --query 'Contents[].[Key,Size,LastModified,StorageClass]' --output table\n```\n\n#### EBS & EFS\n```bash\n# \"EBS volumes\" \u002F \"list volumes\"\naws ec2 describe-volumes \\\n  --query 'Volumes[].[VolumeId,Size,VolumeType,State,AvailabilityZone,Attachments[0].InstanceId]' --output table\n\n# \"unattached EBS volumes\" \u002F \"unused volumes\"\naws ec2 describe-volumes --filters Name=status,Values=available \\\n  --query 'Volumes[].[VolumeId,Size,VolumeType,CreateTime]' --output table\n\n# \"EBS snapshots I own\"\naws ec2 describe-snapshots --owner-ids self \\\n  --query 'Snapshots[].[SnapshotId,VolumeId,State,StartTime]' --output table\n\n# \"EFS file systems\"\naws efs describe-file-systems \\\n  --query 'FileSystems[].[FileSystemId,Name,LifeCycleState,SizeInBytes.Value,ThroughputMode]' --output table\n```\n\n---\n\n### DATABASES\n\n#### RDS\n```bash\n# \"list RDS instances\" \u002F \"show databases\" \u002F \"what databases do I have\"\naws rds describe-db-instances \\\n  --query 'DBInstances[].[DBInstanceIdentifier,DBInstanceClass,Engine,EngineVersion,DBInstanceStatus,MultiAZ,Endpoint.Address]' \\\n  --output table\n\n# \"Aurora clusters\" \u002F \"RDS clusters\"\naws rds describe-db-clusters \\\n  --query 'DBClusters[].[DBClusterIdentifier,Engine,EngineVersion,Status,MultiAZ,Endpoint]' --output table\n\n# \"RDS snapshots\"\naws rds describe-db-snapshots \\\n  --query 'DBSnapshots[].[DBSnapshotIdentifier,DBInstanceIdentifier,Engine,Status,SnapshotCreateTime]' --output table\n\n# \"RDS parameter groups\"\naws rds describe-db-parameter-groups \\\n  --query 'DBParameterGroups[].[DBParameterGroupName,DBParameterGroupFamily]' --output table\n\n# \"RDS subnet groups\"\naws rds describe-db-subnet-groups \\\n  --query 'DBSubnetGroups[].[DBSubnetGroupName,VpcId]' --output table\n```\n\n#### DynamoDB\n```bash\n# \"DynamoDB tables\" \u002F \"list NoSQL tables\"\naws dynamodb list-tables --query 'TableNames' --output table\n\n# \"DynamoDB table details for \u003Cname>\"\naws dynamodb describe-table --table-name \u003Cname> \\\n  --query 'Table.[TableName,TableStatus,ItemCount,BillingModeSummary.BillingMode]'\n\n# \"DynamoDB backups\"\naws dynamodb list-backups \\\n  --query 'BackupSummaries[].[TableName,BackupName,BackupStatus,BackupCreationDateTime]' --output table\n\n# \"DynamoDB global tables\"\naws dynamodb list-global-tables \\\n  --query 'GlobalTables[].[GlobalTableName,ReplicationGroup[].RegionName]' --output table\n```\n\n#### ElastiCache & Redshift\n```bash\n# \"ElastiCache clusters\" \u002F \"Redis clusters\"\naws elasticache describe-cache-clusters \\\n  --query 'CacheClusters[].[CacheClusterId,Engine,EngineVersion,CacheNodeType,CacheClusterStatus]' --output table\n\n# \"ElastiCache replication groups\"\naws elasticache describe-replication-groups \\\n  --query 'ReplicationGroups[].[ReplicationGroupId,Status,AutomaticFailover]' --output table\n\n# \"Redshift clusters\" \u002F \"data warehouse\"\naws redshift describe-clusters \\\n  --query 'Clusters[].[ClusterIdentifier,ClusterStatus,NodeType,NumberOfNodes,Endpoint.Address]' --output table\n\n# \"DocumentDB clusters\"\naws docdb describe-db-clusters \\\n  --query 'DBClusters[].[DBClusterIdentifier,Status,Engine,Endpoint]' --output table\n\n# \"Neptune clusters\" \u002F \"graph databases\"\naws neptune describe-db-clusters \\\n  --query 'DBClusters[].[DBClusterIdentifier,Status,Engine,Endpoint]' --output table\n```\n\n---\n\n### NETWORKING\n\n#### VPC & Subnets\n```bash\n# \"list VPCs\" \u002F \"show my VPCs\"\naws ec2 describe-vpcs \\\n  --query 'Vpcs[].[VpcId,CidrBlock,IsDefault,Tags[?Key==`Name`].Value|[0],State]' --output table\n\n# \"subnets\" \u002F \"list subnets\"\naws ec2 describe-subnets \\\n  --query 'Subnets[].[SubnetId,VpcId,CidrBlock,AvailabilityZone,MapPublicIpOnLaunch,Tags[?Key==`Name`].Value|[0]]' --output table\n\n# \"public subnets\"\naws ec2 describe-subnets --filters \"Name=mapPublicIpOnLaunch,Values=true\" \\\n  --query 'Subnets[].[SubnetId,VpcId,CidrBlock,AvailabilityZone]' --output table\n\n# \"security groups\"\naws ec2 describe-security-groups \\\n  --query 'SecurityGroups[].[GroupId,GroupName,VpcId,Description]' --output table\n\n# \"security group rules for \u003Cgroup-id>\"\naws ec2 describe-security-group-rules --filters \"Name=group-id,Values=\u003Cid>\" \\\n  --query 'SecurityGroupRules[].[IsEgress,IpProtocol,FromPort,ToPort,CidrIpv4,Description]' --output table\n\n# \"route tables\"\naws ec2 describe-route-tables \\\n  --query 'RouteTables[].[RouteTableId,VpcId,Associations[0].SubnetId,Tags[?Key==`Name`].Value|[0]]' --output table\n\n# \"internet gateways\" \u002F \"IGWs\"\naws ec2 describe-internet-gateways \\\n  --query 'InternetGateways[].[InternetGatewayId,Attachments[0].VpcId,Tags[?Key==`Name`].Value|[0]]' --output table\n\n# \"NAT gateways\"\naws ec2 describe-nat-gateways \\\n  --query 'NatGateways[].[NatGatewayId,VpcId,SubnetId,State,NatGatewayAddresses[0].PublicIp]' --output table\n\n# \"VPC endpoints\"\naws ec2 describe-vpc-endpoints \\\n  --query 'VpcEndpoints[].[VpcEndpointId,VpcId,ServiceName,State,VpcEndpointType]' --output table\n\n# \"VPC peering connections\"\naws ec2 describe-vpc-peering-connections \\\n  --query 'VpcPeeringConnections[].[VpcPeeringConnectionId,Status.Code,RequesterVpcInfo.VpcId,AccepterVpcInfo.VpcId]' --output table\n\n# \"NACLs\" \u002F \"network ACLs\"\naws ec2 describe-network-acls \\\n  --query 'NetworkAcls[].[NetworkAclId,VpcId,IsDefault]' --output table\n\n# \"Transit Gateways\"\naws ec2 describe-transit-gateways \\\n  --query 'TransitGateways[].[TransitGatewayId,State,Description]' --output table\n```\n\n#### Load Balancers & DNS\n```bash\n# \"load balancers\" \u002F \"ALBs\" \u002F \"NLBs\"\naws elbv2 describe-load-balancers \\\n  --query 'LoadBalancers[].[LoadBalancerName,Type,Scheme,State.Code,DNSName]' --output table\n\n# \"target groups\"\naws elbv2 describe-target-groups \\\n  --query 'TargetGroups[].[TargetGroupName,Protocol,Port,TargetType,VpcId]' --output table\n\n# \"target health for \u003Ctarget-group-arn>\"\naws elbv2 describe-target-health --target-group-arn \u003Carn> \\\n  --query 'TargetHealthDescriptions[].[Target.Id,TargetHealth.State,TargetHealth.Description]' --output table\n\n# \"Route 53 hosted zones\" \u002F \"DNS zones\"\naws route53 list-hosted-zones \\\n  --query 'HostedZones[].[Id,Name,Config.PrivateZone,ResourceRecordSetCount]' --output table\n\n# \"DNS records in zone \u003Cid>\"\naws route53 list-resource-record-sets --hosted-zone-id \u003Cid> \\\n  --query 'ResourceRecordSets[].[Name,Type,TTL]' --output table\n\n# \"CloudFront distributions\"\naws cloudfront list-distributions \\\n  --query 'DistributionList.Items[].[Id,DomainName,Status,Origins.Items[0].DomainName]' --output table\n\n# \"VPN connections\"\naws ec2 describe-vpn-connections \\\n  --query 'VpnConnections[].[VpnConnectionId,State,Type,CustomerGatewayId]' --output table\n\n# \"Direct Connect connections\"\naws directconnect describe-connections \\\n  --query 'connections[].[connectionId,connectionName,connectionState,bandwidth]' --output table\n```\n\n---\n\n### SECURITY & IDENTITY\n\n#### IAM\n```bash\n# \"IAM users\" \u002F \"list users\"\naws iam list-users \\\n  --query 'Users[].[UserName,UserId,CreateDate,PasswordLastUsed]' --output table\n\n# \"IAM roles\" \u002F \"list roles\"\naws iam list-roles \\\n  --query 'Roles[].[RoleName,RoleId,CreateDate]' --output table\n\n# \"IAM policies attached to role \u003Cname>\"\naws iam list-attached-role-policies --role-name \u003Cname> \\\n  --query 'AttachedPolicies[].[PolicyName,PolicyArn]' --output table\n\n# \"IAM groups\"\naws iam list-groups \\\n  --query 'Groups[].[GroupName,GroupId,CreateDate]' --output table\n\n# \"IAM policies (customer managed)\"\naws iam list-policies --scope Local \\\n  --query 'Policies[].[PolicyName,AttachmentCount,CreateDate]' --output table\n\n# \"who has MFA enabled\" \u002F \"MFA devices\"\naws iam list-virtual-mfa-devices \\\n  --query 'VirtualMFADevices[].[SerialNumber,User.UserName,EnableDate]' --output table\n\n# \"IAM account password policy\"\naws iam get-account-password-policy\n\n# \"IAM account summary\"\naws iam get-account-summary\n```\n\n#### Secrets Manager\n```bash\n# \"list secrets\" \u002F \"Secrets Manager secrets\" \u002F \"show secrets\"\naws secretsmanager list-secrets \\\n  --query 'SecretList[].[Name,ARN,LastChangedDate,LastAccessedDate,Description]' --output table\n\n# \"secret metadata for \u003Cname>\"\naws secretsmanager describe-secret --secret-id \u003Cname> \\\n  --query '{Name:Name,ARN:ARN,RotationEnabled:RotationEnabled,LastRotatedDate:LastRotatedDate,Tags:Tags}'\n\n# \"secrets with rotation enabled\"\naws secretsmanager list-secrets \\\n  --query 'SecretList[?RotationEnabled==`true`].[Name,LastRotatedDate]' --output table\n```\n\n> ⚠️ **Note**: Secret **values** are never retrieved (`get-secret-value` is excluded). Only metadata is shown.\n\n#### SSM Parameter Store\n```bash\n# \"SSM parameters\" \u002F \"Parameter Store\"\naws ssm describe-parameters \\\n  --query 'Parameters[].[Name,Type,LastModifiedDate,Description]' --output table\n\n# \"SSM parameters by path \u003Cpath>\"\naws ssm describe-parameters \\\n  --parameter-filters \"Key=Path,Values=\u003Cpath>\" \\\n  --query 'Parameters[].[Name,Type,LastModifiedDate]' --output table\n```\n\n> ⚠️ **Note**: Parameter **values** are never retrieved (`get-parameter` is excluded). Only metadata is shown.\n\n#### KMS & Certificates\n```bash\n# \"KMS keys\" \u002F \"encryption keys\"\naws kms list-keys --query 'Keys[].[KeyId,KeyArn]' --output table\n\n# \"KMS key details for \u003Cid>\"\naws kms describe-key --key-id \u003Cid> \\\n  --query 'KeyMetadata.[KeyId,Description,KeyState,KeyUsage,CreationDate,Enabled]'\n\n# \"KMS aliases\"\naws kms list-aliases \\\n  --query 'Aliases[].[AliasName,AliasArn,TargetKeyId]' --output table\n\n# \"SSL certificates\" \u002F \"ACM certificates\"\naws acm list-certificates \\\n  --query 'CertificateSummaryList[].[CertificateArn,DomainName,Status,RenewalEligibility]' --output table\n\n# \"certificate details for \u003Carn>\"\naws acm describe-certificate --certificate-arn \u003Carn> \\\n  --query 'Certificate.[DomainName,Status,NotAfter,NotBefore,InUseBy]'\n```\n\n#### GuardDuty, Security Hub & Config\n```bash\n# \"GuardDuty detectors\"\naws guardduty list-detectors --query 'DetectorIds' --output table\n\n# \"GuardDuty findings\"\naws guardduty list-findings --detector-id \u003Cid> --query 'FindingIds' --output table\n\n# \"Security Hub findings\"\naws securityhub get-findings \\\n  --query 'Findings[].[Title,Severity.Label,WorkflowState,UpdatedAt]' --output table\n\n# \"AWS Config rules\"\naws configservice describe-config-rules \\\n  --query 'ConfigRules[].[ConfigRuleName,ConfigRuleState,Source.SourceIdentifier]' --output table\n\n# \"non-compliant resources\"\naws configservice get-compliance-summary-by-config-rule \\\n  --query 'ComplianceSummariesByConfigRule[].[ConfigRuleName,Compliance.ComplianceType]' --output table\n```\n\n---\n\n### MESSAGING & EVENTS\n\n```bash\n# \"SQS queues\" \u002F \"list queues\"\naws sqs list-queues --query 'QueueUrls' --output table\n\n# \"SQS queue details \u002F message count for \u003Curl>\"\naws sqs get-queue-attributes --queue-url \u003Curl> \\\n  --attribute-names ApproximateNumberOfMessages,ApproximateNumberOfMessagesNotVisible,ApproximateAgeOfOldestMessage\n\n# \"SNS topics\"\naws sns list-topics --query 'Topics[].TopicArn' --output table\n\n# \"SNS subscriptions\"\naws sns list-subscriptions \\\n  --query 'Subscriptions[].[SubscriptionArn,Protocol,Endpoint,TopicArn]' --output table\n\n# \"EventBridge rules\"\naws events list-rules \\\n  --query 'Rules[].[Name,State,ScheduleExpression,EventPattern]' --output table\n\n# \"EventBridge event buses\"\naws events list-event-buses \\\n  --query 'EventBuses[].[Name,Arn]' --output table\n\n# \"Kinesis streams\"\naws kinesis list-streams --query 'StreamNames' --output table\n\n# \"Kinesis Firehose delivery streams\"\naws firehose list-delivery-streams --query 'DeliveryStreamNames' --output table\n```\n\n---\n\n### API GATEWAY & SERVERLESS\n\n```bash\n# \"API Gateway APIs\" \u002F \"REST APIs\"\naws apigateway get-rest-apis \\\n  --query 'items[].[id,name,description,createdDate]' --output table\n\n# \"HTTP APIs\" \u002F \"API Gateway v2\"\naws apigatewayv2 get-apis \\\n  --query 'Items[].[ApiId,Name,ProtocolType,ApiEndpoint,CreatedDate]' --output table\n\n# \"Step Functions state machines\" \u002F \"workflows\"\naws stepfunctions list-state-machines \\\n  --query 'stateMachines[].[name,stateMachineArn,type,creationDate]' --output table\n\n# \"Step Functions executions for \u003Carn>\"\naws stepfunctions list-executions --state-machine-arn \u003Carn> \\\n  --query 'executions[].[name,status,startDate,stopDate]' --output table\n```\n\n---\n\n### MONITORING & OBSERVABILITY\n\n```bash\n# \"CloudWatch alarms\" \u002F \"list alarms\"\naws cloudwatch describe-alarms \\\n  --query 'MetricAlarms[].[AlarmName,StateValue,MetricName,Namespace,Threshold]' --output table\n\n# \"alarms in ALARM state\" \u002F \"triggered alarms\"\naws cloudwatch describe-alarms --state-value ALARM \\\n  --query 'MetricAlarms[].[AlarmName,MetricName,StateReason]' --output table\n\n# \"CloudWatch dashboards\"\naws cloudwatch list-dashboards \\\n  --query 'DashboardEntries[].[DashboardName,LastModified,Size]' --output table\n\n# \"CloudWatch log groups\"\naws logs describe-log-groups \\\n  --query 'logGroups[].[logGroupName,retentionInDays,storedBytes]' --output table\n\n# \"CloudTrail trails\"\naws cloudtrail describe-trails \\\n  --query 'trailList[].[Name,S3BucketName,IsMultiRegionTrail,LogFileValidationEnabled]' --output table\n\n# \"ECR repositories\" \u002F \"container registries\"\naws ecr describe-repositories \\\n  --query 'repositories[].[repositoryName,repositoryUri,createdAt]' --output table\n```\n\n---\n\n### COST & BILLING\n\n```bash\n# \"current month cost\" \u002F \"how much am I spending\"\naws ce get-cost-and-usage \\\n  --time-period Start=$(date -u +%Y-%m-01),End=$(date -u +%Y-%m-%d) \\\n  --granularity MONTHLY --metrics BlendedCost \\\n  --query 'ResultsByTime[].[TimePeriod.Start,Total.BlendedCost.Amount,Total.BlendedCost.Unit]' \\\n  --output table\n\n# \"cost by service\" \u002F \"spending breakdown\"\naws ce get-cost-and-usage \\\n  --time-period Start=$(date -u -d '30 days ago' +%Y-%m-%d),End=$(date -u +%Y-%m-%d) \\\n  --granularity MONTHLY --metrics BlendedCost \\\n  --group-by Type=DIMENSION,Key=SERVICE --output table\n\n# \"AWS Budgets\"\naws budgets describe-budgets \\\n  --account-id $(aws sts get-caller-identity --query Account --output text) \\\n  --query 'Budgets[].[BudgetName,BudgetType,BudgetLimit.Amount,CalculatedSpend.ActualSpend.Amount]' \\\n  --output table\n\n# \"Trusted Advisor recommendations\"\naws support describe-trusted-advisor-checks --language en \\\n  --query 'checks[].[id,name,category]' --output table\n```\n\n---\n\n### CROSS-SERVICE QUERIES\n\n```bash\n# \"resources tagged Environment=production\" \u002F \"all production resources\"\naws resourcegroupstaggingapi get-resources \\\n  --tag-filters Key=Environment,Values=production \\\n  --query 'ResourceTagMappingList[].[ResourceARN]' --output table\n\n# \"all resources tagged \u003Ckey>=\u003Cvalue>\"\naws resourcegroupstaggingapi get-resources \\\n  --tag-filters Key=\u003Ckey>,Values=\u003Cvalue> \\\n  --query 'ResourceTagMappingList[].[ResourceARN,Tags]' --output table\n\n# \"inventory of all resources\" (AWS Config)\naws configservice list-discovered-resources --resource-type \u003Ctype> \\\n  --query 'resourceIdentifiers[].[resourceType,resourceId,resourceName]' --output table\n```\n\n---\n\n## Output Formatting Rules\n\n1. Always use `--output table` for list results; use `--output json` only when deep detail is explicitly requested\n2. Always use `--query` to extract only relevant fields — never dump raw JSON\n3. For large result sets (>20 items), show a count first, then offer to filter\n4. When a command returns nothing, explain why (wrong region, no resources, insufficient permissions)\n5. Offer to drill into a specific resource: \"Found 47 EC2 instances. Filter by state, type, or tag?\"\n\n## Error Handling\n\n| Error | Response |\n|---|---|\n| `AccessDenied` | \"You don't have permission to list [resource]. Required: `\u003Cservice>:\u003CAction>`.\" |\n| `NoCredentialProviders` | \"Run `aws configure` or set `AWS_PROFILE`.\" |\n| Empty result | \"No [resources] found in [region]. Check another region?\" |\n| Invalid identifier | \"Could not find '[name]'. Check the name or provide the resource ID.\" |\n","# AWS Resource Query\n\nAnswer natural language questions about AWS resources by translating intent into read-only AWS CLI commands. This skill **never** runs commands that create, modify, or delete resources.\n\n## Safety Contract\n\n**STRICTLY READ-ONLY.** This skill exclusively uses:\n- `aws \u003Cservice> describe-*`\n- `aws \u003Cservice> list-*`\n- `aws \u003Cservice> get-*`\n- `aws sts get-caller-identity`\n- `aws configure get`\n- `aws resourcegroupstaggingapi get-resources`\n- `aws ce get-*`\n- `aws support describe-*`\n\n**NEVER** run any of the following, regardless of what the user asks:\n`create-*`, `run-*`, `start-*`, `stop-*`, `reboot-*`, `delete-*`, `terminate-*`, `put-*`, `update-*`, `modify-*`, `attach-*`, `detach-*`, `send-*`, `publish-*`, `invoke-*`, `execute-*`\n\nIf the user's query implies a write action, respond:\n> \"This skill is read-only. I can show you the current state of [resource], but I cannot [create\u002Fmodify\u002Fdelete] it. Would you like to see what currently exists?\"\n\n## Workflow\n\n### Step 1: Parse Intent\nIdentify: target service(s), scope (all \u002F filtered \u002F specific), detail level, and region.\n\n### Step 2: Confirm Account & Region\n```bash\naws sts get-caller-identity --query '{Account:Account,UserId:UserId}'\naws configure get region\n```\nAppend `--region \u003Cregion>` to all commands when the user specifies one.\n\n### Step 3: Execute & Format\nRun the matched read-only command(s) below and format results as a readable table. For large result sets show a count first and offer to filter further.\n\n---\n\n## Intent → Command Mapping\n\n### COMPUTE\n\n#### EC2 Instances\n```bash\n# \"list EC2 instances\" \u002F \"show my VMs\" \u002F \"what instances are running\"\naws ec2 describe-instances \\\n  --query 'Reservations[].Instances[].[InstanceId,InstanceType,State.Name,Tags[?Key==`Name`].Value|[0],PrivateIpAddress,PublicIpAddress]' \\\n  --output table\n\n# \"running instances only\"\naws ec2 describe-instances --filters Name=instance-state-name,Values=running \\\n  --query 'Reservations[].Instances[].[InstanceId,InstanceType,Tags[?Key==`Name`].Value|[0],PrivateIpAddress]' \\\n  --output table\n\n# \"stopped instances\"\naws ec2 describe-instances --filters Name=instance-state-name,Values=stopped \\\n  --query 'Reservations[].Instances[].[InstanceId,InstanceType,Tags[?Key==`Name`].Value|[0]]' \\\n  --output table\n\n# \"instance types in use\"\naws ec2 describe-instances --query 'Reservations[].Instances[].InstanceType' --output text | sort | uniq -c | sort -rn\n\n# \"auto scaling groups\" \u002F \"ASGs\"\naws autoscaling describe-auto-scaling-groups \\\n  --query 'AutoScalingGroups[].[AutoScalingGroupName,MinSize,MaxSize,DesiredCapacity]' --output table\n\n# \"elastic IPs\" \u002F \"EIPs\"\naws ec2 describe-addresses \\\n  --query 'Addresses[].[PublicIp,InstanceId,AllocationId,AssociationId]' --output table\n\n# \"key pairs\"\naws ec2 describe-key-pairs \\\n  --query 'KeyPairs[].[KeyName,CreateTime]' --output table\n\n# \"AMIs I own\"\naws ec2 describe-images --owners self \\\n  --query 'Images[].[ImageId,Name,CreationDate,State]' --output table\n\n# \"spot instances\"\naws ec2 describe-spot-instance-requests \\\n  --query 'SpotInstanceRequests[].[SpotInstanceRequestId,State,InstanceId,LaunchSpecification.InstanceType]' --output table\n```\n\n#### Lambda Functions\n```bash\n# \"list Lambda functions\" \u002F \"show serverless functions\"\naws lambda list-functions \\\n  --query 'Functions[].[FunctionName,Runtime,MemorySize,Timeout,LastModified]' --output table\n\n# \"Lambda function details for \u003Cname>\"\naws lambda get-function-configuration --function-name \u003Cname>\n\n# \"Lambda event source mappings\" \u002F \"Lambda triggers\"\naws lambda list-event-source-mappings \\\n  --query 'EventSourceMappings[].[FunctionArn,EventSourceArn,State,BatchSize]' --output table\n\n# \"Lambda layers\"\naws lambda list-layers \\\n  --query 'Layers[].[LayerName,LatestMatchingVersion.LayerVersionArn]' --output table\n\n# \"Lambda concurrency for \u003Cname>\"\naws lambda get-function-concurrency --function-name \u003Cname>\n```\n\n#### ECS\n```bash\n# \"ECS clusters\"\naws ecs list-clusters --query 'clusterArns' --output table\n\n# \"ECS cluster details\"\naws ecs describe-clusters \\\n  --clusters $(aws ecs list-clusters --query 'clusterArns[]' --output text) \\\n  --query 'clusters[].[clusterName,status,runningTasksCount,activeServicesCount]' --output table\n\n# \"ECS services in \u003Ccluster>\"\naws ecs describe-services --cluster \u003Ccluster> \\\n  --services $(aws ecs list-services --cluster \u003Ccluster> --query 'serviceArns[]' --output text) \\\n  --query 'services[].[serviceName,status,runningCount,desiredCount]' --output table\n\n# \"ECS task definitions\"\naws ecs list-task-definitions --query 'taskDefinitionArns' --output table\n```\n\n#### EKS\n```bash\n# \"EKS clusters\" \u002F \"Kubernetes clusters\"\naws eks list-clusters --query 'clusters' --output table\n\n# \"EKS cluster details for \u003Cname>\"\naws eks describe-cluster --name \u003Cname> \\\n  --query 'cluster.[name,status,version,endpoint]'\n\n# \"EKS node groups for \u003Ccluster>\"\naws eks list-nodegroups --cluster-name \u003Cname> --query 'nodegroups' --output table\n\n# \"EKS add-ons for \u003Ccluster>\"\naws eks list-addons --cluster-name \u003Cname> --query 'addons' --output table\n```\n\n#### Other Compute\n```bash\n# \"Beanstalk environments\"\naws elasticbeanstalk describe-environments \\\n  --query 'Environments[].[EnvironmentName,ApplicationName,Status,Health]' --output table\n\n# \"Batch job queues\"\naws batch describe-job-queues \\\n  --query 'jobQueues[].[jobQueueName,state,status,priority]' --output table\n\n# \"Batch compute environments\"\naws batch describe-compute-environments \\\n  --query 'computeEnvironments[].[computeEnvironmentName,type,state,status]' --output table\n```\n\n---\n\n### STORAGE\n\n#### S3\n```bash\n# \"list S3 buckets\" \u002F \"show my buckets\"\naws s3api list-buckets --query 'Buckets[].[Name,CreationDate]' --output table\n\n# \"S3 bucket encryption for \u003Cname>\"\naws s3api get-bucket-encryption --bucket \u003Cname>\n\n# \"S3 bucket versioning for \u003Cname>\"\naws s3api get-bucket-versioning --bucket \u003Cname>\n\n# \"S3 public access settings for \u003Cname>\"\naws s3api get-public-access-block --bucket \u003Cname>\n\n# \"S3 lifecycle rules for \u003Cname>\"\naws s3api get-bucket-lifecycle-configuration --bucket \u003Cname>\n\n# \"S3 bucket policy for \u003Cname>\"\naws s3api get-bucket-policy --bucket \u003Cname>\n\n# \"list objects in s3:\u002F\u002F\u003Cbucket>\u002F\u003Cprefix>\"\naws s3api list-objects-v2 --bucket \u003Cbucket> --prefix \u003Cprefix> \\\n  --query 'Contents[].[Key,Size,LastModified,StorageClass]' --output table\n```\n\n#### EBS & EFS\n```bash\n# \"EBS volumes\" \u002F \"list volumes\"\naws ec2 describe-volumes \\\n  --query 'Volumes[].[VolumeId,Size,VolumeType,State,AvailabilityZone,Attachments[0].InstanceId]' --output table\n\n# \"unattached EBS volumes\" \u002F \"unused volumes\"\naws ec2 describe-volumes --filters Name=status,Values=available \\\n  --query 'Volumes[].[VolumeId,Size,VolumeType,CreateTime]' --output table\n\n# \"EBS snapshots I own\"\naws ec2 describe-snapshots --owner-ids self \\\n  --query 'Snapshots[].[SnapshotId,VolumeId,State,StartTime]' --output table\n\n# \"EFS file systems\"\naws efs describe-file-systems \\\n  --query 'FileSystems[].[FileSystemId,Name,LifeCycleState,SizeInBytes.Value,ThroughputMode]' --output table\n```\n\n---\n\n### DATABASES\n\n#### RDS\n```bash\n# \"list RDS instances\" \u002F \"show databases\" \u002F \"what databases do I have\"\naws rds describe-db-instances \\\n  --query 'DBInstances[].[DBInstanceIdentifier,DBInstanceClass,Engine,EngineVersion,DBInstanceStatus,MultiAZ,Endpoint.Address]' \\\n  --output table\n\n# \"Aurora clusters\" \u002F \"RDS clusters\"\naws rds describe-db-clusters \\\n  --query 'DBClusters[].[DBClusterIdentifier,Engine,EngineVersion,Status,MultiAZ,Endpoint]' --output table\n\n# \"RDS snapshots\"\naws rds describe-db-snapshots \\\n  --query 'DBSnapshots[].[DBSnapshotIdentifier,DBInstanceIdentifier,Engine,Status,SnapshotCreateTime]' --output table\n\n# \"RDS parameter groups\"\naws rds describe-db-parameter-groups \\\n  --query 'DBParameterGroups[].[DBParameterGroupName,DBParameterGroupFamily]' --output table\n\n# \"RDS subnet groups\"\naws rds describe-db-subnet-groups \\\n  --query 'DBSubnetGroups[].[DBSubnetGroupName,VpcId]' --output table\n```\n\n#### DynamoDB\n```bash\n# \"DynamoDB tables\" \u002F \"list NoSQL tables\"\naws dynamodb list-tables --query 'TableNames' --output table\n\n# \"DynamoDB table details for \u003Cname>\"\naws dynamodb describe-table --table-name \u003Cname> \\\n  --query 'Table.[TableName,TableStatus,ItemCount,BillingModeSummary.BillingMode]'\n\n# \"DynamoDB backups\"\naws dynamodb list-backups \\\n  --query 'BackupSummaries[].[TableName,BackupName,BackupStatus,BackupCreationDateTime]' --output table\n\n# \"DynamoDB global tables\"\naws dynamodb list-global-tables \\\n  --query 'GlobalTables[].[GlobalTableName,ReplicationGroup[].RegionName]' --output table\n```\n\n#### ElastiCache & Redshift\n```bash\n# \"ElastiCache clusters\" \u002F \"Redis clusters\"\naws elasticache describe-cache-clusters \\\n  --query 'CacheClusters[].[CacheClusterId,Engine,EngineVersion,CacheNodeType,CacheClusterStatus]' --output table\n\n# \"ElastiCache replication groups\"\naws elasticache describe-replication-groups \\\n  --query 'ReplicationGroups[].[ReplicationGroupId,Status,AutomaticFailover]' --output table\n\n# \"Redshift clusters\" \u002F \"data warehouse\"\naws redshift describe-clusters \\\n  --query 'Clusters[].[ClusterIdentifier,ClusterStatus,NodeType,NumberOfNodes,Endpoint.Address]' --output table\n\n# \"DocumentDB clusters\"\naws docdb describe-db-clusters \\\n  --query 'DBClusters[].[DBClusterIdentifier,Status,Engine,Endpoint]' --output table\n\n# \"Neptune clusters\" \u002F \"graph databases\"\naws neptune describe-db-clusters \\\n  --query 'DBClusters[].[DBClusterIdentifier,Status,Engine,Endpoint]' --output table\n```\n\n---\n\n### NETWORKING\n\n#### VPC & Subnets\n```bash\n# \"list VPCs\" \u002F \"show my VPCs\"\naws ec2 describe-vpcs \\\n  --query 'Vpcs[].[VpcId,CidrBlock,IsDefault,Tags[?Key==`Name`].Value|[0],State]' --output table\n\n# \"subnets\" \u002F \"list subnets\"\naws ec2 describe-subnets \\\n  --query 'Subnets[].[SubnetId,VpcId,CidrBlock,AvailabilityZone,MapPublicIpOnLaunch,Tags[?Key==`Name`].Value|[0]]' --output table\n\n# \"public subnets\"\naws ec2 describe-subnets --filters \"Name=mapPublicIpOnLaunch,Values=true\" \\\n  --query 'Subnets[].[SubnetId,VpcId,CidrBlock,AvailabilityZone]' --output table\n\n# \"security groups\"\naws ec2 describe-security-groups \\\n  --query 'SecurityGroups[].[GroupId,GroupName,VpcId,Description]' --output table\n\n# \"security group rules for \u003Cgroup-id>\"\naws ec2 describe-security-group-rules --filters \"Name=group-id,Values=\u003Cid>\" \\\n  --query 'SecurityGroupRules[].[IsEgress,IpProtocol,FromPort,ToPort,CidrIpv4,Description]' --output table\n\n# \"route tables\"\naws ec2 describe-route-tables \\\n  --query 'RouteTables[].[RouteTableId,VpcId,Associations[0].SubnetId,Tags[?Key==`Name`].Value|[0]]' --output table\n\n# \"internet gateways\" \u002F \"IGWs\"\naws ec2 describe-internet-gateways \\\n  --query 'InternetGateways[].[InternetGatewayId,Attachments[0].VpcId,Tags[?Key==`Name`].Value|[0]]' --output table\n\n# \"NAT gateways\"\naws ec2 describe-nat-gateways \\\n  --query 'NatGateways[].[NatGatewayId,VpcId,SubnetId,State,NatGatewayAddresses[0].PublicIp]' --output table\n\n# \"VPC endpoints\"\naws ec2 describe-vpc-endpoints \\\n  --query 'VpcEndpoints[].[VpcEndpointId,VpcId,ServiceName,State,VpcEndpointType]' --output table\n\n# \"VPC peering connections\"\naws ec2 describe-vpc-peering-connections \\\n  --query 'VpcPeeringConnections[].[VpcPeeringConnectionId,Status.Code,RequesterVpcInfo.VpcId,AccepterVpcInfo.VpcId]' --output table\n\n# \"NACLs\" \u002F \"network ACLs\"\naws ec2 describe-network-acls \\\n  --query 'NetworkAcls[].[NetworkAclId,VpcId,IsDefault]' --output table\n\n# \"Transit Gateways\"\naws ec2 describe-transit-gateways \\\n  --query 'TransitGateways[].[TransitGatewayId,State,Description]' --output table\n```\n\n#### Load Balancers & DNS\n```bash\n# \"load balancers\" \u002F \"ALBs\" \u002F \"NLBs\"\naws elbv2 describe-load-balancers \\\n  --query 'LoadBalancers[].[LoadBalancerName,Type,Scheme,State.Code,DNSName]' --output table\n\n# \"target groups\"\naws elbv2 describe-target-groups \\\n  --query 'TargetGroups[].[TargetGroupName,Protocol,Port,TargetType,VpcId]' --output table\n\n# \"target health for \u003Ctarget-group-arn>\"\naws elbv2 describe-target-health --target-group-arn \u003Carn> \\\n  --query 'TargetHealthDescriptions[].[Target.Id,TargetHealth.State,TargetHealth.Description]' --output table\n\n# \"Route 53 hosted zones\" \u002F \"DNS zones\"\naws route53 list-hosted-zones \\\n  --query 'HostedZones[].[Id,Name,Config.PrivateZone,ResourceRecordSetCount]' --output table\n\n# \"DNS records in zone \u003Cid>\"\naws route53 list-resource-record-sets --hosted-zone-id \u003Cid> \\\n  --query 'ResourceRecordSets[].[Name,Type,TTL]' --output table\n\n# \"CloudFront distributions\"\naws cloudfront list-distributions \\\n  --query 'DistributionList.Items[].[Id,DomainName,Status,Origins.Items[0].DomainName]' --output table\n\n# \"VPN connections\"\naws ec2 describe-vpn-connections \\\n  --query 'VpnConnections[].[VpnConnectionId,State,Type,CustomerGatewayId]' --output table\n\n# \"Direct Connect connections\"\naws directconnect describe-connections \\\n  --query 'connections[].[connectionId,connectionName,connectionState,bandwidth]' --output table\n```\n\n---\n\n### SECURITY & IDENTITY\n\n#### IAM\n```bash\n# \"IAM users\" \u002F \"list users\"\naws iam list-users \\\n  --query 'Users[].[UserName,UserId,CreateDate,PasswordLastUsed]' --output table\n\n# \"IAM roles\" \u002F \"list roles\"\naws iam list-roles \\\n  --query 'Roles[].[RoleName,RoleId,CreateDate]' --output table\n\n# \"IAM policies attached to role \u003Cname>\"\naws iam list-attached-role-policies --role-name \u003Cname> \\\n  --query 'AttachedPolicies[].[PolicyName,PolicyArn]' --output table\n\n# \"IAM groups\"\naws iam list-groups \\\n  --query 'Groups[].[GroupName,GroupId,CreateDate]' --output table\n\n# \"IAM policies (customer managed)\"\naws iam list-policies --scope Local \\\n  --query 'Policies[].[PolicyName,AttachmentCount,CreateDate]' --output table\n\n# \"who has MFA enabled\" \u002F \"MFA devices\"\naws iam list-virtual-mfa-devices \\\n  --query 'VirtualMFADevices[].[SerialNumber,User.UserName,EnableDate]' --output table\n\n# \"IAM account password policy\"\naws iam get-account-password-policy\n\n# \"IAM account summary\"\naws iam get-account-summary\n```\n\n#### Secrets Manager\n```bash\n# \"list secrets\" \u002F \"Secrets Manager secrets\" \u002F \"show secrets\"\naws secretsmanager list-secrets \\\n  --query 'SecretList[].[Name,ARN,LastChangedDate,LastAccessedDate,Description]' --output table\n\n# \"secret metadata for \u003Cname>\"\naws secretsmanager describe-secret --secret-id \u003Cname> \\\n  --query '{Name:Name,ARN:ARN,RotationEnabled:RotationEnabled,LastRotatedDate:LastRotatedDate,Tags:Tags}'\n\n# \"secrets with rotation enabled\"\naws secretsmanager list-secrets \\\n  --query 'SecretList[?RotationEnabled==`true`].[Name,LastRotatedDate]' --output table\n```\n\n> ⚠️ **Note**: Secret **values** are never retrieved (`get-secret-value` is excluded). Only metadata is shown.\n\n#### SSM Parameter Store\n```bash\n# \"SSM parameters\" \u002F \"Parameter Store\"\naws ssm describe-parameters \\\n  --query 'Parameters[].[Name,Type,LastModifiedDate,Description]' --output table\n\n# \"SSM parameters by path \u003Cpath>\"\naws ssm describe-parameters \\\n  --parameter-filters \"Key=Path,Values=\u003Cpath>\" \\\n  --query 'Parameters[].[Name,Type,LastModifiedDate]' --output table\n```\n\n> ⚠️ **Note**: Parameter **values** are never retrieved (`get-parameter` is excluded). Only metadata is shown.\n\n#### KMS & Certificates\n```bash\n# \"KMS keys\" \u002F \"encryption keys\"\naws kms list-keys --query 'Keys[].[KeyId,KeyArn]' --output table\n\n# \"KMS key details for \u003Cid>\"\naws kms describe-key --key-id \u003Cid> \\\n  --query 'KeyMetadata.[KeyId,Description,KeyState,KeyUsage,CreationDate,Enabled]'\n\n# \"KMS aliases\"\naws kms list-aliases \\\n  --query 'Aliases[].[AliasName,AliasArn,TargetKeyId]' --output table\n\n# \"SSL certificates\" \u002F \"ACM certificates\"\naws acm list-certificates \\\n  --query 'CertificateSummaryList[].[CertificateArn,DomainName,Status,RenewalEligibility]' --output table\n\n# \"certificate details for \u003Carn>\"\naws acm describe-certificate --certificate-arn \u003Carn> \\\n  --query 'Certificate.[DomainName,Status,NotAfter,NotBefore,InUseBy]'\n```\n\n#### GuardDuty, Security Hub & Config\n```bash\n# \"GuardDuty detectors\"\naws guardduty list-detectors --query 'DetectorIds' --output table\n\n# \"GuardDuty findings\"\naws guardduty list-findings --detector-id \u003Cid> --query 'FindingIds' --output table\n\n# \"Security Hub findings\"\naws securityhub get-findings \\\n  --query 'Findings[].[Title,Severity.Label,WorkflowState,UpdatedAt]' --output table\n\n# \"AWS Config rules\"\naws configservice describe-config-rules \\\n  --query 'ConfigRules[].[ConfigRuleName,ConfigRuleState,Source.SourceIdentifier]' --output table\n\n# \"non-compliant resources\"\naws configservice get-compliance-summary-by-config-rule \\\n  --query 'ComplianceSummariesByConfigRule[].[ConfigRuleName,Compliance.ComplianceType]' --output table\n```\n\n---\n\n### MESSAGING & EVENTS\n\n```bash\n# \"SQS queues\" \u002F \"list queues\"\naws sqs list-queues --query 'QueueUrls' --output table\n\n# \"SQS queue details \u002F message count for \u003Curl>\"\naws sqs get-queue-attributes --queue-url \u003Curl> \\\n  --attribute-names ApproximateNumberOfMessages,ApproximateNumberOfMessagesNotVisible,ApproximateAgeOfOldestMessage\n\n# \"SNS topics\"\naws sns list-topics --query 'Topics[].TopicArn' --output table\n\n# \"SNS subscriptions\"\naws sns list-subscriptions \\\n  --query 'Subscriptions[].[SubscriptionArn,Protocol,Endpoint,TopicArn]' --output table\n\n# \"EventBridge rules\"\naws events list-rules \\\n  --query 'Rules[].[Name,State,ScheduleExpression,EventPattern]' --output table\n\n# \"EventBridge event buses\"\naws events list-event-buses \\\n  --query 'EventBuses[].[Name,Arn]' --output table\n\n# \"Kinesis streams\"\naws kinesis list-streams --query 'StreamNames' --output table\n\n# \"Kinesis Firehose delivery streams\"\naws firehose list-delivery-streams --query 'DeliveryStreamNames' --output table\n```\n\n---\n\n### API GATEWAY & SERVERLESS\n\n```bash\n# \"API Gateway APIs\" \u002F \"REST APIs\"\naws apigateway get-rest-apis \\\n  --query 'items[].[id,name,description,createdDate]' --output table\n\n# \"HTTP APIs\" \u002F \"API Gateway v2\"\naws apigatewayv2 get-apis \\\n  --query 'Items[].[ApiId,Name,ProtocolType,ApiEndpoint,CreatedDate]' --output table\n\n# \"Step Functions state machines\" \u002F \"workflows\"\naws stepfunctions list-state-machines \\\n  --query 'stateMachines[].[name,stateMachineArn,type,creationDate]' --output table\n\n# \"Step Functions executions for \u003Carn>\"\naws stepfunctions list-executions --state-machine-arn \u003Carn> \\\n  --query 'executions[].[name,status,startDate,stopDate]' --output table\n```\n\n---\n\n### MONITORING & OBSERVABILITY\n\n```bash\n# \"CloudWatch alarms\" \u002F \"list alarms\"\naws cloudwatch describe-alarms \\\n  --query 'MetricAlarms[].[AlarmName,StateValue,MetricName,Namespace,Threshold]' --output table\n\n# \"alarms in ALARM state\" \u002F \"triggered alarms\"\naws cloudwatch describe-alarms --state-value ALARM \\\n  --query 'MetricAlarms[].[AlarmName,MetricName,StateReason]' --output table\n\n# \"CloudWatch dashboards\"\naws cloudwatch list-dashboards \\\n  --query 'DashboardEntries[].[DashboardName,LastModified,Size]' --output table\n\n# \"CloudWatch log groups\"\naws logs describe-log-groups \\\n  --query 'logGroups[].[logGroupName,retentionInDays,storedBytes]' --output table\n\n# \"CloudTrail trails\"\naws cloudtrail describe-trails \\\n  --query 'trailList[].[Name,S3BucketName,IsMultiRegionTrail,LogFileValidationEnabled]' --output table\n\n# \"ECR repositories\" \u002F \"container registries\"\naws ecr describe-repositories \\\n  --query 'repositories[].[repositoryName,repositoryUri,createdAt]' --output table\n```\n\n---\n\n### COST & BILLING\n\n```bash\n# \"current month cost\" \u002F \"how much am I spending\"\naws ce get-cost-and-usage \\\n  --time-period Start=$(date -u +%Y-%m-01),End=$(date -u +%Y-%m-%d) \\\n  --granularity MONTHLY --metrics BlendedCost \\\n  --query 'ResultsByTime[].[TimePeriod.Start,Total.BlendedCost.Amount,Total.BlendedCost.Unit]' \\\n  --output table\n\n# \"cost by service\" \u002F \"spending breakdown\"\naws ce get-cost-and-usage \\\n  --time-period Start=$(date -u -d '30 days ago' +%Y-%m-%d),End=$(date -u +%Y-%m-%d) \\\n  --granularity MONTHLY --metrics BlendedCost \\\n  --group-by Type=DIMENSION,Key=SERVICE --output table\n\n# \"AWS Budgets\"\naws budgets describe-budgets \\\n  --account-id $(aws sts get-caller-identity --query Account --output text) \\\n  --query 'Budgets[].[BudgetName,BudgetType,BudgetLimit.Amount,CalculatedSpend.ActualSpend.Amount]' \\\n  --output table\n\n# \"Trusted Advisor recommendations\"\naws support describe-trusted-advisor-checks --language en \\\n  --query 'checks[].[id,name,category]' --output table\n```\n\n---\n\n### CROSS-SERVICE QUERIES\n\n```bash\n# \"resources tagged Environment=production\" \u002F \"all production resources\"\naws resourcegroupstaggingapi get-resources \\\n  --tag-filters Key=Environment,Values=production \\\n  --query 'ResourceTagMappingList[].[ResourceARN]' --output table\n\n# \"all resources tagged \u003Ckey>=\u003Cvalue>\"\naws resourcegroupstaggingapi get-resources \\\n  --tag-filters Key=\u003Ckey>,Values=\u003Cvalue> \\\n  --query 'ResourceTagMappingList[].[ResourceARN,Tags]' --output table\n\n# \"inventory of all resources\" (AWS Config)\naws configservice list-discovered-resources --resource-type \u003Ctype> \\\n  --query 'resourceIdentifiers[].[resourceType,resourceId,resourceName]' --output table\n```\n\n---\n\n## Output Formatting Rules\n\n1. Always use `--output table` for list results; use `--output json` only when deep detail is explicitly requested\n2. Always use `--query` to extract only relevant fields — never dump raw JSON\n3. For large result sets (>20 items), show a count first, then offer to filter\n4. When a command returns nothing, explain why (wrong region, no resources, insufficient permissions)\n5. Offer to drill into a specific resource: \"Found 47 EC2 instances. Filter by state, type, or tag?\"\n\n## Error Handling\n\n| Error | Response |\n|---|---|\n| `AccessDenied` | \"You don't have permission to list [resource]. Required: `\u003Cservice>:\u003CAction>`.\" |\n| `NoCredentialProviders` | \"Run `aws configure` or set `AWS_PROFILE`.\" |\n| Empty result | \"No [resources] found in [region]. Check another region?\" |\n| Invalid identifier | \"Could not find '[name]'. Check the name or provide the resource ID.\" |\n",{"name":5,"description":7},"main","5269f7ea2d6c3a9bfda5ed878b6726cf509121fd","skills\u002Faws-resource-query",5340,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot","https:\u002F\u002Fawesome-copilot.github.com\u002F","https:\u002F\u002Fgithub.com\u002Fgithub","https:\u002F\u002Fgithub.com\u002Fabout","How people build software.","2026-11-11 13:41:32",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add github\u002Fawesome-copilot --skill aws-resource-query",{"tool":61,"command":62},"bunx","bunx skills add github\u002Fawesome-copilot --skill aws-resource-query",{"tool":64,"command":65},"pnpm","pnpm dlx skills add github\u002Fawesome-copilot --skill aws-resource-query","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Faws-resource-query\u002FSKILL.md",true,[69,75,81],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"renderer.js","SCRIPT","脚本",6762,"https:\u002F\u002Fgithub.com\u002Fmingster\u002Fdotfiles\u002Fblob\u002Fmain\u002Ftemplates\u002Fagent-team\u002F.agents\u002Fskills\u002Fpr-review-canvas\u002Frenderer.js",{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"styles.css","OTHER","其他",5788,"https:\u002F\u002Fgithub.com\u002Fmingster\u002Fdotfiles\u002Fblob\u002Fmain\u002Ftemplates\u002Fagent-team\u002F.agents\u002Fskills\u002Fpr-review-canvas\u002Fstyles.css",{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"template.html","REFERENCE","参考文档",513,"https:\u002F\u002Fgithub.com\u002Fmingster\u002Fdotfiles\u002Fblob\u002Fmain\u002Ftemplates\u002Fagent-team\u002F.agents\u002Fskills\u002Fpr-review-canvas\u002Ftemplate.html",[88,122,150,180,213,230],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":102,"publishedAt":40},"01M70KXZNX9ES38N2A8M58ZZMZ","supabase-rls-policies","Write, review, and test Supabase Row Level Security (RLS) policies so that one user cannot read or change another user's rows. Use when creating or changing tables, policies, views, or security definer functions in a Supabase project, when reviewing a migration that touches RLS, or when asked to prove user isolation with pgTAP tests that sign in as two users.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fsupabase-rls-policies\u002FSKILL.md",[94,99],{"categoryNo":95,"categoryName":96,"taxonomyType":97,"taxonomyTypeDesc":98},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":100,"categoryName":101,"taxonomyType":97,"taxonomyTypeDesc":98},"01JBSEEDCAT000000000000023","Skill与智能体开发",[103,104,105,106,107,108,109,110,23,111,112,113,114,115,116,117,118,119,120,121],"supabase","rls","supabase rls","supabase rls policies","project","when","review","change","write","security","isolation","tables","as","tests","prove","use","users","functions","with",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":129,"publishedAt":40},"01M70KWA5YWXDV6V8DZ19E3T2Y","skill-distribution-audit","Audit a skill collection before release or investigate installer omissions, archived\u002Ftemplate leakage, duplicate identities, and manifest drift. Reconcile the intended public source set, distribution manifest, and actual discovery output for a specified consumer version. Includes a deterministic set-comparison helper.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fskill-distribution-audit\u002FSKILL.md",[128],{"categoryNo":100,"categoryName":101,"taxonomyType":97,"taxonomyTypeDesc":98},[130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149],"distribution","skill distribution audit","audit","SET","deterministic","installer","for","discovery","comparison","helper","manifest","version","collection","drift","output","investigate","duplicate","template","release","reconcile",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":154,"sourceHtmlUrl":155,"categories":156,"keywords":162,"publishedAt":40},"01M70KCJPFVW7PPQ49CC5R8JGK","logicapps-custom-code-net10-migration","Migrate Azure Logic Apps Standard local-function custom-code projects from .NET 8 to .NET 10. Use for legacy Logic Apps custom-code workspace upgrades, project\u002Fpackage configuration, custom-worker settings, publication, and integrated VS Code debugging. Not for ordinary .NET applications, standalone Azure Functions, Consumption workflows, or cloud deployment.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Flogicapps-custom-code-net10-migration\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Flogicapps-custom-code-net10-migration\u002FSKILL.md",[157],{"categoryNo":158,"categoryName":159,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[163,164,165,166,167,168,136,107,169,170,171,172,173,174,175,118,176,177,178,179],"custom","code","logicapps custom code net10 migration","migration","projects","standalone","deployment","applications","local","azure","worker","upgrades","package","apps","Legacy","debugging","workflows",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":184,"sourceHtmlUrl":185,"categories":186,"keywords":191,"publishedAt":40},"01M6AEBN37RQMXJ3298PEY7PG1","winmd-api-search","Find and explore Windows desktop APIs. Use when building features that need platform capabilities — camera, file access, notifications, UI controls, AI\u002FML, sensors, networking, etc. Discovers the right API for a task and retrieves full type details (methods, properties, events, enumeration values).","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fwinmd-api-search\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fwinmd-api-search\u002FSKILL.md",[187,190],{"categoryNo":188,"categoryName":189,"taxonomyType":97,"taxonomyTypeDesc":98},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":158,"categoryName":159,"taxonomyType":160,"taxonomyTypeDesc":161},[192,193,194,195,196,197,198,199,200,201,32,202,203,204,205,108,206,207,208,209,210,136,211,212],"winmd api search","search","api","windows","desktop","file access","enumeration","ui","ml","file","capabilities","notifications","explore","access","features","full","camera","events","platform","methods","controls",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":217,"licenseFileUrl":218,"sourceHtmlUrl":219,"categories":220,"keywords":226,"publishedAt":40},"01M6AE571R3SC1ZGE202B3NB5S","resemble-detect","Deepfake detection and media safety — detect AI-generated audio, images, video, and text, trace synthesis sources, apply watermarks, verify speaker identity, and analyze media intelligence using Resemble AI","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fresemble-detect\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fresemble-detect\u002FSKILL.md",[221,222,225],{"categoryNo":188,"categoryName":189,"taxonomyType":97,"taxonomyTypeDesc":98},{"categoryNo":223,"categoryName":224,"taxonomyType":97,"taxonomyTypeDesc":98},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":100,"categoryName":101,"taxonomyType":97,"taxonomyTypeDesc":98},[227,133,201,228,229],"resemble detect","https","identity",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":217,"licenseFileUrl":234,"sourceHtmlUrl":235,"categories":236,"keywords":241,"publishedAt":40},"01M6AE30BSK2HCY4TQQ22Z8JRD","quality-playbook","Run a complete quality engineering audit on any codebase. Derives behavioral requirements from the code, generates spec-traced functional tests, runs a three-pass code review with regression tests, executes a multi-model spec audit (Council of Three), and produces a consolidated bug report with TDD-verified patches. Finds the 35% of real defects that structural code review alone cannot catch. Works with any language. Trigger on 'quality playbook', 'spec audit', 'Council of Three', 'fitness-to-purpose', or 'coverage theater'.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fquality-playbook\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fquality-playbook\u002FSKILL.md",[237,240],{"categoryNo":238,"categoryName":239,"taxonomyType":97,"taxonomyTypeDesc":98},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":100,"categoryName":101,"taxonomyType":97,"taxonomyTypeDesc":98},[242,243,244,245,164,109,9,132,246,247,228,248,249,250,251,252,253,254,255,256,257,258,116,259,260,261,262],"playbook","quality playbook","quality","code review","tdd","run","report","spec","bug report","council","engineering","functional","spec audit","bug","verified","multi-model","three","coverage","model","regression","structural"]