[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M77PB22PS002R0TYRTP6M9WC":3,"skill-same:01M77PB22PS002R0TYRTP6M9WC":46},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":24,"commitSha":25,"skillDirectory":26,"forksCount":27,"repositoryHtmlUrl":28,"repositoryHomepageUrl":6,"ownerHtmlUrl":29,"ownerBlogUrl":30,"ownerDescription":6,"updatedAt":31,"install":32,"resources":45},"01M77PB22PS002R0TYRTP6M9WC","aws-resource-query",null,"Query AWS resources using natural language. Covers EC2, S3, RDS, Lambda, ECS, EKS, Secrets Manager, IAM, VPC, networking, messaging, and more. Strictly read-only — no writes, deletes, or mutations.","Reihantt6\u002Fsns-myagent","Reihantt6","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F219822095?v=4","01M77KK94PV8B7C2D9XWXNS8DJ","Mohamad Reihan tegar prasetya","01M77KK958QFMTHYXGXFV7KZ79",2,"MIT","https:\u002F\u002Fgithub.com\u002FReihantt6\u002Fsns-myagent\u002Fblob\u002Fmain\u002Fagent\u002Fskills\u002Faws-resource-query\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\ndescription: \"Query AWS resources using natural language. Covers EC2, S3, RDS, Lambda, ECS, EKS, Secrets Manager, IAM, VPC, networking, messaging, and more. Strictly read-only — no writes, deletes, or mutations.\"\n---\n# AWS Resource Query\n\nAnswer natural language questions about AWS resources by translating intent into read-only AWS CLI commands. This skill **never** runs commands that create, modify, or delete resources.\n\n## Safety Contract\n\n**STRICTLY READ-ONLY.** This skill exclusively uses:\n- `aws \u003Cservice> describe-*`\n- `aws \u003Cservice> list-*`\n- `aws \u003Cservice> get-*`\n- `aws sts get-caller-identity`\n- `aws configure get`\n- `aws resourcegroupstaggingapi get-resources`\n- `aws ce get-*`\n- `aws support describe-*`\n\n**NEVER** run any of the following, regardless of what the user asks:\n`create-*`, `run-*`, `start-*`, `stop-*`, `reboot-*`, `delete-*`, `terminate-*`, `put-*`, `update-*`, `modify-*`, `attach-*`, `detach-*`, `send-*`, `publish-*`, `invoke-*`, `execute-*`\n\nIf the user's query implies a write action, respond:\n> \"This skill is read-only. I can show you the current state of [resource], but I cannot [create\u002Fmodify\u002Fdelete] it. Would you like to see what currently exists?\"\n\n## Workflow\n\n### Step 1: Parse Intent\nIdentify: target service(s), scope (all \u002F filtered \u002F specific), detail level, and region.\n\n### Step 2: Confirm Account & Region\n```bash\naws sts get-caller-identity --query '{Account:Account,UserId:UserId}'\naws configure get region\n```\nAppend `--region \u003Cregion>` to all commands when the user specifies one.\n\n### Step 3: Execute & Format\nRun the matched read-only command(s) below and format results as a readable table. For large result sets show a count first and offer to filter further.\n\n---\n\n## Intent → Command Mapping\n\n### COMPUTE\n\n#### EC2 Instances\n```bash\n# \"list EC2 instances\" \u002F \"show my VMs\" \u002F \"what instances are running\"\naws ec2 describe-instances \\\n  --query 'Reservations[].Instances[].[InstanceId,InstanceType,State.Name,Tags[?Key==`Name`].Value|[0],PrivateIpAddress,PublicIpAddress]' \\\n  --output table\n\n# \"running instances only\"\naws ec2 describe-instances --filters Name=instance-state-name,Values=running \\\n  --query 'Reservations[].Instances[].[InstanceId,InstanceType,Tags[?Key==`Name`].Value|[0],PrivateIpAddress]' \\\n  --output table\n\n# \"stopped instances\"\naws ec2 describe-instances --filters Name=instance-state-name,Values=stopped \\\n  --query 'Reservations[].Instances[].[InstanceId,InstanceType,Tags[?Key==`Name`].Value|[0]]' \\\n  --output table\n\n# \"instance types in use\"\naws ec2 describe-instances --query 'Reservations[].Instances[].InstanceType' --output text | sort | uniq -c | sort -rn\n\n# \"auto scaling groups\" \u002F \"ASGs\"\naws autoscaling describe-auto-scaling-groups \\\n  --query 'AutoScalingGroups[].[AutoScalingGroupName,MinSize,MaxSize,DesiredCapacity]' --output table\n\n# \"elastic IPs\" \u002F \"EIPs\"\naws ec2 describe-addresses \\\n  --query 'Addresses[].[PublicIp,InstanceId,AllocationId,AssociationId]' --output table\n\n# \"key pairs\"\naws ec2 describe-key-pairs \\\n  --query 'KeyPairs[].[KeyName,CreateTime]' --output table\n\n# \"AMIs I own\"\naws ec2 describe-images --owners self \\\n  --query 'Images[].[ImageId,Name,CreationDate,State]' --output table\n\n# \"spot instances\"\naws ec2 describe-spot-instance-requests \\\n  --query 'SpotInstanceRequests[].[SpotInstanceRequestId,State,InstanceId,LaunchSpecification.InstanceType]' --output table\n```\n\n#### Lambda Functions\n```bash\n# \"list Lambda functions\" \u002F \"show serverless functions\"\naws lambda list-functions \\\n  --query 'Functions[].[FunctionName,Runtime,MemorySize,Timeout,LastModified]' --output table\n\n# \"Lambda function details for \u003Cname>\"\naws lambda get-function-configuration --function-name \u003Cname>\n\n# \"Lambda event source mappings\" \u002F \"Lambda triggers\"\naws lambda list-event-source-mappings \\\n  --query 'EventSourceMappings[].[FunctionArn,EventSourceArn,State,BatchSize]' --output table\n\n# \"Lambda layers\"\naws lambda list-layers \\\n  --query 'Layers[].[LayerName,LatestMatchingVersion.LayerVersionArn]' --output table\n\n# \"Lambda concurrency for \u003Cname>\"\naws lambda get-function-concurrency --function-name \u003Cname>\n```\n\n#### ECS\n```bash\n# \"ECS clusters\"\naws ecs list-clusters --query 'clusterArns' --output table\n\n# \"ECS cluster details\"\naws ecs describe-clusters \\\n  --clusters $(aws ecs list-clusters --query 'clusterArns[]' --output text) \\\n  --query 'clusters[].[clusterName,status,runningTasksCount,activeServicesCount]' --output table\n\n# \"ECS services in \u003Ccluster>\"\naws ecs describe-services --cluster \u003Ccluster> \\\n  --services $(aws ecs list-services --cluster \u003Ccluster> --query 'serviceArns[]' --output text) \\\n  --query 'services[].[serviceName,status,runningCount,desiredCount]' --output table\n\n# \"ECS task definitions\"\naws ecs list-task-definitions --query 'taskDefinitionArns' --output table\n```\n\n#### EKS\n```bash\n# \"EKS clusters\" \u002F \"Kubernetes clusters\"\naws eks list-clusters --query 'clusters' --output table\n\n# \"EKS cluster details for \u003Cname>\"\naws eks describe-cluster --name \u003Cname> \\\n  --query 'cluster.[name,status,version,endpoint]'\n\n# \"EKS node groups for \u003Ccluster>\"\naws eks list-nodegroups --cluster-name \u003Cname> --query 'nodegroups' --output table\n\n# \"EKS add-ons for \u003Ccluster>\"\naws eks list-addons --cluster-name \u003Cname> --query 'addons' --output table\n```\n\n#### Other Compute\n```bash\n# \"Beanstalk environments\"\naws elasticbeanstalk describe-environments \\\n  --query 'Environments[].[EnvironmentName,ApplicationName,Status,Health]' --output table\n\n# \"Batch job queues\"\naws batch describe-job-queues \\\n  --query 'jobQueues[].[jobQueueName,state,status,priority]' --output table\n\n# \"Batch compute environments\"\naws batch describe-compute-environments \\\n  --query 'computeEnvironments[].[computeEnvironmentName,type,state,status]' --output table\n```\n\n---\n\n### STORAGE\n\n#### S3\n```bash\n# \"list S3 buckets\" \u002F \"show my buckets\"\naws s3api list-buckets --query 'Buckets[].[Name,CreationDate]' --output table\n\n# \"S3 bucket encryption for \u003Cname>\"\naws s3api get-bucket-encryption --bucket \u003Cname>\n\n# \"S3 bucket versioning for \u003Cname>\"\naws s3api get-bucket-versioning --bucket \u003Cname>\n\n# \"S3 public access settings for \u003Cname>\"\naws s3api get-public-access-block --bucket \u003Cname>\n\n# \"S3 lifecycle rules for \u003Cname>\"\naws s3api get-bucket-lifecycle-configuration --bucket \u003Cname>\n\n# \"S3 bucket policy for \u003Cname>\"\naws s3api get-bucket-policy --bucket \u003Cname>\n\n# \"list objects in s3:\u002F\u002F\u003Cbucket>\u002F\u003Cprefix>\"\naws s3api list-objects-v2 --bucket \u003Cbucket> --prefix \u003Cprefix> \\\n  --query 'Contents[].[Key,Size,LastModified,StorageClass]' --output table\n```\n\n#### EBS & EFS\n```bash\n# \"EBS volumes\" \u002F \"list volumes\"\naws ec2 describe-volumes \\\n  --query 'Volumes[].[VolumeId,Size,VolumeType,State,AvailabilityZone,Attachments[0].InstanceId]' --output table\n\n# \"unattached EBS volumes\" \u002F \"unused volumes\"\naws ec2 describe-volumes --filters Name=status,Values=available \\\n  --query 'Volumes[].[VolumeId,Size,VolumeType,CreateTime]' --output table\n\n# \"EBS snapshots I own\"\naws ec2 describe-snapshots --owner-ids self \\\n  --query 'Snapshots[].[SnapshotId,VolumeId,State,StartTime]' --output table\n\n# \"EFS file systems\"\naws efs describe-file-systems \\\n  --query 'FileSystems[].[FileSystemId,Name,LifeCycleState,SizeInBytes.Value,ThroughputMode]' --output table\n```\n\n---\n\n### DATABASES\n\n#### RDS\n```bash\n# \"list RDS instances\" \u002F \"show databases\" \u002F \"what databases do I have\"\naws rds describe-db-instances \\\n  --query 'DBInstances[].[DBInstanceIdentifier,DBInstanceClass,Engine,EngineVersion,DBInstanceStatus,MultiAZ,Endpoint.Address]' \\\n  --output table\n\n# \"Aurora clusters\" \u002F \"RDS clusters\"\naws rds describe-db-clusters \\\n  --query 'DBClusters[].[DBClusterIdentifier,Engine,EngineVersion,Status,MultiAZ,Endpoint]' --output table\n\n# \"RDS snapshots\"\naws rds describe-db-snapshots \\\n  --query 'DBSnapshots[].[DBSnapshotIdentifier,DBInstanceIdentifier,Engine,Status,SnapshotCreateTime]' --output table\n\n# \"RDS parameter groups\"\naws rds describe-db-parameter-groups \\\n  --query 'DBParameterGroups[].[DBParameterGroupName,DBParameterGroupFamily]' --output table\n\n# \"RDS subnet groups\"\naws rds describe-db-subnet-groups \\\n  --query 'DBSubnetGroups[].[DBSubnetGroupName,VpcId]' --output table\n```\n\n#### DynamoDB\n```bash\n# \"DynamoDB tables\" \u002F \"list NoSQL tables\"\naws dynamodb list-tables --query 'TableNames' --output table\n\n# \"DynamoDB table details for \u003Cname>\"\naws dynamodb describe-table --table-name \u003Cname> \\\n  --query 'Table.[TableName,TableStatus,ItemCount,BillingModeSummary.BillingMode]'\n\n# \"DynamoDB backups\"\naws dynamodb list-backups \\\n  --query 'BackupSummaries[].[TableName,BackupName,BackupStatus,BackupCreationDateTime]' --output table\n\n# \"DynamoDB global tables\"\naws dynamodb list-global-tables \\\n  --query 'GlobalTables[].[GlobalTableName,ReplicationGroup[].RegionName]' --output table\n```\n\n#### ElastiCache & Redshift\n```bash\n# \"ElastiCache clusters\" \u002F \"Redis clusters\"\naws elasticache describe-cache-clusters \\\n  --query 'CacheClusters[].[CacheClusterId,Engine,EngineVersion,CacheNodeType,CacheClusterStatus]' --output table\n\n# \"ElastiCache replication groups\"\naws elasticache describe-replication-groups \\\n  --query 'ReplicationGroups[].[ReplicationGroupId,Status,AutomaticFailover]' --output table\n\n# \"Redshift clusters\" \u002F \"data warehouse\"\naws redshift describe-clusters \\\n  --query 'Clusters[].[ClusterIdentifier,ClusterStatus,NodeType,NumberOfNodes,Endpoint.Address]' --output table\n\n# \"DocumentDB clusters\"\naws docdb describe-db-clusters \\\n  --query 'DBClusters[].[DBClusterIdentifier,Status,Engine,Endpoint]' --output table\n\n# \"Neptune clusters\" \u002F \"graph databases\"\naws neptune describe-db-clusters \\\n  --query 'DBClusters[].[DBClusterIdentifier,Status,Engine,Endpoint]' --output table\n```\n\n---\n\n### NETWORKING\n\n#### VPC & Subnets\n```bash\n# \"list VPCs\" \u002F \"show my VPCs\"\naws ec2 describe-vpcs \\\n  --query 'Vpcs[].[VpcId,CidrBlock,IsDefault,Tags[?Key==`Name`].Value|[0],State]' --output table\n\n# \"subnets\" \u002F \"list subnets\"\naws ec2 describe-subnets \\\n  --query 'Subnets[].[SubnetId,VpcId,CidrBlock,AvailabilityZone,MapPublicIpOnLaunch,Tags[?Key==`Name`].Value|[0]]' --output table\n\n# \"public subnets\"\naws ec2 describe-subnets --filters \"Name=mapPublicIpOnLaunch,Values=true\" \\\n  --query 'Subnets[].[SubnetId,VpcId,CidrBlock,AvailabilityZone]' --output table\n\n# \"security groups\"\naws ec2 describe-security-groups \\\n  --query 'SecurityGroups[].[GroupId,GroupName,VpcId,Description]' --output table\n\n# \"security group rules for \u003Cgroup-id>\"\naws ec2 describe-security-group-rules --filters \"Name=group-id,Values=\u003Cid>\" \\\n  --query 'SecurityGroupRules[].[IsEgress,IpProtocol,FromPort,ToPort,CidrIpv4,Description]' --output table\n\n# \"route tables\"\naws ec2 describe-route-tables \\\n  --query 'RouteTables[].[RouteTableId,VpcId,Associations[0].SubnetId,Tags[?Key==`Name`].Value|[0]]' --output table\n\n# \"internet gateways\" \u002F \"IGWs\"\naws ec2 describe-internet-gateways \\\n  --query 'InternetGateways[].[InternetGatewayId,Attachments[0].VpcId,Tags[?Key==`Name`].Value|[0]]' --output table\n\n# \"NAT gateways\"\naws ec2 describe-nat-gateways \\\n  --query 'NatGateways[].[NatGatewayId,VpcId,SubnetId,State,NatGatewayAddresses[0].PublicIp]' --output table\n\n# \"VPC endpoints\"\naws ec2 describe-vpc-endpoints \\\n  --query 'VpcEndpoints[].[VpcEndpointId,VpcId,ServiceName,State,VpcEndpointType]' --output table\n\n# \"VPC peering connections\"\naws ec2 describe-vpc-peering-connections \\\n  --query 'VpcPeeringConnections[].[VpcPeeringConnectionId,Status.Code,RequesterVpcInfo.VpcId,AccepterVpcInfo.VpcId]' --output table\n\n# \"NACLs\" \u002F \"network ACLs\"\naws ec2 describe-network-acls \\\n  --query 'NetworkAcls[].[NetworkAclId,VpcId,IsDefault]' --output table\n\n# \"Transit Gateways\"\naws ec2 describe-transit-gateways \\\n  --query 'TransitGateways[].[TransitGatewayId,State,Description]' --output table\n```\n\n#### Load Balancers & DNS\n```bash\n# \"load balancers\" \u002F \"ALBs\" \u002F \"NLBs\"\naws elbv2 describe-load-balancers \\\n  --query 'LoadBalancers[].[LoadBalancerName,Type,Scheme,State.Code,DNSName]' --output table\n\n# \"target groups\"\naws elbv2 describe-target-groups \\\n  --query 'TargetGroups[].[TargetGroupName,Protocol,Port,TargetType,VpcId]' --output table\n\n# \"target health for \u003Ctarget-group-arn>\"\naws elbv2 describe-target-health --target-group-arn \u003Carn> \\\n  --query 'TargetHealthDescriptions[].[Target.Id,TargetHealth.State,TargetHealth.Description]' --output table\n\n# \"Route 53 hosted zones\" \u002F \"DNS zones\"\naws route53 list-hosted-zones \\\n  --query 'HostedZones[].[Id,Name,Config.PrivateZone,ResourceRecordSetCount]' --output table\n\n# \"DNS records in zone \u003Cid>\"\naws route53 list-resource-record-sets --hosted-zone-id \u003Cid> \\\n  --query 'ResourceRecordSets[].[Name,Type,TTL]' --output table\n\n# \"CloudFront distributions\"\naws cloudfront list-distributions \\\n  --query 'DistributionList.Items[].[Id,DomainName,Status,Origins.Items[0].DomainName]' --output table\n\n# \"VPN connections\"\naws ec2 describe-vpn-connections \\\n  --query 'VpnConnections[].[VpnConnectionId,State,Type,CustomerGatewayId]' --output table\n\n# \"Direct Connect connections\"\naws directconnect describe-connections \\\n  --query 'connections[].[connectionId,connectionName,connectionState,bandwidth]' --output table\n```\n\n---\n\n### SECURITY & IDENTITY\n\n#### IAM\n```bash\n# \"IAM users\" \u002F \"list users\"\naws iam list-users \\\n  --query 'Users[].[UserName,UserId,CreateDate,PasswordLastUsed]' --output table\n\n# \"IAM roles\" \u002F \"list roles\"\naws iam list-roles \\\n  --query 'Roles[].[RoleName,RoleId,CreateDate]' --output table\n\n# \"IAM policies attached to role \u003Cname>\"\naws iam list-attached-role-policies --role-name \u003Cname> \\\n  --query 'AttachedPolicies[].[PolicyName,PolicyArn]' --output table\n\n# \"IAM groups\"\naws iam list-groups \\\n  --query 'Groups[].[GroupName,GroupId,CreateDate]' --output table\n\n# \"IAM policies (customer managed)\"\naws iam list-policies --scope Local \\\n  --query 'Policies[].[PolicyName,AttachmentCount,CreateDate]' --output table\n\n# \"who has MFA enabled\" \u002F \"MFA devices\"\naws iam list-virtual-mfa-devices \\\n  --query 'VirtualMFADevices[].[SerialNumber,User.UserName,EnableDate]' --output table\n\n# \"IAM account password policy\"\naws iam get-account-password-policy\n\n# \"IAM account summary\"\naws iam get-account-summary\n```\n\n#### Secrets Manager\n```bash\n# \"list secrets\" \u002F \"Secrets Manager secrets\" \u002F \"show secrets\"\naws secretsmanager list-secrets \\\n  --query 'SecretList[].[Name,ARN,LastChangedDate,LastAccessedDate,Description]' --output table\n\n# \"secret metadata for \u003Cname>\"\naws secretsmanager describe-secret --secret-id \u003Cname> \\\n  --query '{Name:Name,ARN:ARN,RotationEnabled:RotationEnabled,LastRotatedDate:LastRotatedDate,Tags:Tags}'\n\n# \"secrets with rotation enabled\"\naws secretsmanager list-secrets \\\n  --query 'SecretList[?RotationEnabled==`true`].[Name,LastRotatedDate]' --output table\n```\n\n> ⚠️ **Note**: Secret **values** are never retrieved (`get-secret-value` is excluded). Only metadata is shown.\n\n#### SSM Parameter Store\n```bash\n# \"SSM parameters\" \u002F \"Parameter Store\"\naws ssm describe-parameters \\\n  --query 'Parameters[].[Name,Type,LastModifiedDate,Description]' --output table\n\n# \"SSM parameters by path \u003Cpath>\"\naws ssm describe-parameters \\\n  --parameter-filters \"Key=Path,Values=\u003Cpath>\" \\\n  --query 'Parameters[].[Name,Type,LastModifiedDate]' --output table\n```\n\n> ⚠️ **Note**: Parameter **values** are never retrieved (`get-parameter` is excluded). Only metadata is shown.\n\n#### KMS & Certificates\n```bash\n# \"KMS keys\" \u002F \"encryption keys\"\naws kms list-keys --query 'Keys[].[KeyId,KeyArn]' --output table\n\n# \"KMS key details for \u003Cid>\"\naws kms describe-key --key-id \u003Cid> \\\n  --query 'KeyMetadata.[KeyId,Description,KeyState,KeyUsage,CreationDate,Enabled]'\n\n# \"KMS aliases\"\naws kms list-aliases \\\n  --query 'Aliases[].[AliasName,AliasArn,TargetKeyId]' --output table\n\n# \"SSL certificates\" \u002F \"ACM certificates\"\naws acm list-certificates \\\n  --query 'CertificateSummaryList[].[CertificateArn,DomainName,Status,RenewalEligibility]' --output table\n\n# \"certificate details for \u003Carn>\"\naws acm describe-certificate --certificate-arn \u003Carn> \\\n  --query 'Certificate.[DomainName,Status,NotAfter,NotBefore,InUseBy]'\n```\n\n#### GuardDuty, Security Hub & Config\n```bash\n# \"GuardDuty detectors\"\naws guardduty list-detectors --query 'DetectorIds' --output table\n\n# \"GuardDuty findings\"\naws guardduty list-findings --detector-id \u003Cid> --query 'FindingIds' --output table\n\n# \"Security Hub findings\"\naws securityhub get-findings \\\n  --query 'Findings[].[Title,Severity.Label,WorkflowState,UpdatedAt]' --output table\n\n# \"AWS Config rules\"\naws configservice describe-config-rules \\\n  --query 'ConfigRules[].[ConfigRuleName,ConfigRuleState,Source.SourceIdentifier]' --output table\n\n# \"non-compliant resources\"\naws configservice get-compliance-summary-by-config-rule \\\n  --query 'ComplianceSummariesByConfigRule[].[ConfigRuleName,Compliance.ComplianceType]' --output table\n```\n\n---\n\n### MESSAGING & EVENTS\n\n```bash\n# \"SQS queues\" \u002F \"list queues\"\naws sqs list-queues --query 'QueueUrls' --output table\n\n# \"SQS queue details \u002F message count for \u003Curl>\"\naws sqs get-queue-attributes --queue-url \u003Curl> \\\n  --attribute-names ApproximateNumberOfMessages,ApproximateNumberOfMessagesNotVisible,ApproximateAgeOfOldestMessage\n\n# \"SNS topics\"\naws sns list-topics --query 'Topics[].TopicArn' --output table\n\n# \"SNS subscriptions\"\naws sns list-subscriptions \\\n  --query 'Subscriptions[].[SubscriptionArn,Protocol,Endpoint,TopicArn]' --output table\n\n# \"EventBridge rules\"\naws events list-rules \\\n  --query 'Rules[].[Name,State,ScheduleExpression,EventPattern]' --output table\n\n# \"EventBridge event buses\"\naws events list-event-buses \\\n  --query 'EventBuses[].[Name,Arn]' --output table\n\n# \"Kinesis streams\"\naws kinesis list-streams --query 'StreamNames' --output table\n\n# \"Kinesis Firehose delivery streams\"\naws firehose list-delivery-streams --query 'DeliveryStreamNames' --output table\n```\n\n---\n\n### API GATEWAY & SERVERLESS\n\n```bash\n# \"API Gateway APIs\" \u002F \"REST APIs\"\naws apigateway get-rest-apis \\\n  --query 'items[].[id,name,description,createdDate]' --output table\n\n# \"HTTP APIs\" \u002F \"API Gateway v2\"\naws apigatewayv2 get-apis \\\n  --query 'Items[].[ApiId,Name,ProtocolType,ApiEndpoint,CreatedDate]' --output table\n\n# \"Step Functions state machines\" \u002F \"workflows\"\naws stepfunctions list-state-machines \\\n  --query 'stateMachines[].[name,stateMachineArn,type,creationDate]' --output table\n\n# \"Step Functions executions for \u003Carn>\"\naws stepfunctions list-executions --state-machine-arn \u003Carn> \\\n  --query 'executions[].[name,status,startDate,stopDate]' --output table\n```\n\n---\n\n### MONITORING & OBSERVABILITY\n\n```bash\n# \"CloudWatch alarms\" \u002F \"list alarms\"\naws cloudwatch describe-alarms \\\n  --query 'MetricAlarms[].[AlarmName,StateValue,MetricName,Namespace,Threshold]' --output table\n\n# \"alarms in ALARM state\" \u002F \"triggered alarms\"\naws cloudwatch describe-alarms --state-value ALARM \\\n  --query 'MetricAlarms[].[AlarmName,MetricName,StateReason]' --output table\n\n# \"CloudWatch dashboards\"\naws cloudwatch list-dashboards \\\n  --query 'DashboardEntries[].[DashboardName,LastModified,Size]' --output table\n\n# \"CloudWatch log groups\"\naws logs describe-log-groups \\\n  --query 'logGroups[].[logGroupName,retentionInDays,storedBytes]' --output table\n\n# \"CloudTrail trails\"\naws cloudtrail describe-trails \\\n  --query 'trailList[].[Name,S3BucketName,IsMultiRegionTrail,LogFileValidationEnabled]' --output table\n\n# \"ECR repositories\" \u002F \"container registries\"\naws ecr describe-repositories \\\n  --query 'repositories[].[repositoryName,repositoryUri,createdAt]' --output table\n```\n\n---\n\n### COST & BILLING\n\n```bash\n# \"current month cost\" \u002F \"how much am I spending\"\naws ce get-cost-and-usage \\\n  --time-period Start=$(date -u +%Y-%m-01),End=$(date -u +%Y-%m-%d) \\\n  --granularity MONTHLY --metrics BlendedCost \\\n  --query 'ResultsByTime[].[TimePeriod.Start,Total.BlendedCost.Amount,Total.BlendedCost.Unit]' \\\n  --output table\n\n# \"cost by service\" \u002F \"spending breakdown\"\naws ce get-cost-and-usage \\\n  --time-period Start=$(date -u -d '30 days ago' +%Y-%m-%d),End=$(date -u +%Y-%m-%d) \\\n  --granularity MONTHLY --metrics BlendedCost \\\n  --group-by Type=DIMENSION,Key=SERVICE --output table\n\n# \"AWS Budgets\"\naws budgets describe-budgets \\\n  --account-id $(aws sts get-caller-identity --query Account --output text) \\\n  --query 'Budgets[].[BudgetName,BudgetType,BudgetLimit.Amount,CalculatedSpend.ActualSpend.Amount]' \\\n  --output table\n\n# \"Trusted Advisor recommendations\"\naws support describe-trusted-advisor-checks --language en \\\n  --query 'checks[].[id,name,category]' --output table\n```\n\n---\n\n### CROSS-SERVICE QUERIES\n\n```bash\n# \"resources tagged Environment=production\" \u002F \"all production resources\"\naws resourcegroupstaggingapi get-resources \\\n  --tag-filters Key=Environment,Values=production \\\n  --query 'ResourceTagMappingList[].[ResourceARN]' --output table\n\n# \"all resources tagged \u003Ckey>=\u003Cvalue>\"\naws resourcegroupstaggingapi get-resources \\\n  --tag-filters Key=\u003Ckey>,Values=\u003Cvalue> \\\n  --query 'ResourceTagMappingList[].[ResourceARN,Tags]' --output table\n\n# \"inventory of all resources\" (AWS Config)\naws configservice list-discovered-resources --resource-type \u003Ctype> \\\n  --query 'resourceIdentifiers[].[resourceType,resourceId,resourceName]' --output table\n```\n\n---\n\n## Output Formatting Rules\n\n1. Always use `--output table` for list results; use `--output json` only when deep detail is explicitly requested\n2. Always use `--query` to extract only relevant fields — never dump raw JSON\n3. For large result sets (>20 items), show a count first, then offer to filter\n4. When a command returns nothing, explain why (wrong region, no resources, insufficient permissions)\n5. Offer to drill into a specific resource: \"Found 47 EC2 instances. Filter by state, type, or tag?\"\n\n## Error Handling\n\n| Error | Response |\n|---|---|\n| `AccessDenied` | \"You don't have permission to list [resource]. Required: `\u003Cservice>:\u003CAction>`.\" |\n| `NoCredentialProviders` | \"Run `aws configure` or set `AWS_PROFILE`.\" |\n| Empty result | \"No [resources] found in [region]. Check another region?\" |\n| Invalid identifier | \"Could not find '[name]'. Check the name or provide the resource ID.\" |\n","# AWS Resource Query\n\nAnswer natural language questions about AWS resources by translating intent into read-only AWS CLI commands. This skill **never** runs commands that create, modify, or delete resources.\n\n## Safety Contract\n\n**STRICTLY READ-ONLY.** This skill exclusively uses:\n- `aws \u003Cservice> describe-*`\n- `aws \u003Cservice> list-*`\n- `aws \u003Cservice> get-*`\n- `aws sts get-caller-identity`\n- `aws configure get`\n- `aws resourcegroupstaggingapi get-resources`\n- `aws ce get-*`\n- `aws support describe-*`\n\n**NEVER** run any of the following, regardless of what the user asks:\n`create-*`, `run-*`, `start-*`, `stop-*`, `reboot-*`, `delete-*`, `terminate-*`, `put-*`, `update-*`, `modify-*`, `attach-*`, `detach-*`, `send-*`, `publish-*`, `invoke-*`, `execute-*`\n\nIf the user's query implies a write action, respond:\n> \"This skill is read-only. I can show you the current state of [resource], but I cannot [create\u002Fmodify\u002Fdelete] it. Would you like to see what currently exists?\"\n\n## Workflow\n\n### Step 1: Parse Intent\nIdentify: target service(s), scope (all \u002F filtered \u002F specific), detail level, and region.\n\n### Step 2: Confirm Account & Region\n```bash\naws sts get-caller-identity --query '{Account:Account,UserId:UserId}'\naws configure get region\n```\nAppend `--region \u003Cregion>` to all commands when the user specifies one.\n\n### Step 3: Execute & Format\nRun the matched read-only command(s) below and format results as a readable table. For large result sets show a count first and offer to filter further.\n\n---\n\n## Intent → Command Mapping\n\n### COMPUTE\n\n#### EC2 Instances\n```bash\n# \"list EC2 instances\" \u002F \"show my VMs\" \u002F \"what instances are running\"\naws ec2 describe-instances \\\n  --query 'Reservations[].Instances[].[InstanceId,InstanceType,State.Name,Tags[?Key==`Name`].Value|[0],PrivateIpAddress,PublicIpAddress]' \\\n  --output table\n\n# \"running instances only\"\naws ec2 describe-instances --filters Name=instance-state-name,Values=running \\\n  --query 'Reservations[].Instances[].[InstanceId,InstanceType,Tags[?Key==`Name`].Value|[0],PrivateIpAddress]' \\\n  --output table\n\n# \"stopped instances\"\naws ec2 describe-instances --filters Name=instance-state-name,Values=stopped \\\n  --query 'Reservations[].Instances[].[InstanceId,InstanceType,Tags[?Key==`Name`].Value|[0]]' \\\n  --output table\n\n# \"instance types in use\"\naws ec2 describe-instances --query 'Reservations[].Instances[].InstanceType' --output text | sort | uniq -c | sort -rn\n\n# \"auto scaling groups\" \u002F \"ASGs\"\naws autoscaling describe-auto-scaling-groups \\\n  --query 'AutoScalingGroups[].[AutoScalingGroupName,MinSize,MaxSize,DesiredCapacity]' --output table\n\n# \"elastic IPs\" \u002F \"EIPs\"\naws ec2 describe-addresses \\\n  --query 'Addresses[].[PublicIp,InstanceId,AllocationId,AssociationId]' --output table\n\n# \"key pairs\"\naws ec2 describe-key-pairs \\\n  --query 'KeyPairs[].[KeyName,CreateTime]' --output table\n\n# \"AMIs I own\"\naws ec2 describe-images --owners self \\\n  --query 'Images[].[ImageId,Name,CreationDate,State]' --output table\n\n# \"spot instances\"\naws ec2 describe-spot-instance-requests \\\n  --query 'SpotInstanceRequests[].[SpotInstanceRequestId,State,InstanceId,LaunchSpecification.InstanceType]' --output table\n```\n\n#### Lambda Functions\n```bash\n# \"list Lambda functions\" \u002F \"show serverless functions\"\naws lambda list-functions \\\n  --query 'Functions[].[FunctionName,Runtime,MemorySize,Timeout,LastModified]' --output table\n\n# \"Lambda function details for \u003Cname>\"\naws lambda get-function-configuration --function-name \u003Cname>\n\n# \"Lambda event source mappings\" \u002F \"Lambda triggers\"\naws lambda list-event-source-mappings \\\n  --query 'EventSourceMappings[].[FunctionArn,EventSourceArn,State,BatchSize]' --output table\n\n# \"Lambda layers\"\naws lambda list-layers \\\n  --query 'Layers[].[LayerName,LatestMatchingVersion.LayerVersionArn]' --output table\n\n# \"Lambda concurrency for \u003Cname>\"\naws lambda get-function-concurrency --function-name \u003Cname>\n```\n\n#### ECS\n```bash\n# \"ECS clusters\"\naws ecs list-clusters --query 'clusterArns' --output table\n\n# \"ECS cluster details\"\naws ecs describe-clusters \\\n  --clusters $(aws ecs list-clusters --query 'clusterArns[]' --output text) \\\n  --query 'clusters[].[clusterName,status,runningTasksCount,activeServicesCount]' --output table\n\n# \"ECS services in \u003Ccluster>\"\naws ecs describe-services --cluster \u003Ccluster> \\\n  --services $(aws ecs list-services --cluster \u003Ccluster> --query 'serviceArns[]' --output text) \\\n  --query 'services[].[serviceName,status,runningCount,desiredCount]' --output table\n\n# \"ECS task definitions\"\naws ecs list-task-definitions --query 'taskDefinitionArns' --output table\n```\n\n#### EKS\n```bash\n# \"EKS clusters\" \u002F \"Kubernetes clusters\"\naws eks list-clusters --query 'clusters' --output table\n\n# \"EKS cluster details for \u003Cname>\"\naws eks describe-cluster --name \u003Cname> \\\n  --query 'cluster.[name,status,version,endpoint]'\n\n# \"EKS node groups for \u003Ccluster>\"\naws eks list-nodegroups --cluster-name \u003Cname> --query 'nodegroups' --output table\n\n# \"EKS add-ons for \u003Ccluster>\"\naws eks list-addons --cluster-name \u003Cname> --query 'addons' --output table\n```\n\n#### Other Compute\n```bash\n# \"Beanstalk environments\"\naws elasticbeanstalk describe-environments \\\n  --query 'Environments[].[EnvironmentName,ApplicationName,Status,Health]' --output table\n\n# \"Batch job queues\"\naws batch describe-job-queues \\\n  --query 'jobQueues[].[jobQueueName,state,status,priority]' --output table\n\n# \"Batch compute environments\"\naws batch describe-compute-environments \\\n  --query 'computeEnvironments[].[computeEnvironmentName,type,state,status]' --output table\n```\n\n---\n\n### STORAGE\n\n#### S3\n```bash\n# \"list S3 buckets\" \u002F \"show my buckets\"\naws s3api list-buckets --query 'Buckets[].[Name,CreationDate]' --output table\n\n# \"S3 bucket encryption for \u003Cname>\"\naws s3api get-bucket-encryption --bucket \u003Cname>\n\n# \"S3 bucket versioning for \u003Cname>\"\naws s3api get-bucket-versioning --bucket \u003Cname>\n\n# \"S3 public access settings for \u003Cname>\"\naws s3api get-public-access-block --bucket \u003Cname>\n\n# \"S3 lifecycle rules for \u003Cname>\"\naws s3api get-bucket-lifecycle-configuration --bucket \u003Cname>\n\n# \"S3 bucket policy for \u003Cname>\"\naws s3api get-bucket-policy --bucket \u003Cname>\n\n# \"list objects in s3:\u002F\u002F\u003Cbucket>\u002F\u003Cprefix>\"\naws s3api list-objects-v2 --bucket \u003Cbucket> --prefix \u003Cprefix> \\\n  --query 'Contents[].[Key,Size,LastModified,StorageClass]' --output table\n```\n\n#### EBS & EFS\n```bash\n# \"EBS volumes\" \u002F \"list volumes\"\naws ec2 describe-volumes \\\n  --query 'Volumes[].[VolumeId,Size,VolumeType,State,AvailabilityZone,Attachments[0].InstanceId]' --output table\n\n# \"unattached EBS volumes\" \u002F \"unused volumes\"\naws ec2 describe-volumes --filters Name=status,Values=available \\\n  --query 'Volumes[].[VolumeId,Size,VolumeType,CreateTime]' --output table\n\n# \"EBS snapshots I own\"\naws ec2 describe-snapshots --owner-ids self \\\n  --query 'Snapshots[].[SnapshotId,VolumeId,State,StartTime]' --output table\n\n# \"EFS file systems\"\naws efs describe-file-systems \\\n  --query 'FileSystems[].[FileSystemId,Name,LifeCycleState,SizeInBytes.Value,ThroughputMode]' --output table\n```\n\n---\n\n### DATABASES\n\n#### RDS\n```bash\n# \"list RDS instances\" \u002F \"show databases\" \u002F \"what databases do I have\"\naws rds describe-db-instances \\\n  --query 'DBInstances[].[DBInstanceIdentifier,DBInstanceClass,Engine,EngineVersion,DBInstanceStatus,MultiAZ,Endpoint.Address]' \\\n  --output table\n\n# \"Aurora clusters\" \u002F \"RDS clusters\"\naws rds describe-db-clusters \\\n  --query 'DBClusters[].[DBClusterIdentifier,Engine,EngineVersion,Status,MultiAZ,Endpoint]' --output table\n\n# \"RDS snapshots\"\naws rds describe-db-snapshots \\\n  --query 'DBSnapshots[].[DBSnapshotIdentifier,DBInstanceIdentifier,Engine,Status,SnapshotCreateTime]' --output table\n\n# \"RDS parameter groups\"\naws rds describe-db-parameter-groups \\\n  --query 'DBParameterGroups[].[DBParameterGroupName,DBParameterGroupFamily]' --output table\n\n# \"RDS subnet groups\"\naws rds describe-db-subnet-groups \\\n  --query 'DBSubnetGroups[].[DBSubnetGroupName,VpcId]' --output table\n```\n\n#### DynamoDB\n```bash\n# \"DynamoDB tables\" \u002F \"list NoSQL tables\"\naws dynamodb list-tables --query 'TableNames' --output table\n\n# \"DynamoDB table details for \u003Cname>\"\naws dynamodb describe-table --table-name \u003Cname> \\\n  --query 'Table.[TableName,TableStatus,ItemCount,BillingModeSummary.BillingMode]'\n\n# \"DynamoDB backups\"\naws dynamodb list-backups \\\n  --query 'BackupSummaries[].[TableName,BackupName,BackupStatus,BackupCreationDateTime]' --output table\n\n# \"DynamoDB global tables\"\naws dynamodb list-global-tables \\\n  --query 'GlobalTables[].[GlobalTableName,ReplicationGroup[].RegionName]' --output table\n```\n\n#### ElastiCache & Redshift\n```bash\n# \"ElastiCache clusters\" \u002F \"Redis clusters\"\naws elasticache describe-cache-clusters \\\n  --query 'CacheClusters[].[CacheClusterId,Engine,EngineVersion,CacheNodeType,CacheClusterStatus]' --output table\n\n# \"ElastiCache replication groups\"\naws elasticache describe-replication-groups \\\n  --query 'ReplicationGroups[].[ReplicationGroupId,Status,AutomaticFailover]' --output table\n\n# \"Redshift clusters\" \u002F \"data warehouse\"\naws redshift describe-clusters \\\n  --query 'Clusters[].[ClusterIdentifier,ClusterStatus,NodeType,NumberOfNodes,Endpoint.Address]' --output table\n\n# \"DocumentDB clusters\"\naws docdb describe-db-clusters \\\n  --query 'DBClusters[].[DBClusterIdentifier,Status,Engine,Endpoint]' --output table\n\n# \"Neptune clusters\" \u002F \"graph databases\"\naws neptune describe-db-clusters \\\n  --query 'DBClusters[].[DBClusterIdentifier,Status,Engine,Endpoint]' --output table\n```\n\n---\n\n### NETWORKING\n\n#### VPC & Subnets\n```bash\n# \"list VPCs\" \u002F \"show my VPCs\"\naws ec2 describe-vpcs \\\n  --query 'Vpcs[].[VpcId,CidrBlock,IsDefault,Tags[?Key==`Name`].Value|[0],State]' --output table\n\n# \"subnets\" \u002F \"list subnets\"\naws ec2 describe-subnets \\\n  --query 'Subnets[].[SubnetId,VpcId,CidrBlock,AvailabilityZone,MapPublicIpOnLaunch,Tags[?Key==`Name`].Value|[0]]' --output table\n\n# \"public subnets\"\naws ec2 describe-subnets --filters \"Name=mapPublicIpOnLaunch,Values=true\" \\\n  --query 'Subnets[].[SubnetId,VpcId,CidrBlock,AvailabilityZone]' --output table\n\n# \"security groups\"\naws ec2 describe-security-groups \\\n  --query 'SecurityGroups[].[GroupId,GroupName,VpcId,Description]' --output table\n\n# \"security group rules for \u003Cgroup-id>\"\naws ec2 describe-security-group-rules --filters \"Name=group-id,Values=\u003Cid>\" \\\n  --query 'SecurityGroupRules[].[IsEgress,IpProtocol,FromPort,ToPort,CidrIpv4,Description]' --output table\n\n# \"route tables\"\naws ec2 describe-route-tables \\\n  --query 'RouteTables[].[RouteTableId,VpcId,Associations[0].SubnetId,Tags[?Key==`Name`].Value|[0]]' --output table\n\n# \"internet gateways\" \u002F \"IGWs\"\naws ec2 describe-internet-gateways \\\n  --query 'InternetGateways[].[InternetGatewayId,Attachments[0].VpcId,Tags[?Key==`Name`].Value|[0]]' --output table\n\n# \"NAT gateways\"\naws ec2 describe-nat-gateways \\\n  --query 'NatGateways[].[NatGatewayId,VpcId,SubnetId,State,NatGatewayAddresses[0].PublicIp]' --output table\n\n# \"VPC endpoints\"\naws ec2 describe-vpc-endpoints \\\n  --query 'VpcEndpoints[].[VpcEndpointId,VpcId,ServiceName,State,VpcEndpointType]' --output table\n\n# \"VPC peering connections\"\naws ec2 describe-vpc-peering-connections \\\n  --query 'VpcPeeringConnections[].[VpcPeeringConnectionId,Status.Code,RequesterVpcInfo.VpcId,AccepterVpcInfo.VpcId]' --output table\n\n# \"NACLs\" \u002F \"network ACLs\"\naws ec2 describe-network-acls \\\n  --query 'NetworkAcls[].[NetworkAclId,VpcId,IsDefault]' --output table\n\n# \"Transit Gateways\"\naws ec2 describe-transit-gateways \\\n  --query 'TransitGateways[].[TransitGatewayId,State,Description]' --output table\n```\n\n#### Load Balancers & DNS\n```bash\n# \"load balancers\" \u002F \"ALBs\" \u002F \"NLBs\"\naws elbv2 describe-load-balancers \\\n  --query 'LoadBalancers[].[LoadBalancerName,Type,Scheme,State.Code,DNSName]' --output table\n\n# \"target groups\"\naws elbv2 describe-target-groups \\\n  --query 'TargetGroups[].[TargetGroupName,Protocol,Port,TargetType,VpcId]' --output table\n\n# \"target health for \u003Ctarget-group-arn>\"\naws elbv2 describe-target-health --target-group-arn \u003Carn> \\\n  --query 'TargetHealthDescriptions[].[Target.Id,TargetHealth.State,TargetHealth.Description]' --output table\n\n# \"Route 53 hosted zones\" \u002F \"DNS zones\"\naws route53 list-hosted-zones \\\n  --query 'HostedZones[].[Id,Name,Config.PrivateZone,ResourceRecordSetCount]' --output table\n\n# \"DNS records in zone \u003Cid>\"\naws route53 list-resource-record-sets --hosted-zone-id \u003Cid> \\\n  --query 'ResourceRecordSets[].[Name,Type,TTL]' --output table\n\n# \"CloudFront distributions\"\naws cloudfront list-distributions \\\n  --query 'DistributionList.Items[].[Id,DomainName,Status,Origins.Items[0].DomainName]' --output table\n\n# \"VPN connections\"\naws ec2 describe-vpn-connections \\\n  --query 'VpnConnections[].[VpnConnectionId,State,Type,CustomerGatewayId]' --output table\n\n# \"Direct Connect connections\"\naws directconnect describe-connections \\\n  --query 'connections[].[connectionId,connectionName,connectionState,bandwidth]' --output table\n```\n\n---\n\n### SECURITY & IDENTITY\n\n#### IAM\n```bash\n# \"IAM users\" \u002F \"list users\"\naws iam list-users \\\n  --query 'Users[].[UserName,UserId,CreateDate,PasswordLastUsed]' --output table\n\n# \"IAM roles\" \u002F \"list roles\"\naws iam list-roles \\\n  --query 'Roles[].[RoleName,RoleId,CreateDate]' --output table\n\n# \"IAM policies attached to role \u003Cname>\"\naws iam list-attached-role-policies --role-name \u003Cname> \\\n  --query 'AttachedPolicies[].[PolicyName,PolicyArn]' --output table\n\n# \"IAM groups\"\naws iam list-groups \\\n  --query 'Groups[].[GroupName,GroupId,CreateDate]' --output table\n\n# \"IAM policies (customer managed)\"\naws iam list-policies --scope Local \\\n  --query 'Policies[].[PolicyName,AttachmentCount,CreateDate]' --output table\n\n# \"who has MFA enabled\" \u002F \"MFA devices\"\naws iam list-virtual-mfa-devices \\\n  --query 'VirtualMFADevices[].[SerialNumber,User.UserName,EnableDate]' --output table\n\n# \"IAM account password policy\"\naws iam get-account-password-policy\n\n# \"IAM account summary\"\naws iam get-account-summary\n```\n\n#### Secrets Manager\n```bash\n# \"list secrets\" \u002F \"Secrets Manager secrets\" \u002F \"show secrets\"\naws secretsmanager list-secrets \\\n  --query 'SecretList[].[Name,ARN,LastChangedDate,LastAccessedDate,Description]' --output table\n\n# \"secret metadata for \u003Cname>\"\naws secretsmanager describe-secret --secret-id \u003Cname> \\\n  --query '{Name:Name,ARN:ARN,RotationEnabled:RotationEnabled,LastRotatedDate:LastRotatedDate,Tags:Tags}'\n\n# \"secrets with rotation enabled\"\naws secretsmanager list-secrets \\\n  --query 'SecretList[?RotationEnabled==`true`].[Name,LastRotatedDate]' --output table\n```\n\n> ⚠️ **Note**: Secret **values** are never retrieved (`get-secret-value` is excluded). Only metadata is shown.\n\n#### SSM Parameter Store\n```bash\n# \"SSM parameters\" \u002F \"Parameter Store\"\naws ssm describe-parameters \\\n  --query 'Parameters[].[Name,Type,LastModifiedDate,Description]' --output table\n\n# \"SSM parameters by path \u003Cpath>\"\naws ssm describe-parameters \\\n  --parameter-filters \"Key=Path,Values=\u003Cpath>\" \\\n  --query 'Parameters[].[Name,Type,LastModifiedDate]' --output table\n```\n\n> ⚠️ **Note**: Parameter **values** are never retrieved (`get-parameter` is excluded). Only metadata is shown.\n\n#### KMS & Certificates\n```bash\n# \"KMS keys\" \u002F \"encryption keys\"\naws kms list-keys --query 'Keys[].[KeyId,KeyArn]' --output table\n\n# \"KMS key details for \u003Cid>\"\naws kms describe-key --key-id \u003Cid> \\\n  --query 'KeyMetadata.[KeyId,Description,KeyState,KeyUsage,CreationDate,Enabled]'\n\n# \"KMS aliases\"\naws kms list-aliases \\\n  --query 'Aliases[].[AliasName,AliasArn,TargetKeyId]' --output table\n\n# \"SSL certificates\" \u002F \"ACM certificates\"\naws acm list-certificates \\\n  --query 'CertificateSummaryList[].[CertificateArn,DomainName,Status,RenewalEligibility]' --output table\n\n# \"certificate details for \u003Carn>\"\naws acm describe-certificate --certificate-arn \u003Carn> \\\n  --query 'Certificate.[DomainName,Status,NotAfter,NotBefore,InUseBy]'\n```\n\n#### GuardDuty, Security Hub & Config\n```bash\n# \"GuardDuty detectors\"\naws guardduty list-detectors --query 'DetectorIds' --output table\n\n# \"GuardDuty findings\"\naws guardduty list-findings --detector-id \u003Cid> --query 'FindingIds' --output table\n\n# \"Security Hub findings\"\naws securityhub get-findings \\\n  --query 'Findings[].[Title,Severity.Label,WorkflowState,UpdatedAt]' --output table\n\n# \"AWS Config rules\"\naws configservice describe-config-rules \\\n  --query 'ConfigRules[].[ConfigRuleName,ConfigRuleState,Source.SourceIdentifier]' --output table\n\n# \"non-compliant resources\"\naws configservice get-compliance-summary-by-config-rule \\\n  --query 'ComplianceSummariesByConfigRule[].[ConfigRuleName,Compliance.ComplianceType]' --output table\n```\n\n---\n\n### MESSAGING & EVENTS\n\n```bash\n# \"SQS queues\" \u002F \"list queues\"\naws sqs list-queues --query 'QueueUrls' --output table\n\n# \"SQS queue details \u002F message count for \u003Curl>\"\naws sqs get-queue-attributes --queue-url \u003Curl> \\\n  --attribute-names ApproximateNumberOfMessages,ApproximateNumberOfMessagesNotVisible,ApproximateAgeOfOldestMessage\n\n# \"SNS topics\"\naws sns list-topics --query 'Topics[].TopicArn' --output table\n\n# \"SNS subscriptions\"\naws sns list-subscriptions \\\n  --query 'Subscriptions[].[SubscriptionArn,Protocol,Endpoint,TopicArn]' --output table\n\n# \"EventBridge rules\"\naws events list-rules \\\n  --query 'Rules[].[Name,State,ScheduleExpression,EventPattern]' --output table\n\n# \"EventBridge event buses\"\naws events list-event-buses \\\n  --query 'EventBuses[].[Name,Arn]' --output table\n\n# \"Kinesis streams\"\naws kinesis list-streams --query 'StreamNames' --output table\n\n# \"Kinesis Firehose delivery streams\"\naws firehose list-delivery-streams --query 'DeliveryStreamNames' --output table\n```\n\n---\n\n### API GATEWAY & SERVERLESS\n\n```bash\n# \"API Gateway APIs\" \u002F \"REST APIs\"\naws apigateway get-rest-apis \\\n  --query 'items[].[id,name,description,createdDate]' --output table\n\n# \"HTTP APIs\" \u002F \"API Gateway v2\"\naws apigatewayv2 get-apis \\\n  --query 'Items[].[ApiId,Name,ProtocolType,ApiEndpoint,CreatedDate]' --output table\n\n# \"Step Functions state machines\" \u002F \"workflows\"\naws stepfunctions list-state-machines \\\n  --query 'stateMachines[].[name,stateMachineArn,type,creationDate]' --output table\n\n# \"Step Functions executions for \u003Carn>\"\naws stepfunctions list-executions --state-machine-arn \u003Carn> \\\n  --query 'executions[].[name,status,startDate,stopDate]' --output table\n```\n\n---\n\n### MONITORING & OBSERVABILITY\n\n```bash\n# \"CloudWatch alarms\" \u002F \"list alarms\"\naws cloudwatch describe-alarms \\\n  --query 'MetricAlarms[].[AlarmName,StateValue,MetricName,Namespace,Threshold]' --output table\n\n# \"alarms in ALARM state\" \u002F \"triggered alarms\"\naws cloudwatch describe-alarms --state-value ALARM \\\n  --query 'MetricAlarms[].[AlarmName,MetricName,StateReason]' --output table\n\n# \"CloudWatch dashboards\"\naws cloudwatch list-dashboards \\\n  --query 'DashboardEntries[].[DashboardName,LastModified,Size]' --output table\n\n# \"CloudWatch log groups\"\naws logs describe-log-groups \\\n  --query 'logGroups[].[logGroupName,retentionInDays,storedBytes]' --output table\n\n# \"CloudTrail trails\"\naws cloudtrail describe-trails \\\n  --query 'trailList[].[Name,S3BucketName,IsMultiRegionTrail,LogFileValidationEnabled]' --output table\n\n# \"ECR repositories\" \u002F \"container registries\"\naws ecr describe-repositories \\\n  --query 'repositories[].[repositoryName,repositoryUri,createdAt]' --output table\n```\n\n---\n\n### COST & BILLING\n\n```bash\n# \"current month cost\" \u002F \"how much am I spending\"\naws ce get-cost-and-usage \\\n  --time-period Start=$(date -u +%Y-%m-01),End=$(date -u +%Y-%m-%d) \\\n  --granularity MONTHLY --metrics BlendedCost \\\n  --query 'ResultsByTime[].[TimePeriod.Start,Total.BlendedCost.Amount,Total.BlendedCost.Unit]' \\\n  --output table\n\n# \"cost by service\" \u002F \"spending breakdown\"\naws ce get-cost-and-usage \\\n  --time-period Start=$(date -u -d '30 days ago' +%Y-%m-%d),End=$(date -u +%Y-%m-%d) \\\n  --granularity MONTHLY --metrics BlendedCost \\\n  --group-by Type=DIMENSION,Key=SERVICE --output table\n\n# \"AWS Budgets\"\naws budgets describe-budgets \\\n  --account-id $(aws sts get-caller-identity --query Account --output text) \\\n  --query 'Budgets[].[BudgetName,BudgetType,BudgetLimit.Amount,CalculatedSpend.ActualSpend.Amount]' \\\n  --output table\n\n# \"Trusted Advisor recommendations\"\naws support describe-trusted-advisor-checks --language en \\\n  --query 'checks[].[id,name,category]' --output table\n```\n\n---\n\n### CROSS-SERVICE QUERIES\n\n```bash\n# \"resources tagged Environment=production\" \u002F \"all production resources\"\naws resourcegroupstaggingapi get-resources \\\n  --tag-filters Key=Environment,Values=production \\\n  --query 'ResourceTagMappingList[].[ResourceARN]' --output table\n\n# \"all resources tagged \u003Ckey>=\u003Cvalue>\"\naws resourcegroupstaggingapi get-resources \\\n  --tag-filters Key=\u003Ckey>,Values=\u003Cvalue> \\\n  --query 'ResourceTagMappingList[].[ResourceARN,Tags]' --output table\n\n# \"inventory of all resources\" (AWS Config)\naws configservice list-discovered-resources --resource-type \u003Ctype> \\\n  --query 'resourceIdentifiers[].[resourceType,resourceId,resourceName]' --output table\n```\n\n---\n\n## Output Formatting Rules\n\n1. Always use `--output table` for list results; use `--output json` only when deep detail is explicitly requested\n2. Always use `--query` to extract only relevant fields — never dump raw JSON\n3. For large result sets (>20 items), show a count first, then offer to filter\n4. When a command returns nothing, explain why (wrong region, no resources, insufficient permissions)\n5. Offer to drill into a specific resource: \"Found 47 EC2 instances. Filter by state, type, or tag?\"\n\n## Error Handling\n\n| Error | Response |\n|---|---|\n| `AccessDenied` | \"You don't have permission to list [resource]. Required: `\u003Cservice>:\u003CAction>`.\" |\n| `NoCredentialProviders` | \"Run `aws configure` or set `AWS_PROFILE`.\" |\n| Empty result | \"No [resources] found in [region]. Check another region?\" |\n| Invalid identifier | \"Could not find '[name]'. Check the name or provide the resource ID.\" |\n",{"description":7},"main","58843b159d7a4050d6b785a98b908cce505c0b92","agent\u002Fskills\u002Faws-resource-query",0,"https:\u002F\u002Fgithub.com\u002FReihantt6\u002Fsns-myagent","https:\u002F\u002Fgithub.com\u002FReihantt6","reihsns.web.id","2026-08-19 20:08:18",{"source":8,"skillName":5,"commands":33,"prompt":43,"zipAvailable":44},[34,37,40],{"tool":35,"command":36},"npx","npx skills add Reihantt6\u002Fsns-myagent --skill aws-resource-query",{"tool":38,"command":39},"bunx","bunx skills add Reihantt6\u002Fsns-myagent --skill aws-resource-query",{"tool":41,"command":42},"pnpm","pnpm dlx skills add Reihantt6\u002Fsns-myagent --skill aws-resource-query","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FReihantt6\u002Fsns-myagent\u002Fblob\u002Fmain\u002Fagent\u002Fskills\u002Faws-resource-query\u002FSKILL.md",true,[],[47,54,61,68,75,82],{"skillNo":48,"name":49,"nameZh":6,"description":50,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":51,"categories":52,"keywords":53,"publishedAt":19},"01M77XDCYZ407XYMF2T4P6F7VT","youtube-transcript","Extract transcripts from YouTube videos. Use when the user asks for a transcript, subtitles, or captions of a YouTube video and provides a YouTube URL (youtube.com\u002Fwatch?v=, youtu.be\u002F, or similar). Supports output with or without timestamps.","https:\u002F\u002Fgithub.com\u002FReihantt6\u002Fsns-myagent\u002Fblob\u002Fmain\u002Fagent\u002Fskills\u002Fyoutube-transcript\u002FSKILL.md",[],[],{"skillNo":55,"name":56,"nameZh":6,"description":57,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":58,"categories":59,"keywords":60,"publishedAt":19},"01M77XD7PBC98J6MXGJJ2TJ8DX","youtube-thumbnail-design","YouTube thumbnail design with specific dimensions, contrast rules, and mobile preview optimization. Covers safe zones, text placement, face expression psychology, and A\u002FB testing. Use for: YouTube thumbnails, video cover images, click-through optimization. Triggers: youtube thumbnail, thumbnail design, video thumbnail, click through rate, ctr optimization, youtube cover, video cover image, thumbnail maker, thumbnail tips, youtube design, video preview image","https:\u002F\u002Fgithub.com\u002FReihantt6\u002Fsns-myagent\u002Fblob\u002Fmain\u002Fagent\u002Fskills\u002Fyoutube-thumbnail-design\u002FSKILL.md",[],[],{"skillNo":62,"name":63,"nameZh":6,"description":64,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":65,"categories":66,"keywords":67,"publishedAt":19},"01M77XD2541C8HXJ6RHYZP4NGJ","youtube-short-maker","Make YouTube Shorts that hold attention with Pexo — vertical 9:16, fast-paced, hook in the first 3 seconds. Describe your topic and Pexo writes the script, generates the shots, picks the models, and assembles a finished Short with music and captions. Use for YouTube Shorts: \"youtube short\", \"make a youtube short\", \"shorts video\", \"short-form video\". NOT for long-form or landscape video.","https:\u002F\u002Fgithub.com\u002FReihantt6\u002Fsns-myagent\u002Fblob\u002Fmain\u002Fagent\u002Fskills\u002Fyoutube-short-maker\u002FSKILL.md",[],[],{"skillNo":69,"name":70,"nameZh":6,"description":71,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":74,"publishedAt":19},"01M77XCXKVSYK7KTZ3PQBVVGFD","xcode-project-setup","Safely modifies Xcode projects (.pbxproj) to add Swift Packages and link files. Use this skill whenever an iOS project needs dependencies installed (e.g. Firebase, Alamofire).","https:\u002F\u002Fgithub.com\u002FReihantt6\u002Fsns-myagent\u002Fblob\u002Fmain\u002Fagent\u002Fskills\u002Fxcode-project-setup\u002FSKILL.md",[],[],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":19},"01M77XCR1DV8ZQK2NHWKVY4EWX","x402","Set up Browser Use Cloud payments with x402 — pay per request from a crypto wallet (USDC on Base mainnet), no signup or API key. Two setups it works out up front — \"just use it\" (set up a wallet so you or Claude Code can run cloud browser tasks paid from the wallet — Claude writes and runs throwaway scripts, nothing touches your codebase) or \"build it in\" (install the SDK and write the key + code into your project). Walks through wallet setup, funding, .env, and a ~$1 test run. Use when the user asks about x402, pay-per-use, USDC payments, or wants Browser Use Cloud without an API key. For the free-tier signup (reverse-CAPTCHA → API key), use `browser-use cloud signup` or the `cloud` skill instead.","https:\u002F\u002Fgithub.com\u002FReihantt6\u002Fsns-myagent\u002Fblob\u002Fmain\u002Fagent\u002Fskills\u002Fx402\u002FSKILL.md",[],[],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":19},"01M77XCMD3R3ZBZQQSW6E0793B","x-twitter-scraper","Build GitHub Copilot workflows with Xquik X API SDKs, REST endpoints, hosted Apify Actor runs, MCP tools, TweetClaw OpenClaw plugin installs, signed webhooks, tweet search, user lookup, follower exports, media actions, and agent automation.","https:\u002F\u002Fgithub.com\u002FReihantt6\u002Fsns-myagent\u002Fblob\u002Fmain\u002Fagent\u002Fskills\u002Fx-twitter-scraper\u002FSKILL.md",[],[]]