AWS Cloud Operations Skill

Installation

The skill invokes the AWS CLI v2. Install and configure:

Linux x86

Download

AWS CLI v2

, unzip, then

sudo ./aws/install

macOS

:

curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg"

then run the installer

Windows

Download MSI from AWS CLI v2 or use msiexec ; or install via package managers Configure: aws configure (access key, secret, region). Verify: aws --version Cheat Sheet & Best Practices Identity & config: aws sts get-caller-identity — who am I; aws configure list-profiles — list profiles. S3: aws s3 ls ; aws s3 cp s3://bucket/ ; aws s3 sync ./dir s3://bucket/ ; aws s3 rm s3://bucket/key . Lambda: aws lambda list-functions ; aws lambda invoke --function-name X output.json ; aws lambda get-function --function-name X . CloudWatch: aws cloudwatch list-metrics ; aws cloudwatch get-metric-statistics ; aws cloudwatch describe-alarms ; put-metric-alarm for alerts. EC2: aws ec2 describe-instances ; start-instances / stop-instances / terminate-instances with --instance-ids . Best practices: Use IAM roles over long-lived keys; set AWS_REGION / AWS_PROFILE ; use --output json and --query to limit response size; run destructive ops only after describe to confirm resources. Certifications & Training Free: AWS Skill Builder — exam prep, Cloud Quest, Cloud Essentials. Cloud Practitioner (CLF-C02): Cloud concepts, security/compliance, technology/services, billing (~6 months exposure). Solutions Architect Associate: Next step; prep on Skill Builder. Skill data: Map to S3, Lambda, CloudWatch, EC2, IAM; security best practices; no hardcoded credentials. Hooks & Workflows Suggested hooks: Pre-deploy: validate credentials ( aws sts get-caller-identity ). Cost-tracking hook: optional CloudWatch/billing checks. No mandatory hook; use when devops is routed for AWS tasks. Workflows: Use with devops (contextual: aws_project ). Flow: detect AWS project → load aws-cloud-ops → run CLI via skill script. See operations/incident-response if debugging AWS resources. Overview Provides 90%+ context savings vs raw AWS MCP server. Multi-service support with progressive disclosure by service category. Requirements AWS CLI v2 Configured credentials (AWS_PROFILE or ~/.aws/credentials) AWS_REGION environment variable Tools (Progressive Disclosure) CloudWatch Operations Tool Description Confirmation logs-groups List log groups No logs-tail Tail log stream No logs-filter Filter log events No metrics-list List metrics No metrics-get Get metric data No alarm-list List alarms No alarm-create Create alarm Yes S3 Operations Tool Description Confirmation s3-ls List buckets/objects No s3-cp Copy objects Yes s3-sync Sync directories Yes s3-rm Delete objects Yes Lambda Operations Tool Description Confirmation lambda-list List functions No lambda-get Get function details No lambda-invoke Invoke function Yes lambda-logs Get function logs No EC2 Operations Tool Description Confirmation ec2-list List instances No ec2-describe Describe instance No ec2-start Start instance Yes ec2-stop Stop instance Yes sg-list List security groups No IAM Operations (Read-Only) Tool Description Confirmation iam-users List users No iam-roles List roles No iam-policies List policies No Quick Reference

List EC2 instances

aws ec2 describe-instances --output table

Tail CloudWatch logs

aws logs tail /aws/lambda/my-function --follow

List S3 buckets

aws s3 ls

Invoke Lambda

aws lambda invoke --function-name my-func output.json

Configuration

AWS_PROFILE

Named profile to use

AWS_REGION

Target region (e.g., us-east-1)

AWS_DEFAULT_OUTPUT

Output format (json/table/text) Security ⚠️ Never hardcode credentials ⚠️ Use IAM roles when possible ⚠️ IAM write operations are blocked Agent Integration devops (primary): Cloud operations cloud-integrator (primary): Multi-cloud incident-responder (secondary): Troubleshooting Troubleshooting Issue Solution Access denied Check IAM permissions Region error Set AWS_REGION Credentials Run aws configure Memory Protocol (MANDATORY) Before starting: Read .claude/context/memory/learnings.md After completing: New pattern -> .claude/context/memory/learnings.md Issue found -> .claude/context/memory/issues.md Decision made -> .claude/context/memory/decisions.md ASSUME INTERRUPTION: If it's not in memory, it didn't happen.